[rocker9455]

Hi,
i was told to post a hijack this logfile by serverguy from this post:
http://www.computer-juice.com/forums...998/#post90830

Here it is:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:36:22, on 05/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\POP Peeper\POPPeeper.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\filehippo.com\UpdateChecker.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\CalcFire\CalcFire.exe
C:\Program Files\FreshIP\FreshIP.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Trend Micro\HijackThis\Sniper.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [POP Peeper] "C:\Program Files\POP Peeper\POPPeeper.exe" -min
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [filehippo.com] "C:\Program Files\filehippo.com\UpdateChecker.exe" /background
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: CalcFire.lnk = C:\Program Files\CalcFire\CalcFire.exe
O4 - Startup: FreshIP.lnk = C:\Program Files\FreshIP\FreshIP.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe

--
End of file - 5869 bytes

[evilfantasy]

Download Malwarebytes' Anti-Malware (MBAM)

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to the following:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

[rocker9455]

Malwarebytes' Anti-Malware 1.30
Database version: 1368
Windows 5.1.2600 Service Pack 2

06/11/2008 07:44:27
mbam-log-2008-11-06 (07-44-27).txt

Scan type: Quick Scan
Objects scanned: 43086
Time elapsed: 3 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\run32.sys (Trojan.Agent) -> Quarantined and deleted successfully.

[evilfantasy]

Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.

For Windows XP Systems install the Recovery Console:

- If you are using Windows XP and do not already have the Recovery Console installed, please ensure your Internet connection is active (if possible) and click Yes.
- If for some reason your Internet is not working click No.
- If you are not using Windows XP, you will not be prompted.
- When prompted to accept the EULA click OK.
- Accept Microsoft's EULA (Click Yes).
- When you are told that the RC is installed correctly click YES to continue scanning for malware.

When finished ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

[rocker9455]

ComboFix 08-11-05.02 - Administrator 2008-11-06 17:52:06.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.607 [GMT 0:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-10-06 to 2008-11-06 )))))))))))))))))))))))))))))))
.

