text:
Thank you for visiting nature.com. You are using a browser version with limited support for CSS. To obtain the best experience, we recommend you use a more up to date browser (or turn off compatibility mode in Internet Explorer). In the meantime, to ensure continued support, we are displaying the site without styles and JavaScript.

# Global analysis reveals climatic controls on the oxygen isotope composition of cave drip water

## Abstract

The oxygen isotope composition of speleothems is a widely used proxy for past climate change. Robust use of this proxy depends on understanding the relationship between precipitation and cave drip water δ18O. Here, we present the first global analysis, based on data from 163 drip sites, from 39 caves on five continents, showing that drip water δ18O is most similar to the amount-weighted precipitation δ18O where mean annual temperature (MAT) is < 10 °C. By contrast, for seasonal climates with MAT > 10 °C and < 16 °C, drip water δ18O records the recharge-weighted δ18O. This implies that the δ18O of speleothems (formed in near isotopic equilibrium) are most likely to directly reflect meteoric precipitation in cool climates only. In warmer and drier environments, speleothems will have a seasonal bias toward the precipitation δ18O of recharge periods and, in some cases, the extent of evaporative fractionation of stored karst water.

## Introduction

The oxygen isotope composition is by far the most widely reported climate proxy in cave deposits, or speleothems (e.g., stalagmites, stalactites and flowstones1). Multiple processes determine the oxygen isotope composition of speleothems (δ18Ospeleo), with the potential climate signal reflecting the source water (meteoric precipitation) δ18O (δ18Oprecip) and its relationship to local and regional climate. This signal is transferred to the cave through the vadose zone, where it may be mixed with existing waters and fractionated by evaporation. Finally, at the target (the speleothem), the δ18Ospeleo signal can be further altered by non-equilibrium fractionation processes and temperature-dependent fractionation during calcite precipitation. See refs. 1,2,3 for in-depth reviews of these processes and climate signal transformation.

Within the speleothem research community, it is widely acknowledged that a cave monitoring approach is necessary to fully understand, and constrain quantitatively, the extent that the climate signal is preserved in δ18Ospeleo (e.g., during transfer from the source to the target). The measurement of drip water hydrology4, drip water geochemistry5, cave environment6 and calcite growth and geochemistry7, as well as surface climate parameters, allows empirical relationships between the source and the target to be determined. With monitoring data, regression models between climate and speleothem proxy data can be developed8, proxy interpretations can be evaluated9, input data for forward or proxy system models can be generated10,11,12,13 and the extent that speleothem calcite precipitates in isotopic equilibrium with its associated drip water can be assessed7,14,15.

Recently, a new global database of speleothem carbon and oxygen isotope proxy records was compiled16,17. This archive includes 455 δ18Ospeleo records, with over 324 covering intervals within the last 21 ka16,17. Some regions have δ18Ospeleo records that span glacial–interglacial intervals (e.g. monsoon regions18,19,20), whereas other regions have records that are more complex (e.g. water-limited regions where δ18Ospeleo exhibits high magnitude and frequency variability21,22). In water-limited environments, potential mechanisms by which δ18Ospeleo can be modified during transit from the source, include evaporative fractionation of water δ18O in the soil; a shallow vadose zone or cave; selective recharge, whereby rainfall events with high amount or intensity have a distinct isotopic composition, typically low δ18O; non-equilibrium deposition during speleothem formation23,24,25,26,27. A fundamental research question is: what are the regional climate parameters where δ18Ospeleo values most faithfully preserve the source signal (δ18Oprecip)? Identification of such climatic regions, and speleothem samples, will have the greatest utility; for example, for research methodologies, such as data assimilation28, which utilise proxy–climate model inter-comparison.

Interpretation of δ18Ospeleo proxy records would benefit from the best possible understanding of the climatic conditions under which oxygen isotope composition of drip water (δ18Odripwater) is most directly related to δ18Oprecip. Here, we compile cave monitoring data with the objective of understanding the modern-day relationship between δ18Oprecip and δ18Odripwater. We compile data sets where there are both cave δ18Odripwater data (1-year or longer data sets) and δ18Oprecip data (of equal duration, amount-weighted and collected close to the cave and similar altitude). The latter enables the amount-weighted precipitation oxygen isotope composition (δ18Oamountwprecip) to be compared with δ18Odripwater. By using a karst hydrology model developed for European climates, monthly modelled recharge amount is used to obtain an annual recharge-weighted δ18O (δ18Orechargewprecip) at European sites. This permits the first analysis of δ18Odripwater, δ18Orechargewprecip, δ18Oamountwprecip and climate parameters. The analyses show that drip water δ18O is most similar to the amount-weighted precipitation δ18O, when mean annual temperature is < 10 °C. The implications for speleothem palaeoclimatology are that speleothems (if formed near isotopic equilibrium) are most likely to directly reflect meteoric precipitation δ18O only in cooler climates.

## Results

### Global water oxygen isotope distributions

We find a strong positive correlation between δ18Odripwater and δ18Oamountwprecip. δ18Orechargewprecip provides a similarly strong correlation, but in this case with a slope and intercept indistinguishable from 1 and 0, respectively. Supplementary Data 1 presents the database of δ18Odripwater and δ18Oamountwprecip compiled from the literature and unpublished data comprising 163 drip sites from 39 caves on five continents. The location of the caves in comparison with modern mean annual temperature (MAT) and the global database of δ18Ospeleo records17 are shown in Fig. 1. Climate regimes represented in the compilation include temperate maritime and semiarid monsoon, Mediterranean, montane and tropical, therefore including a wide range of MAT and aridity, as expressed by the ratio of precipitation to potential evapotranspiration (P/PET).

Figure 2a, b presents the global relationship between δ18Odripwater and δ18Oamountwprecip. The correlation is positive and strong (Spearman’s rank rs = 0.90, p < 0.00001), indicating that at a global scale, δ18Odripwater closely relates to δ18Oamountwprecip. The regression demonstrates that, at this scale, δ18Odripwater is greater than δ18Oamountwprecip where the latter is more positive, typically sites where MAT > 16 °C. Conversely, δ18Odripwater is less than δ18Oamountwprecip where the latter is more negative, typically at sites where MAT < 16 °C. Regional relationships between δ18Odripwater and δ18Oamountwprecip for Europe, China and Australia are quantified in Supplementary Fig. 1. At a regional scale, the correlation is positive, very strong and highly significant for the European region and moderately strong for China.