2008-11-06 07:59 . 2008-11-06 07:59 236 --a------ C:\sqmdata02.sqm
2008-11-06 07:59 . 2008-11-06 07:59 200 --a------ C:\sqmnoopt02.sqm
2008-11-06 07:39 . 2008-11-06 07:39 236 --a------ C:\sqmdata01.sqm
2008-11-06 07:39 . 2008-11-06 07:39 200 --a------ C:\sqmnoopt01.sqm
2008-11-05 22:36 . 2008-11-05 22:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes
2008-11-05 22:35 . 2008-11-05 22:35 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-05 22:35 . 2008-11-05 22:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-05 22:35 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-05 22:35 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-05 19:35 . 2008-11-05 19:35 <DIR> d-------- c:\program files\Trend Micro
2008-11-04 22:07 . 2008-11-04 22:07 <DIR> d-------- c:\program files\Cabos
2008-11-04 22:07 . 2008-11-04 22:07 <DIR> d-------- c:\documents and settings\Administrator\Shared
2008-11-04 22:07 . 2008-11-04 22:09 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Cabos
2008-11-04 17:50 . 2008-11-04 17:50 <DIR> d-------- C:\CloneDVDTemp
2008-11-04 17:49 . 2008-11-04 17:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\Elaborate Bytes
2008-11-04 17:37 . 2008-11-04 17:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\SlySoft
2008-11-04 17:33 . 2008-11-04 17:33 <DIR> d-------- c:\program files\Elaborate Bytes
2008-11-04 17:31 . 2008-11-04 17:31 <DIR> d-------- c:\program files\SlySoft
2008-11-03 17:05 . 2008-11-03 17:05 2,560 --a------ c:\windows\_MSRSTRT.EXE
2008-11-03 17:05 . 2008-11-03 17:05 236 --a------ C:\sqmdata00.sqm
2008-11-03 17:05 . 2008-11-03 17:05 200 --a------ C:\sqmnoopt00.sqm
2008-11-03 17:04 . 2008-11-03 17:05 <DIR> d-------- c:\program files\Your Uninstaller 2008
2008-11-03 17:04 . 2008-11-03 17:05 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-03 17:04 . 2008-11-03 17:04 <DIR> d-------- c:\documents and settings\Administrator\Application Data\URSoft
2008-11-03 17:01 . 2008-11-03 17:09 158 --a------ c:\windows\nurtab.bat
2008-11-03 07:53 . 2008-11-03 07:53 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ImgBurn
2008-11-03 07:50 . 2008-11-03 07:50 0 --------- c:\windows\WB.ini
2008-11-02 13:19 . 2008-11-02 13:36 64 --a------ c:\windows\prio.ini
2008-11-01 22:23 . 2008-11-01 22:23 <DIR> d-------- c:\documents and settings\Administrator\Application Data\vlc
2008-11-01 18:49 . 2008-11-01 18:49 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-01 11:04 . 2008-11-06 07:46 <DIR> d-------- c:\documents and settings\Administrator\Tracing
2008-11-01 11:00 . 2008-11-01 11:03 <DIR> d-------- c:\program files\Mozilla Firefox 3.1 Beta 1
2008-11-01 10:59 . 2008-11-01 10:59 <DIR> d-------- c:\program files\Microsoft
2008-11-01 10:57 . 2008-11-01 10:58 <DIR> d-------- c:\program files\Windows Live
2008-11-01 10:54 . 2008-11-01 10:54 <DIR> d-------- c:\program files\filehippo.com
2008-11-01 10:51 . 2008-11-01 10:51 <DIR> d-------- c:\program files\Common Files\Windows Live
2008-10-31 13:40 . 2008-11-04 21:34 <DIR> d-------- c:\program files\DupeEliminator
2008-10-31 10:32 . 2008-10-31 10:32 <DIR> d-------- c:\program files\Foxit Software
2008-10-30 23:21 . 2008-10-30 23:21 <DIR> d-------- c:\windows\Sun
2008-10-30 22:55 . 2008-10-30 23:00 <DIR> d-------- c:\program files\Free Music Zilla
2008-10-30 22:55 . 2008-10-30 22:59 <DIR> d-------- C:\downloads
2008-10-30 22:55 . 2008-10-30 22:55 <DIR> d-------- c:\documents and settings\Administrator\Application Data\FMZilla
2008-10-30 22:38 . 2008-10-31 22:55 <DIR> d-------- C:\DVDVideoSoft
2008-10-30 21:03 . 2008-10-30 21:03 <DIR> d-------- c:\program files\Belkin
2008-10-30 21:03 . 2005-10-03 09:49 204,800 --a------ c:\windows\system32\UploadDLL.dll
2008-10-30 21:03 . 2005-11-20 04:31 192,512 --a------ c:\windows\system32\blkwcd.dll
2008-10-30 21:03 . 2005-10-03 09:50 167,936 --a------ c:\windows\system32\BelkinwcuiDLL.dll
2008-10-30 21:03 . 2005-10-03 09:50 101,888 --a------ c:\windows\system32\CrashRpt.dll
2008-10-30 21:03 . 2005-10-03 09:49 81,920 --a------ c:\windows\system32\brdcm2k.dll
2008-10-30 21:03 . 2005-10-03 09:49 61,440 --a------ c:\windows\system32\BelkinHWStatus.dll
2008-10-30 21:03 . 2004-10-29 12:09 53,248 --a------ c:\windows\system32\preflib.dll
2008-10-30 20:23 . 2008-10-30 20:23 20,747 --a------ c:\windows\system32\drivers\AegisP.sys
2008-10-30 20:23 . 2003-07-24 12:10 17,149 --a------ c:\windows\system32\DNINDIS5.SYS
2008-10-30 20:21 . 2008-10-30 20:21 <DIR> d-------- c:\program files\DVDVideoSoft
2008-10-30 20:21 . 2008-10-30 20:22 <DIR> d-------- c:\program files\Common Files\DVDVideoSoft
2008-10-30 20:21 . 2002-01-05 14:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2008-10-30 11:23 . 2008-10-30 11:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\vsosdk
2008-10-30 09:53 . 2008-11-02 16:08 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Vso
2008-10-30 09:53 . 2008-10-30 09:53 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys
2008-10-30 09:53 . 2008-10-30 09:53 47,360 --a------ c:\documents and settings\Administrator\Application Data\pcouffin.sys
2008-10-30 09:52 . 2008-10-30 09:52 <DIR> d-------- c:\program files\VSO
2008-10-30 09:52 . 2004-05-04 12:53 1,645,320 --a------ c:\windows\gdiplus.dll
2008-10-30 09:52 . 2006-05-20 17:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2008-10-30 09:52 . 2006-05-11 20:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2008-10-30 09:52 . 2006-09-29 13:24 217,127 --a------ c:\windows\system32\drv43260.dll
2008-10-30 09:52 . 2006-09-29 13:25 208,935 --a------ c:\windows\system32\drv33260.dll
2008-10-30 09:52 . 2006-09-29 13:26 176,165 --a------ c:\windows\system32\drv23260.dll
2008-10-30 09:52 . 2007-03-18 21:37 65,602 --a------ c:\windows\system32\cook3260.dll
2008-10-29 14:11 . 2008-10-29 15:48 <DIR> d-------- c:\documents and settings\Administrator\Application Data\dvdcss
2008-10-29 13:17 . 2008-10-29 13:17 376 --a------ c:\windows\ODBC.INI
2008-10-29 13:16 . 2003-06-18 17:31 17,920 --a------ c:\windows\system32\mdimon.dll
2008-10-29 13:13 . 2008-10-29 13:13 <DIR> d-------- c:\program files\Microsoft ActiveSync
2008-10-29 13:10 . 2008-10-29 13:10 <DIR> d-------- c:\windows\SHELLNEW
2008-10-29 13:10 . 2008-10-29 13:10 <DIR> d-------- c:\program files\Microsoft.NET
2008-10-29 13:08 . 2008-10-29 13:08 <DIR> dr-h----- C:\MSOCache
2008-10-29 11:53 . 2008-10-29 11:53 12,670 --a------ c:\windows\system32\LexFiles.ulf
2008-10-29 11:52 . 2008-10-30 09:38 <DIR> d-------- c:\temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15}
2008-10-29 11:52 . 2008-10-29 11:53 <DIR> d-------- c:\program files\Lexmark 730 Series
2008-10-29 11:17 . 2008-10-31 13:03 <DIR> d-------- c:\program files\Handbrake
2008-10-29 09:27 . 2008-10-29 09:27 <DIR> d-------- c:\program files\FreshIP
2008-10-29 09:27 . 2008-10-29 09:27 <DIR> d-------- c:\program files\Ejector
2008-10-29 09:27 . 2008-10-29 09:27 <DIR> d-------- c:\program files\CalcFire
2008-10-29 09:26 . 2008-10-29 09:26 <DIR> d-------- c:\windows\SIS
2008-10-29 09:26 . 2008-10-29 09:26 <DIR> d-------- c:\program files\sisagp
2008-10-29 09:26 . 2008-10-29 09:26 <DIR> d-------- c:\program files\SiS VGA Utilities V3.81
2008-10-29 09:26 . 2008-10-30 21:03 <DIR> d--h----- c:\program files\InstallShield Installation Information
2008-10-29 09:26 . 2008-10-30 21:03 <DIR> d-------- c:\program files\Common Files\InstallShield
2008-10-29 09:26 . 2007-06-25 16:45 262,144 --a------ c:\windows\system32\sistray.exe
2008-10-29 09:26 . 2006-04-12 19:35 208,896 --a------ c:\windows\Progress.exe