For cave drip water monitoring sites in Europe, we utilise a karst hydrology model29 to determine the monthly recharge amount (see the ‘Methods’ section), and these monthly recharge values (see Supplementary Table 1) were then used to weight the δ18Oprecip in that month. At the European scale, the relationship between the δ18Odripwater and δ18Oamountwprecip is a strong positive correlation (Spearman’s rank rs = 0.90, p < 0.00001), similar to that observed globally (Fig. 2c, d), although over a more restricted range of δ18O. With recharge weighting, the correlation between the δ18Odripwater and δ18Orechargewprecip remains positive and strong (Spearman’s rank rs = 0.89, p < 0.00001). The intercept and gradient are indistinguishable from 0 to 1, respectively, indicating that after recharge weighting, at the European sites, δ18Odripwater can be explained by δ18Orechargewprecip.

### Climate controls on selective recharge and partial evaporation

We provide empirical evidence from the global δ18Odripwater data set that increasing temperature and decreasing rainfall both increase the absolute difference between δ18Odripwater and δ18Oamountwprecip. Figure 3 explores the global relationship between climate parameters and the difference between amount-weighted precipitation and drip water isotopic composition (Δawp-dw = δ18Oamountwprecip − δ18Odripwater). It can be observed that there is a narrowing in the range of Δawp-dw when MAT is relatively low (<10 °C), the total annual P is high (>1750 mm), the annual PET is low (<800 mm) or the total annual P/PET values are high (>1.5). Linear single and stepwise multiple regression analyses on the global data set showed that the strongest correlation (Spearman’s rank) of the absolute value of Δawp-dw was with the ratio of mean annual temperature (MAT) to the total annual P:

$$|\Delta _{{\mathrm{awp - dw}}}| = 0.0106\left( { \pm 7.90439 \times 10^{ - 4}} \right) \\ \ \ + 0.00719\left( { \pm 8.75606 \times 10^{ - 4}} \right){\mathrm{MAT}}/P\left({{\,}^ \circ {\mathrm{mm}}^{ - 1}} \right)\\ \ \ \ \left( {r_{\mathrm{s}} = 0.51,\,p = 0.001072} \right)$$
(1)

To further explore the relationship between Δawp-dw and these climate parameters, we define a threshold for |Δawp-dw| of more than 0.3‰ as a criterion for determining the significant difference between δ18Oamountwprecip and δ18Odripwater. This is chosen taking into consideration potential uncertainties in δ18O determinations of water and speleothem calcite (analytical uncertainties of 0.06–0.2‰, depending on measurement technique). Considering the climate parameter MAT, 91% of all drip waters with a MAT < 10 °C (n = 34) have a |Δawp-dw| of <0.3‰. Considering the P, then for a P threshold of 1750 mm, 61% of all drip waters (n = 31) have a |Δawp-dw| of < 0.3‰. These empirical observations agree with theoretical understanding that in warmer, water-limited climates, δ18Odripwater may be affected by evaporative fractionation of the water in the soil or shallow karst22,30, or by selective recharge, with an isotopic composition dominated by those rainfall events or seasons that generate recharge26,27. However, we note that a combination of post-infiltration evaporative fractionation and isotopically depleted recharge could lead to observations of |Δawp-dw| < 0.3‰ for some sites with warm and dry climates.

## Discussion

Our recharge modelling demonstrates the importance of selective recharge, and suggests that for a MAT < 16 °C, δ18Odripwater is best interpreted as δ18Orechargewprecip. The 1:1 linearity of the relationship between δ18Orechargewprecip and δ18Odripwater for European sites confirms the importance of selective recharge for this climate range (seasonal climates with a MAT ranging from 7.1 to 16.1 °C, Supplementary Data 1). Selective recharge is minimised at MAT < 10 °C. At these temperatures, the opportunity for soil and shallow karst evaporation is decreased, and karst water stores are more likely to be maintained, allowing mixing of recharge waters that buffer the isotopic impact of any individual recharge event. At a MAT < 10 °C, speleothems that have been deposited close to equilibrium would have the potential of recording past variations of δ18Oamountwprecip, plus a temperature signal from the fractionation during calcite precipitation.

Latitudes poleward of ~35° and high-altitude sites, where MAT < 10 °C (Fig. 1), would be most likely to contain a δ18Ospeleo record of amount-weighted precipitation (northern Europe, high-altitude and northern regions of the Asian monsoon, northern North America and New Zealand). In contrast, δ18Ospeleo records in regions of higher MAT are more likely to have |Δawp-dw| > 0.3 ‰ and would be sensitive to moisture balance changes, due to limited mixing with stored water, selective recharge and/or increased chance of evaporative fractionation of δ18O in the vadose zone. δ18Odripwater, and the associated δ18Ospeleo, can be more positive than amount-weighted precipitation (evaporative fractionation dominates), or either greater or less than amount-weighted precipitation (selective recharge dominates). Regions where this compound signal is most likely are predominantly in latitudes equatorward of ~35° (most of Africa, India, southern Asia, southern Europe, North America and Australia; Fig. 1). Modelling of δ18Orechargewprecip suggests that for seasonal climates with a MAT between 10 and 16 °C (the higher value being the upper bound of the European data set), selective recharge dominates these processes. At this range of MAT (and, we anticipate, at higher MAT), δ18Ospeleo may be a proxy for δ18Orechargewprecip and provides records of paleo-recharge. In addition, when considering δ18Ospeleo, any relationship between δ18Odripwater and climate could be additionally overprinted by non-equilibrium deposition.

Our meta-analysis reveals that the oxygen isotope composition of drip water is primarily determined by the oxygen isotope composition of the recharge water δ18O. At a global scale, we show that the extent to which δ18Odripwater is representative of δ18Oamountwprecip is primarily related to the mean annual temperature and annual precipitation, which determines the extent to which δ18O is further altered by soil and karst processes. To confidently interpret the δ18Odripwater as a specific climate parameter, the relationship between recharge δ18O and climate needs to be understood for specific sites. For sites and regions, characterised by lower temperatures (MAT < 10 °C), where Δawp-dw is likely to be closest to zero, we show that the oxygen isotope composition of drip water is most directly related to the isotopic composition of local rainfall. These regions could produce δ18Ospeleo proxies (if the speleothems are deposited close to equilibrium), where δ18Ospeleo could be used to provide a signal of past δ18Oamountwprecip and cave air temperature (due to the temperature-dependent fractionation during calcite formation), useful for proxy–model assimilations. In these cooler climates, where water in karst stores and fractures is more likely to be well mixed, one would also expect greater agreement in δ18Odripwater between drip sites within a cave. In regions with higher temperatures (MAT > 16 °C), δ18Ospeleo is less likely to represent δ18Orechargewprecip, and instead can contain a compound signal that reflects selective recharge and evaporative fractionation. Such records are of palaeoclimatic value, and may yield a proxy for δ18Orechargewprecip, but are more likely to show greater heterogeneity between coeval records and therefore require a drip-specific interpretation.

Important Quaternary δ18Ospeleo records have been produced from around the world, and in the context of this analysis of modern conditions, we can make several conclusions. Firstly, many palaeoclimate studies interpret the relative changes in δ18Ospeleo over time, and in many cases, monitoring data are not available to guide the interpretation. The climatic controls made here can be used to help guide the interpretation of those records. This is particularly relevant over periods of significant climate change (e.g. glacial–interglacial transitions) and where the climate control on the difference between δ18Oamountwprecip and δ18Odripwater may change over time. A map of the cave sites at modelled last glacial maximum (LGM) surface temperatures is provided in Supplementary Fig. 2, and suggests that a change in the temperature control on the δ18Oamountwprecip–δ18Odripwater relationship is mostly observed in mid-latitudes, and most ubiquitously in the LGM in southern Europe. Secondly, in the Chinese monsoon region, the cooler northern sites are most likely to have δ18Odripwater similar to δ18Oamountwprecip, as reported previously30. However, given that monsoon rainfall requires a land–ocean temperature gradient, there is a trade-off between caves at cooler locations that have δ18Odripwater closest to δ18Oamountwprecip, and those in regions with the strongest monsoon signal. The latter are more likely to experience evaporative fractionation and selective recharge, and therefore less likely to be similar to δ18Oamountwprecip (but may reflect δ18Orechargewprecip). This trade-off would apply to all monsoon regions. At the modern monitoring sites in the Chinese region, where MAT > 10 °C and annual P < 2000 mm (Fig. 3), δ18Oamountwprecip does not correlate with MAT or the total annual P, but δ18Odripwater does positively correlate with both (Supplementary Fig. 3). This appears to be due to the combined overprinting of increasing selective recharge and evaporative fractionation over this range of MAT and offers new insights into the interpretation of δ18Ospeleo in the region. Thirdly, even in regions of exceptionally high rainfall, such as Mulu (Malaysian Borneo) and parts of India, δ18Odripwater can be higher than the δ18Orecharegewprecip31, probably due to the continuous high temperatures, leading to the partial evaporation of vadose water. Analysis of speleothems at caves at higher elevations should help mitigate this effect. Finally, δ18Ospeleo records from regions with high aridity and temperatures should not be expected to preserve a record of δ18Oprecip. Our meta-analysis confirms the modern monitoring observations25, which indicate that δ18Ospeleo in these regions would be an archive of alternating palaeo-aridity and palaeo-recharge and supports the interpretation of δ18Ospeleo as a palaeo-recharge and palaeo-aridity proxy for the last glacial maximum in arid southern Australia22.

## Methods

### Data compilation

δ18Odripwater data were compiled from a literature search and unpublished data. To minimise uncertainties that could be introduced into our analysis, we have chosen to only include sites where both of the following two criteria were met. Firstly, δ18Oprecip was collected at or close to the sites (<20 km) and at a similar altitude, monthly integrated samples for at least 1 year, with an amount-weighted annual mean (δ18Oamountwprecip) value reported. Secondly, δ18Odripwater was collected over the hydrological year, for at least 1 year, with at least bimonthly sampling frequency. Monitoring results had to have at least 1 year of both δ18Odripwater and δ18Oprecip data, with overlapping time periods. We therefore have not included sites where δ18Oprecip is a derived parameter, e.g. from isotope-enabled GCM output or based on empirical relationship with distant Global Network of Isotopes in Precipitation (GNIP) stations. Average drip water age is unknown for all sites, and it is possible that for some locations, the δ18Odripwater integrates δ18Oprecip prior to the monitoring period.

For each site, the local MAT and the total annual P were taken from the publications, and PET was taken from the WorldClim Global Climate Database32,33. For one study29, the total annual precipitation was not provided, and output from the gridded data set was used instead. The P/PET was calculated from the local P and gridded PET.

### Climate comparison

δ18Odripwater and δ18Oamountwprecip data were compared with the following climate characteristics: mean annual temperature (MAT), total annual precipitation (P), potential evapotranspiration (PET) and the precipitation over PET ratio or  aridity index (P/PET). PET and the P/PET were taken from the global aridity and PET database32,33, where PET is modelled at ~1-km resolution, using data from the WorldClim Global Climate Database using mean monthly extraterrestrial radiation, and mean monthly temperature and range (using the equation of ref. 34). Sites are classified as humid where P/PET > 0.65; semi-arid and dry sub-humid at 0.2 ≤ P/PET ≤ 0.65; arid and hyper-arid at P/PET < 0.2. The difference between the δ18Oamountwprecip and δ18Odripwater was determined for each drip site (Δawp-dw).

As cross-checks on the gridded database, we compared for all caves local P and gridded P (Eq. 2) and local T and gridded T (Eq. 3), and for the Australian caves, we compared gridded PET with the mean PET (1960–1990 AD) calculated from the Australian Water Availability Project (AWAP) database35,36:

$${\mathrm{Gridded}}\,{\mathrm{P}} = 1.04\,{\mathrm{P}}\left( {r = 0.98} \right)$$
(2)
$${\mathrm{Gridded}}\,{\mathrm{T}} = 1.00\,{\mathrm{T}}\left( {r = 0.96} \right)$$
(3)

For the Australian sites, the gridded PET calculated by the two products agreed within 7% for all sites, except Golgotha Cave, where the AWAP PET was 30% higher than that calculated by WorldClim. The difference in PET at this site did not change the P/PET classification (using WorldClim: 1.06; using AWAP 0.82), and the WorldClim data are used for consistency.

Statistical analyses were undertaken using Microcal Origin. Correlations are Spearman’s rank-correlation coefficients (rs). Probability values (p), are conservatively determined using the lowest degrees of freedom (df), based on the number of cave sites (global: n = 39; Europe: n = 16; China: n = 10; Australia: n = 5), rather than the number of unique drip waters. Regression equation slope and intercept uncertainties are the standard error.

### Karst hydrological model

To estimate recharge, we use a large-scale karst groundwater recharge model that was previously developed for European and Mediterranean climates29,37,38. The model simulates karstic groundwater recharge at a 0.25° × 0.25° resolution at a daily resolution for a 10-year period from 2002 to 2012, which we consider long enough to provide representative average values of monthly recharge. All relevant karstic and non-karstic processes, such as infiltration of rainfall and snowmelt, evapotranspiration, downward percolation from the upper soil layer to a lower soil/epikarst layer and vertical percolation from the epikarst layer towards the groundwater, are considered within its structure. The epikarst, which is a typical vadose-zone feature of karst systems, allows the dynamic separation of focused and diffuse groundwater recharge38,39. For the weighting of recharge, output from the epikarst is used: the epikarst in the model is a series of N = 15 linear storages with variable capacities (Vsoil,i [mm] and Vepi,i [mm]) and with variable storage constants (Kepi,i[d]), which are distributed by a Pareto function, with a shape parameter a [−]. Parameter estimation provided ranges of values for Vsoil,i Vepi,i, Kepi,i and a for the humid, mountain, Mediterranean and desert karst landscapes29. Here, we use the average recharge volumes (over all simulations obtained with the parameter sets within these confined ranges), and weight the δ18Oprecip in each month by the fraction of the total annual epikarst recharge that occurred in that month.