2008-10-29 09:26 . 2007-06-25 16:44 135,168 --------- c:\windows\system32\SiSApCom.dll
2008-10-29 09:26 . 2007-06-25 16:46 110,592 --------- c:\windows\system32\TVMode.dll
2008-10-29 09:26 . 2007-06-29 21:04 92,761 --a------ c:\windows\VGAsetup.ini
2008-10-29 09:26 . 2008-10-29 09:26 78,664 --a------ c:\windows\system32\VGAunistlog.ini
2008-10-29 09:26 . 2007-06-25 16:46 65,536 --------- c:\windows\system32\SiSHook.dll
2008-10-29 09:25 . 2007-06-25 16:46 9,728 --a------ c:\windows\system32\SiSPIns2.dll
2008-10-28 20:06 . 2004-08-03 22:58 5,504 --a------ c:\windows\system32\drivers\MSTEE.sys
2008-10-28 20:05 . 2004-08-03 23:10 85,376 --a------ c:\windows\system32\drivers\NABTSFEC.sys
2008-10-28 20:05 . 2004-08-03 23:10 19,328 --a------ c:\windows\system32\drivers\WSTCODEC.SYS
2008-10-28 20:05 . 2004-08-03 23:10 17,024 --a------ c:\windows\system32\drivers\CCDECODE.sys
2008-10-28 20:05 . 2004-08-04 00:56 16,384 --a------ c:\windows\system32\ipsink.ax
2008-10-28 20:05 . 2004-08-03 23:10 15,360 --a------ c:\windows\system32\drivers\StreamIP.sys
2008-10-28 20:05 . 2004-08-03 23:10 11,136 --a------ c:\windows\system32\drivers\SLIP.sys
2008-10-28 20:05 . 2004-08-03 23:10 10,880 --a------ c:\windows\system32\drivers\NdisIP.sys
2008-10-28 19:49 . 2008-10-28 19:49 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS
2008-10-28 19:49 . 1998-01-23 12:22 304,128 --a------ c:\windows\IsUninst.exe
2008-10-28 19:49 . 2002-08-20 14:58 139,264 --a------ c:\windows\system32\IDEproperty.dll
2008-10-28 19:49 . 2002-10-17 15:14 49,024 --a------ c:\windows\system32\drivers\sisidex.sys
2008-10-28 19:49 . 2002-08-20 17:19 9,472 --a------ c:\windows\system32\drivers\sisperf.sys
2008-10-28 19:49 . 2003-03-25 17:50 4,096 --a------ c:\windows\system32\drivers\siside.sys
2008-10-28 18:36 . 2008-10-28 18:36 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Media Player Classic
2008-10-28 18:19 . 2008-10-28 18:49 <DIR> d-------- c:\windows\system32\Adobe
2008-10-28 18:19 . 2008-08-06 15:27 499,712 --a------ c:\windows\system32\msvcp71.dll
2008-10-28 18:10 . 2008-10-28 18:10 822 --a------ c:\windows\langorig.ini
2008-10-28 17:58 . 2008-03-03 14:25 5,702 --ah----- c:\windows\nod32restoretemdono.reg
2008-10-28 17:58 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg
2008-10-28 17:57 . 2008-10-28 17:57 <DIR> d-------- c:\program files\ESET
2008-10-28 17:57 . 2008-10-28 17:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2008-10-28 17:49 . 2008-10-28 17:49 <DIR> d-------- c:\documents and settings\Administrator\Contacts
2008-10-28 17:07 . 2008-10-28 17:07 <DIR> d-------- c:\program files\POP Peeper
2008-10-28 17:07 . 2008-11-04 20:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\POP Peeper
2008-10-28 17:02 . 2008-10-28 17:02 <DIR> d-------- c:\documents and settings\Administrator\dwhelper
2008-10-28 17:01 . 2008-10-28 17:01 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Apple Computer
2008-10-28 17:01 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-10-28 17:01 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-10-28 17:00 . 2008-10-28 17:00 <DIR> d-------- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-10-28 15:52 --------- d-----w c:\program files\Opera
2008-10-23 15:07 99,904 ----a-w c:\windows\system32\drivers\AnyDVD.sys
2008-09-09 00:03 51,712 ----a-w c:\windows\system32\sirenacm.dll
2008-08-29 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-08-29 09:53 61,440 ----a-w c:\windows\system32\dnssd.dll
2007-07-31 12:00 34,048 ----a-r c:\program files\mozilla firefox\plugins\upd62i9x.dll
2007-07-31 12:00 45,056 ----a-r c:\program files\mozilla firefox\plugins\upd62int.dll
2007-07-31 12:00 34,048 ----a-r c:\program files\opera\program\plugins\upd62i9x.dll
2007-07-31 12:00 45,056 ----a-r c:\program files\opera\program\plugins\upd62int.dll
.