## Data availability

All water isotope data presented in the figures are contained in the Supplementary Data and Table. The SISAL (Speleothem Isotopes Synthesis and AnaLysis Working Group) database version 1b, that supports Fig. 1 and Supplementary Fig. 3, is archived at the University of Reading. https://doi.org/10.17864/1947.189. The ECHAM5-wiso climate model data that support Supplementary Fig. 2 are archived at PANGAEA40.

## Code availability

The karst hydrology model code is deposited at https://github.com/KarstHub/VarKarst-R-2015.

## References

1. 1.

Hartmann, A. & Baker, A. Modelling karst vadose zone hydrology and its relevance for paleoclimate reconstruction. Earth Sci. Rev. 172, 178–192 (2017).

2. 2.

Lachinet, M. S. Climatic and environmental controls on speleothem oxygen-isotope values. Quatern. Sci. Rev. 28, 314–432 (2009).

3. 3.

Fairchild, I. J. & Baker, A. Speleothem Science: from Process to Past Environments. (John Wiley & Sons, 2012).

4. 4.

Smart, P. L. & Friederich, H. Water movement and storage in the unsaturated zone of a maturely karstified carbonate aquifer, Mendip Hills, England. in Proceedings of the Environmental Problems in Karst Terranes and Their Solutions Conference. 56–87 (National Water Well Association, Dublin OH, 1987).

5. 5.

Pitty, A. An Approach to the Study of Karst Water Vol. 5 (University of Hull Occasional Papers in Geography, 1966).

6. 6.

Wigley, T. & Brown, M. in The Science of Speleology (eds Ford, T. & Cullingford, C.), 329–358 (Academic Press, New York, 1976).

7. 7.

Mickler, P. J., Stern, L. & Banner, J. L. Large kinetic isotope effects in modern speleothems. Geol. Soc. Am. Bull. 118, 65–81 (2006).

8. 8.

Baker, A., Hellstrom, J. C., Kelly, B. F. J., Mariethoz, G. & Trouet, V. A composite annual-resolution stalagmite record of North Atlantic climate over the last three millennia. Sci. Rep. 5, 10307 (2015).

9. 9.

Feng, W., Casteel, R. C., Banner, J. L. & Heinze-Fry, A. Oxygen isotope variations in rainfall, drip-water and speleothem calcite from a well-ventilated cave in Texas, USA: assessing a new speleothem temperature proxy. Geochim. Cosmochim. Acta 127, 233–250 (2014).

10. 10.

Evans, M. N., Tolwinski-Ward, S. E., Thompson, D. M. & Anchukaitis, K. J. Applications of proxy system modeling in high resolution paleoclimatology. Quatern. Sci. Rev. 76, 16–28 (2013).

11. 11.

Deninger, M., Fohlmeister, J., Scholz, D. & Mangini, A. Isotope disequilibrium effects: The influence of evaporation and ventilation effects on the carbon and oxygen isotope composition of speleothems—a model approach. Geochim. Cosmochim. Acta 96, 57–79 (2012).

12. 12.

Bradley, C., Baker, A., Jex, C. N. & Leng, M. J. Hydrological uncertainties in the modelling of cave drip-water δ18O and the implications for stalagmite palaeoclimate reconstructions. Quatern. Sci. Rev. 29, 2201–2214 (2010).

13. 13.

Truebe, S. A., Ault, T. R. & Cole, J. E. A forward model of cave dripwater δ18O and application to speleothem records. IOP Conf. Ser. Earth Environ. Sci. 9, 12022 (2010).

14. 14.

Mickler, P. J. et al. Stable isotope variations in modern tropical speleothems: evaluating equilibrium vs. kinetic effects. Geochim. Cosmochim. Acta 68, 4381–4393 (2004).

15. 15.

Feng, W., Banner, J. L., Guilfoyle, A., Musgrove, M. & James, E. W. Oxygen isotopic fractionation between drip water and speleothem calcite: a 10-year monitoring study, central Texas, USA. Chem. Geol. 304–305, 53–67 (2012).

16. 16.

Atsawawaranunt, K. et al. The SISAL database: a global resource to document oxygen and carbon isotope records from speleothems. Earth Syst. Sci. Data 10, 1687–1713 (2018).

17. 17.

Atsawawaranunt, K., Harrison, S. & Comas-Bru, L. SISAL (Speleothem Isotopes Synthesis and AnaLysis Working Group) database version 1b. Univ. Read. Dataset. https://doi.org/10.17864/1947.189 (2019).

18. 18.

Wang, Y. J. et al. A high-resolution absolute-dated late pleistocene monsoon record from hulu cave, China. Science 294, 2345–2348 (2001).

19. 19.

Wang, X. et al. Hydroclimate changes across the Amazon lowlands over the past 45,000 years. Nature 541, 204–207 (2017).

20. 20.

Cheng, H. et al. The Asian monsoon over the past 640,000 years and ice age terminations. Nature 534, 640–646 (2016).

21. 21.

Denniston, R. F. et al. North Atlantic forcing of millennial-scale Indo-Australian monsoon dynamics during the Last Glacial period. Quatern. Sci. Rev. 72, 159–168 (2013).

22. 22.

Treble, P. C. et al. Hydroclimate of the Last Glacial Maximum and deglaciation in southern Australia’s arid margin interpreted from speleothem records (23–15 ka). Clim. Past 13, 667–687 (2017).

23. 23.

Cuthbert, M. O. et al. Drip water isotopes in semi-arid karst: implications for speleothem paleoclimatology. Earth. Planet. Sci. Lett. 395, 194–204 (2014).

24. 24.

Dreybrodt, W. & Scholz, D. Climatic dependence of stable carbon and oxygen isotope signals recorded in speleothems: from soil water to speleothem calcite. Geochim. Cosmochim. Acta 75, 734–752 (2011).

25. 25.

Markowska, M. et al. Semi-arid zone caves: evaporation and hydrological controls on δ18O drip water composition and implications for speleothem paleoclimate reconstructions. Quatern. Sci. Rev. 131, 285–301 (2016).

26. 26.

Pape, J. R., Banner, J. L., Mack, L. E., Musgrove, M. & Guilfoyle, A. Controls on oxygen isotope variability in precipitation and cave drip waters, central Texas, USA. J. Hydrol. 385, 203–215 (2010).

27. 27.

Jones, I. C. & Banner, J. L. Estimating recharge thresholds in tropical karst island aquifers: Barbados, Puerto Rico and Guam. J. Hydrol. 278, 131–143 (2003).

28. 28.

Goose, H. Reconstructed and simulated temperature asymmetry between continents in both hemispheres over the last centuries. Clim. Dyn. 48, 1483–1501 (2017).

29. 29.

Hartmann, A. et al. A large-scale simulation model to assess karstic groundwater recharge over Europe and the Mediterranean. Geosci. Model Dev. 8, 1729–1746 (2015).

30. 30.

Duan, W. et al. The transfer of seasonal isotopic variability between precipitation and drip water at eight caves in the monsoon regions of China. Geochim. Cosmochim. Acta 183, 250–266 (2016).

31. 31.

Moerman, J. W. et al. Diurnal to interannual rainfall δ18O variations in northern Borneo driven by regional hydrology. Earth. Planet. Sci. Lett. 369–370, 108–119 (2013).

32. 32.

Zomer, R. J. et al. Trees and Water: Smallholder Agroforestry on Irrigated Lands in Northern India. IWMI Research Report 122, 1–45 (International Water Management Institute, Colombo, Sri Lanka, 2007).

33. 33.

Zomer, R. J., Trabucco, A., Bossio, D. A., van Straaten, O. & Verchot, L. V. Climate Change Mitigation: A Spatial Analysis of Global Land Suitability for Clean Development Mechanism Afforestation and Reforestation. Agric. Ecosyst. Environ. 126, 67–80 (2008).

34. 34.

Hargreaves, G. L., Hargreaves, G. H. & Riley, J. P. Irrigation water requirements for Senegal River Basin. J. Irrig. Drain. Eng. ASCE 111, 265–275 (1985).

35. 35.

Raupach, M. R., Harman, I. N. & Canadell, J. G. Global climate goals for temperature, concentrations, emissions and cumulative emissions. CAWCR Technical Report No. 042, 1–74 (2011).

36. 36.

Raupach, M. R. et al. Australian Water Availability Project (AWAP): CSIRO marine and atmospheric research component: final report for phase 3. CAWCR Technical Report No. 013, 1–67 (2009).

37. 37.

Hartmann, A., Gleeson, T., Wada, Y., Wagener, T. & Kingdom, U. Enhanced groundwater recharge rates and altered recharge sensitivity to climate variability through subsurface heterogeneity. Proc. Natl Acad. Sci. USA 114, 2842–2847 (2017).

38. 38.

Hartmann, A., Lange, J., Weiler, M., Arbel, Y. & Greenbaum, N. A new approach to model the spatial and temporal variability of recharge to karst aquifers. Hydrol. Earth Syst. Sci. 16, 2219–2231 (2012).

39. 39.

Williams, P. W. The role of the Subcutaneous zone in karst hydrology. J. Hydrol. 61, 45–67 (1983).

40. 40.

Werner, M. ECHAM5-wiso simulation data—present-day, mid-Holocene, and Last Glacial Maximum. PANGAEA. https://doi.org/10.1594/PANGAEA.902347 (2019).

41. 41.

BGR, IAH, KIT and UNESCO. World Karst Aquifer Map, 1:40 Million (WHYMAP, BGR, Hanover, 2017).

42. 42.

Wassenaar, L. I. et al. Seeking excellence: an evaluation of 235 international laboratories conducting water isotope analyses by isotope-ratio and laser-absorption spectrometry. Rapid Commun. Mass Spectrom. 32, 393–406 (2018).

## Acknowledgements

Ideas in this paper were developed thanks to discussions around the NOAA Last Millennium Reanalysis project and PAGES SISAL consortium. We thank Alan Griffiths for providing AWRA-L PET results and Nico Goldscheider, Tanja Liesch and Zhao Chen for provision of the World Karst Aquifer Map (WOKAM) shapefiles. Funding is gratefully acknowledged by MOC for an Independent Research Fellowship from the UK Natural Environment Research Council (NE/P017819/1). A.H. was supported by the Emmy Noether-Programme of the German Research Foundation (DFG; grant number HA 8113/1-1). W.D. was supported by the National Key R&D Programme of China (Grant 2017YFA0603400) and the Strategic Priority Research Programme of Chinese Academy of Sciences, Grant No. XDB26020000. L.C.B. was supported by ERC-funded project GC2.0 (Global Change 2.0: Unlocking the past for a clearer future, grant number 694481). A.M., M.B. and C.P. were supported by SPYRIT: Speleothems and Ice deposits from PYRenean caves to Reconstruct rapid climate Transitions (Ref: CGL2016-77479-R). L.B. was supported by Science Foundation Ireland through Research Frontiers Grants 07/RFP/GEOF265 and 08/FRP/GEO1184. French Cave water δ18O was collected with the help of the INSU-CNRS (EC2CO-LEFE programme), and E. Régnier, B. Minster, LSCE, made most of the analyses. We thank Valdir Felipe Novello, David Dominguez Villar and Sylvia Riechelmann for providing electronic versions of published data sets.

## Author information

Authors

### Contributions

The paper was conceived by A.B. and W.D., with input from A.H., J.B., S.H., L.C.-B., M.O.C. and P.C.T. A.H. provided the simulations of the karst hydrology model. M.B., A.M., C.P.-M., L.M.B. and D.G. provided unpublished data sets. M.W. provided the ECHAM5-wiso model simulations. All authors contributed to the writing of the paper.

### Corresponding author

Correspondence to Andy Baker.

## Ethics declarations

### Competing interests

The authors declare no competing interests.

Peer review information: Nature Communications thanks Steven Clemens and other anonymous reviewer(s) for their contribution to the peer review of this work. Peer reviewer reports are available.

Publisher’s note: Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

## Rights and permissions

Reprints and Permissions

Baker, A., Hartmann, A., Duan, W. et al. Global analysis reveals climatic controls on the oxygen isotope composition of cave drip water. Nat Commun 10, 2984 (2019). https://doi.org/10.1038/s41467-019-11027-w

• Accepted:

• Published:

• ### Dipole patterns in tropical precipitation were pervasive across landmasses throughout Marine Isotope Stage 5

• Katrina Nilsson-Kerr
• Pallavi Anand
• Melanie J. Leng

Communications Earth & Environment (2021)

• ### Early Holocene permafrost retreat in West Siberia amplified by reorganization of westerly wind systems

• Ting-Yong Li
• Jonathan L. Baker
• R. Lawrence Edwards

Communications Earth & Environment (2021)

• ### Beyond one-way determinism: San Frediano’s miracle and climate change in Central and Northern Italy in late antiquity

• Giovanni Zanchetta
• Monica Bini
• Marco Luppichini

Climatic Change (2021)

• ### Stalagmites: from Science Application to Museumization

• Andrea Columbu
• Laura Calabrò
• Jo De Waele

Geoheritage (2021)


text:
## php – How to pass a variable into an add_filter() function?