------- Sigcheck -------

2007-07-31 12:00 360576 c7be59b07c6eb74bea6fd67c1b164015 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2007-01-30 1432064]
"POP Peeper"="c:\program files\POP Peeper\POPPeeper.exe" [2008-07-18 1437696]
"µTorrent"="c:\program files\uTorrent\utorrent.exe" [2008-10-28 270128]
"uTorrent"="c:\program files\uTorrent\utorrent.exe" [2008-10-28 270128]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-09-09 3513344]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-01 133104]
"filehippo.com"="c:\program files\filehippo.com\UpdateChecker.exe" [2008-10-22 147968]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-11-04 2259904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-01 136600]
"SiSPower"="SiSPower.dll" [2007-06-25 c:\windows\system32\SiSPower.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2007-07-31 c:\windows\system32\advpack.dll]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
CalcFire.lnk - c:\program files\CalcFire\CalcFire.exe [2008-09-04 283529]
FreshIP.lnk - c:\program files\FreshIP\FreshIP.exe [2008-09-15 232891]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2008-10-29 262144]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer]
"NoInternetIcon"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-09-16 08:44 174328 c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders]
SecurityProviders schannel.dll, digest.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Free Music Zilla\\FMZilla.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfw tdir.sys [2008-02-20 33800]
R1 lusbaudio;Logitech USB Microphone;c:\windows\system32\drivers\OVSound2.sy s [2001-08-17 25216]
R2 JavaQuickStarterService;Java Quick Starter;c:\program files\Java\jre6\bin\jqs.exe [2008-11-01 152984]
R3 QCEmerald;Logitech QuickCam Web;c:\windows\system32\DRIVERS\OVCE.sys [2001-08-17 31872]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2007-07-31 3584]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\progra~1\Belkin\BELKIN~1.11G\DNINDIS5.SY S [2003-07-24 17149]

NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
ShellHWDetection

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs


*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-11-06 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-01 10:54]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\p2eog6ij.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
FF -: plugin - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.131.25\npGoogleOneClick6.dl l
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

************************************************** ************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-06 17:53:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2008-11-06 17:55:07
ComboFix-quarantined-files.txt 2008-11-06 17:54:43
ComboFix2.txt 2008-11-06 17:44:22

Pre-Run: 71,168,983,040 bytes free
Post-Run: 71,160,324,096 bytes free

306

[rocker9455]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:56:55, on 06/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\POP Peeper\POPPeeper.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\filehippo.com\UpdateChecker.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Sniper.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [POP Peeper] "C:\Program Files\POP Peeper\POPPeeper.exe" -min
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [filehippo.com] "C:\Program Files\filehippo.com\UpdateChecker.exe" /background
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: CalcFire.lnk = C:\Program Files\CalcFire\CalcFire.exe
O4 - Startup: FreshIP.lnk = C:\Program Files\FreshIP\FreshIP.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe

--
End of file - 5724 bytes

[evilfantasy]

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

Download CCleaner Slim and save it to your Desktop.- Alternate download link
When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.

• Double-click the CCleaner shortcut on the desktop to start the program.
• Click on the Options block on the left, then choose Cookies.
  • Under Cookies to Delete, highlight any cookies you would like to retain permanently
  • Click the right arrow > to move them to the Cookies to Keep window.
• Go into Options > Advanced uncheck Only delete files in Windows Temp folders older than 48 hours
• Click Cleaner on the left then Run Cleaner on the right to run the program.
• Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

• Caution: Only use the Registry feature if you are very familiar with the registry.
• Always back up your registry before making any changes.
• Exit CCleaner after it has completed it's process.

----------

Download SUPERAntiSpyware.exe

Alternate download link 1
Alternate download link 2

• Double-click the icon on your desktop to run the installer.
• When asked to Update the program definitions, click Yes
• If you encounter any problems while downloading the updates, manually download and unzip them from here
• Next click the Preferences button.

• Under Start-Up Options uncheck the following:
• Start SUPERAntiSpyware when Windows starts
• Show SUPERAntiSpyware icon in system tray
• Show splash screen on startup
  

• Click the Scanning Control tab.
• Under Scanner Options make sure only the following are checked:

• Close browsers before scanning
• Scan for tracking cookies
• Terminate memory threats before quarantining
• Scan Alternate Data Streams
  
• Please leave the others unchecked.
• Click the Close button to leave the Control Center screen.

• On the main screen click Scan your computer
• On the left check the box for the drive you are scanning.
• On the right choose Perform Complete Scan
• Click Next to start the scan. Please be patient while it scans your computer.
• After the scan is complete a summary box will appear. Click OK
• Make sure everything in the white box has a check next to it, then click Next
• It will quarantine what it found and if it asks if you want to reboot, click Yes
• To retrieve the removal information please do the following:

• After reboot, double-click the SUPERAntiSpyware icon on your desktop.
• Click Preferences. Click the Statistics/Logs tab.
• Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
• It will open in your default text editor (preferably Notepad).
• Save the notepad file to your desktop by clicking (in notepad) File > Save As...

• Save the log somewhere you can easily find it. (normally the desktop)
• Click close and close again to exit the program.
• Copy and Paste the log in your post.