Question

I have this code here:

$updatedLanguage = "de"; add_filter('locale', 'change_my_locale'); function change_my_locale($locale ) {
$locale =$updatedLanguage;
return $locale; }  I would like to know how to pass the variable$updatedLanguage into the change_my_locale() function please?

in progress 0
1 year 2021-09-03T20:26:33-05:00 0 Answer 0 views 0

1. You could use an anonymous function and pass the variable to it with use.

$updatedLanguage =$languageArray[$pageLanguage] ?? ''; if ($updatedLanguage ) {
add_filter('locale', function($locale) use ($updatedLanguage) {
return \$updatedLanguage;
});
}

If you’re changing the locale at runtime, then you may want to look here Change locale manually at runtime?, where it is noted that the change could have a performance impact. Also, you may need to do the change early enough in the WP loading sequence so that the correct translation file gets loaded – if it something that you need.

format: plain


text:
# BC42105: Function '<procedurename>' doesn't return a value on all code paths

Function '<procedurename>' doesn't return a value on all code paths. Are you missing a 'Return' statement?

A Function procedure has at least one possible path through its code that does not return a value.

You can return a value from a Function procedure in any of the following ways:

• Include the value in a Return Statement.

• Assign the value to the Function procedure name and then perform an Exit Function statement.

• Assign the value to the Function procedure name and then perform the End Function statement.

If control passes to Exit Function or End Function and you have not assigned any value to the procedure name, the procedure returns the default value of the return data type. For more information, see "Behavior" in Function Statement.

By default, this message is a warning. For more information on hiding warnings or treating warnings as errors, see Configuring Warnings in Visual Basic.

Error ID: BC42105

## To correct this error

• Check your control flow logic and make sure you assign a value before every statement that causes a return.

It is easier to guarantee that every return from the procedure returns a value if you always use the Return statement. If you do this, the last statement before End Function should be a Return statement.


text:
## when to use relativistic versus classical energy

csj
Posts: 1
Joined: Thu Jul 24, 2014 8:09 pm

### when to use relativistic versus classical energy

I think I have generally figured out when it is appropriate to use the relativistic expression for energy ($$E^{2} = (pc)^{2} + (mc^{2})^{2}$$) versus the classical ($$E=\frac{p^{2}}{2m}$$), but I want to make sure and/or learn of any other ways ETS might want us to use one or the other. I've found in general that if a question is put in terms of, for instance, MeV/c^2 it is logical to use the relativistic case, and also I've found that often the use of the word "free" (i.e. a free electron) can also suggest to use relativistic. Are there any other general times to use one or the other?

Chiron
Posts: 9
Joined: Tue Sep 01, 2015 10:37 am

### Re: when to use relativistic versus classical energy

In general you will want to use the relativistic energy any time a particle is moving at any rate nearing the speed of light, which generally means any speed which is, or can be, provided in terms of 'c'. For most problems you should be able to identify this from the context. Also, remember that when in doubt you can always use relativistic equations. They reduce to classical ones at low energy. However, the relativistic ones are generally much more work.

If you, or anyone else, has any questions please feel free to ask.

Thanks.


text:
Q

# Which alkyl halide from the following pairs would you expect to react more rapidly by an S_ N 2 mechanism? Explain your answer. (ii)

10.7   Which alkyl halide from the following pairs would you expect to react more rapidly by an $S_{N}2$ mechanism? Explain your answer.

(ii)

The rate of $S_{N}2$ reaction decreases with increase in hindrance to the attack of the nucleophile.


text:
# 2 column layout without using tabular

I'd like to write a 2 column layout page: one column at the left that should show the year, and one column at the right that should show text that goes along the year.

\documentclass[12pt]{article}
\begin{document}
\begin{table}[ht]
\begin{tabular}{l|c}
2012&Some text\vspace{5pt}\\
2011&Some other text\\
\end{tabular}
\end{table}
\end{document}

Now: I would like to avoid using \begin{tabular} .

• \begin{tabular} will not split across multiple pages
• footnotes are too tricky.

My question: Is the a simple way to get this kind of 2 column layout without using \begin{tabular} ?

-

table will not split across pages either. So you shouldn't is too.

I would use a list, e.g. description or labeling from the KOMA-classes:

\documentclass{scrartcl}
\usepackage{lipsum}
\begin{document}
\begin{labeling}{XXXXXXX}%template for longest item.
\item[2000] \lipsum[1-2]
\item[2001] \lipsum[1-2]
\end{labeling}
\end{document}

-
Thats what I was looking for, thanks. –  Konrad Eisele May 24 '12 at 12:32
Now, there is only one thing that nags me: Is there a possibility to get the vertical seperator between year and text that you have with tabular? I'm be glad even with a brute force command, that "superposes" a simple line at a hand calculated coordinate onto the whole design... –  Konrad Eisele May 24 '12 at 12:59
You could look at the code of marginnote: It uses \pdfsavepos to store the line in which a \marginnote command appears in the .aux-file and uses this information in the next run to place the text. But I wouldn't use such lines, bad typography imho to overdecorate like this. –  Ulrike Fischer May 24 '12 at 13:20
I'm not familiar with Tex at that level, isnt there some kind of command like: \drawline{1cm,0cm,1cm,10cm} that simply draws a vertical line at 1cm horiz. pos... something like that... –  Konrad Eisele May 24 '12 at 14:18
Sure, you can use e.g. \rule, or picture, or the package tikz to draw lines all over your page. But you will have to adjust the coordinates manually which can get awkward if the end of the text can change often. –  Ulrike Fischer May 24 '12 at 14:37

I doubt that you are trying to write a CV. If so, you may try dedicated packages like moderncv for this. However, you may try the following:

\documentclass{article}
\usepackage{lipsum}
\usepackage{parallel}
\usepackage[margin=1in]{geometry}
\begin{document}
\begin{Parallel}[v]{0.1\textwidth}{0.89\textwidth} %% [v] for drawing the vertical line
%===========================
\ParallelLText{ 2001 }
\ParallelRText{ \lipsum[2] }
\ParallelPar
%===================
%===========================
\ParallelLText{ 2002 }
\ParallelRText{ \lipsum[4]This is a foot note\footnote{This is a foot note}. }
\ParallelPar
%===========================
\ParallelLText{ 2003 }
\ParallelRText{ \lipsum[6]}
\ParallelPar
%===========================
\ParallelLText{ 2004 }
\ParallelRText{ \lipsum[8] }
\ParallelPar
%===========================
\ParallelLText{ 2005 }
\ParallelRText{ \lipsum[10]}
\ParallelPar
%===========================
\ParallelLText{2006 }
\ParallelRText{ \lipsum[12] }
\ParallelPar
%===========================
\ParallelLText{ 2007 }
\ParallelRText{ \lipsum[14]}
\ParallelPar
%===========================
\ParallelLText{ 2008}
\ParallelRText{ \lipsum[16]}
\ParallelPar
%===========================
\ParallelLText{ 2009}
\ParallelRText{ \lipsum[18]}
\ParallelPar
%===========================
\end{Parallel}

\end{document}

Another option will be the famous longtable where 1. footnotes work and 2. things will break across pages.:

\documentclass[12pt]{article}
\usepackage{longtable}
\begin{document}
\begin{longtable}{r|p{.8\textwidth}}
2012&Some text\footnote{This is a foot note}\\
2011&Some other text\\
\newpage
2012&Some text\footnote{This is a foot note}\\
2011&Some other text\\
\end{longtable}
\end{document}

-

I would use the margin column to hold the years and the usual text column to put the paragraphs.

\documentclass[12pt]{article}

%setup a page layout with a large margin
\usepackage[paperwidth=170mm, paperheight=240mm, left=42pt, top=40pt, textwidth=280pt, marginparsep=20pt, marginparwidth=100pt, textheight=560pt, footskip=40pt]{geometry}

%marginpar would move, but here the year has to be right next to the paragraph
\usepackage{marginnote}

\begin{document}
Some text\marginnote{2012}

Some other text\marginnote{2011}

\end{document}

you have to change the page layout to your liking. This leads to

Footnotes will work (try Some\footnote{This works} text\marginnote{2012}) and pagebreaks are no problem. Please run LaTeX up to 3 times if the alignment is off.

-


text:
# Apply Gauss law to show that for a charged spherical shell, the electric field outside the shell is, as if the entire charge were concentrated at the centre.

Let us consider a spherical shell P with centre 'O' and Radius (R), also consider a gaussian surface outside the shell at a distance r from the centre of the shell.

the electric flux through the surface

$\phi = E \times 4\pi r^{2}\; \; \; \; \; \; \; (i)$

from gauss law, we have

$\phi = \frac{q}{\varepsilon _{o}}\; \; \; \; \; \; \; (ii)$

Now, from equation (i) and (ii), we have

$\frac{q}{\varepsilon _{o}}=E\times 4\pi r^{2}$

$E=\frac{1}{4\pi \varepsilon _{o}}\frac{q}{r^{2}}$

This electric field is similar to that of a point charge q placed at the centre.

## Related Chapters

### Preparation Products

##### Knockout KCET 2021

An exhaustive E-learning program for the complete preparation of KCET exam..

₹ 4999/- ₹ 2999/-
##### Knockout KCET JEE Main 2021

It is an exhaustive preparation module made exclusively for cracking JEE & KCET.

₹ 27999/- ₹ 16999/-
##### Knockout NEET Sept 2020

An exhaustive E-learning program for the complete preparation of NEET..

₹ 15999/- ₹ 6999/-
##### Rank Booster NEET 2020

This course will help student to be better prepared and study in the right direction for NEET..

₹ 9999/- ₹ 4999/-


text:
# How do you calculate this limit $\mathop {\lim }\limits_{x \to 0} \frac{{\sin (\sin x)}}{x}$?

How do you calculate this limit $$\mathop {\lim }\limits_{x \to 0} \frac{{\sin (\sin x)}}{x}?$$ without derivatives please. Thanks.

-
Hint: ${\displaystyle {\sin(\sin(x)) \over x} = {\sin(\sin(x)) \over \sin(x)} {\sin(x) \over x}}$. –  Zarrax Aug 4 '11 at 14:51
Or, intuitively, since $\lim\limits_{x\to 0}\frac{\sin(x)}{x}=1$, then $\sin(x)\approx x$ when $x\approx 0$, so you expect $\sin(\sin(x))\approx \sin(x)\approx x$ when $x$ is very close to $0$. –  Arturo Magidin Aug 4 '11 at 14:56
Thanks Zarrax, is just the trick I needed. : D –  mathsalomon Aug 4 '11 at 14:58
@mathsalomon Since a number of nice answers have been given already, please consider accepting one so that the question shows up as answered in the future. –  Srivatsan Aug 31 '11 at 12:19

Write the limit as $$\lim_{x \to 0} \frac{\sin(\sin x)}{\sin x} \cdot \frac{\sin x}{x}.$$ It is well-known that $$\lim_{x \to 0} \frac{\sin x}{x} = 1,$$ and since $\sin x \to 0$ as $x \to 0$, we get that also $$\lim_{x \to 0} \frac{\sin(\sin x)}{\sin x} = 1.$$ Therefore the limit is $1 \cdot 1 = 1$.

-
Yess!! thank you very much :D –  mathsalomon Aug 4 '11 at 14:58
@J.J Zarrax might have a bone to pick with you. –  Pedro Tamaroff Feb 22 '12 at 2:32
It might be worth noting that while the solution is pretty natural and standard, in this case you are actually calculating the derivative of $\sin(\sin(x))$ at $x=0$ by using the chain rule. –  N. S. Aug 27 '12 at 16:57

Edit: The solution below should not does not follow the OPs guidelines that derivatives not be used. However, I will leave it since it's correct and shows how L'Hôpital's rule makes the problem much easier. If you think this answer should be deleted, please let me know why and I'll consider it.

Since this limit is of $\frac{0}{0}$ form, we can apply L'Hôpital's rule, which yields $$\lim_{x\to 0} \frac{\sin (\sin x)}{x} = \lim_{x\to 0} \frac{\frac{d}{dx}\sin (\sin x)}{\frac{d}{dx}x} = \lim_{x \to 0} \frac{\cos(\sin x) \cos x}{1} = 1.$$

-
Taking derivatives are not allowed :( –  user9413 Aug 4 '11 at 15:02
@Chandru Oops. I didn't see that. Thanks. –  Quinn Culver Aug 4 '11 at 15:05
Actually you cannot apply L'H here, because the limit is the definition of the derivative of $\sin( \sin (x))$ at $x=0$. –  N. S. Aug 27 '12 at 16:56
@N.S. Why does that preclude use of L'H? –  Quinn Culver Sep 9 '12 at 21:22
Because you USE the derivative of $\sin(\sin(x))$ to calculate ITSELF. That is circular logic.... –  N. S. Sep 10 '12 at 0:10

Note that :

• $$\sin(\sin{x}) = \sin{x} - \frac{(\sin{x})^{3}}{3!} + \frac{(\sin{x})^{5}}{5!} + \cdots$$

• $\displaystyle \lim_{x \to 0} \frac{\sin{x}}{x} =1$.

-
Thanks Chandru, but I can not use the series expansion when I'm on chapter limits. But thanks for the extraordinary speed in responding. –  mathsalomon Aug 4 '11 at 14:57
@mathsalomon: You didn't mention that before :) –  user9413 Aug 4 '11 at 14:58

Here is a page with a geometric proof that $$\lim_{x\to 0}\frac{\sin(x)}{x}=\lim_{x\to 0}\frac{\tan(x)}{x}=1$$ You can skip the Corollaries.

Then you can use the fact that $\lim_{x\to 0}\sin(x)=0$ and the fact mentioned by J.J. and Zarrax that $$\lim_{x\to 0}\frac{\sin(\sin(x))}{x}=\lim_{x\to 0}\frac{\sin(\sin(x))}{\sin(x)}\lim_{x\to 0}\frac{\sin(x)}{x}=1$$

-


text:
# Given the graph of a function $f(x)$, describe $\sqrt{f(x)}$

Can someone please help me with this math equation I have a test tomorrow and need to know how to do this thanks gary.

-
Especially for these homework-like problems, people here would like to know what have you tried, and where you are stuck at. For example, for $f(x)$ itself, do you have any ideas on what the domain and range of $f(x)$ might be? –  Lord Soth Apr 17 '13 at 21:55

From the graph, you have the points $(0,4)$ and $(3,1)$. So the slope of the line is $\frac{4-1}{0-3}=-1$. Hence, the equation of the line is $f(x)=4-x$. So the domain and range would both be all reals. For $y=\sqrt{f(x)}=\sqrt{4-x}$, we have that $4-x\geq0 \implies x\geq4$. The corresponding range is all non-negative reals (since the square root function must be positive or zero).
The invariant points occur where $y(x)=x.$ For the first one, that means that $4-x=x\implies x=2$. For the second one, that means that $\sqrt{4-x}=x\implies 4-x=x^2\implies x^2+x-4=0$. Using the quadratic formula, you get $x=\frac{-1\pm\sqrt{1^2-4(1)(-4)}}{2(1)}=\frac{-1\pm\sqrt{17}}{2}$, which are not in the domain of f. Hence, there are no invariant points for the second problem.


text:
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Win32.Brontok --Insecure Internet Activity popup

7 replies to this topic

#1 L-A5

L-A5

• Members
• 2 posts
• OFFLINE
•
• Local time:02:39 PM

Posted 04 June 2009 - 09:02 PM

Hi There, I have recently been infected with a 'virus'.
The 1st symptom started long ago, when McAfee started telling me EVERYDAY that I have updates to install. Some sort of 'mcafee suite', and even when I updated it, it would continue to popup and remind me.

This had gone on for nearly a month and I just put things off, clicking ignore most days.

Recently I have been struggling with more serious problems.
The most common is that often while clicking on linkks to navigate a website, a popup occurs which reads:

"Insecure Internet activity. Threat of virus attack
Due to insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes.
Also insecure Internet activity can result in revealing your personal information.
To get full advanced real-time protection for PC and Internet activity, register your antivirus software. "

I have never clicked on any of the links it recommends.

My computer also restarts on its own sometimes, and frequently shuts my internet windows down. It also often freezes when I just boot up my computer.

At one point last week random elevator-sounding music played when all of my windows were closed. --that hasn't happened since.

I have downloaded many programs to run scans, as my Spybot was not opening. The only scanning program I have been able to run is SuperAntiSpyware. Everything else either doesn't open, or it tells me there was an error and it had to close.
SuperAntiSpyware tells me it got rid of some minor threats and some high-threat ones. The serious ones were labeled:
Win32Trojan Agent
Win32TDSS

I have read forums about running SmitFraudFix, but again, it says there is an error and it won't work. It worked as soon as I installed it, but I closed the program, since it was recommended I be in safe-mode and I wasn't at the time.

Also, a less frequent 'popup' or warning -is from Security Center Alert saying that

'Your firewall has blocked some features of this program"
--Win32.Brontok
Risk Level: High
'this is a worm that spreads via internet as an attachment to infected messages. It sends itself to email addresses harvested from the victim machine'

Block suspicious software? Y/N

--------
Here is are my DDS files
Thats about all the information I can offer,
hope to hear back soon.

Thanks!

L-A

----------------------------------------

DDS (Ver_09-05-14.01) - NTFSx86
Run by Lori-Anne at 22:53:28.42 on Tue 06/02/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.107 [GMT -4:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\Lori-Anne\Desktop\DAEMON Tools\daemon.exe
C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"C:\WINDOWS\system32\drivers\svchost.exe"
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Documents and Settings\Lori-Anne\Desktop\dds.scr

============== Pseudo HJT Report ===============

BHO: WinInet Class: {39fc2065-c9c7-49cd-8942-44cc2dedc844} - c:\windows\ieocx.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
uRun: [DAEMON Tools] "c:\documents and settings\lori-anne\desktop\daemon tools\daemon.exe" -lang 1033
uRun: [WeatherEye] c:\program files\theweathernetwork\weathereye\WeatherEye.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [SVCHOST.EXE] c:\windows\system32\drivers\svchost.exe
mRun: [PRONoMgrWired] c:\program files\intel\prosetwired\ncs\proset\PRONoMgr.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [realteczs] "c:\documents and settings\lori-anne\application data\google\pfysw721318.exe" 2
mRun: [realteks] "c:\documents and settings\lori-anne\application data\google\uqrke8412012.exe" 2
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: c:\windows\system32\debeviva.dll ,
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-20 64160]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-1-15 201320]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-1-15 359248]
R2 McShield;McAfee Real-time Scanner;c:\program files\mcafee\virusscan\Mcshield.exe [2008-1-15 144704]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-1-15 695624]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-1-15 79304]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-1-15 35240]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-1-15 40488]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-1-15 33832]
S3 Viaudan;Viaudan;c:\windows\system32\diantz.exe [2004-8-3 85504]

=============== Created Last 30 ================

2009-05-31 23:04 <DIR> --d----- c:\windows\system32\KB905474
2009-05-31 11:06 45,740 a------- c:\windows\system32\drivers\svchost.exe
2009-05-22 21:12 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-22 21:12 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-22 21:12 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-22 02:29 15,688 a------- c:\windows\system32\lsdelete.exe
2009-05-21 23:49 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-05-21 23:49 <DIR> --d----- c:\docume~1\lori-a~1\applic~1\SUPERAntiSpyware.com
2009-05-21 23:06 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-05-20 23:51 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-05-20 23:49 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-20 23:49 <DIR> --d----- c:\program files\Lavasoft
2009-05-20 23:43 <DIR> --d----- c:\program files\SpyWall
2009-05-20 23:30 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-05-19 23:15 190 a------- c:\docume~1\lori-a~1\applic~1\asd.bat
2009-05-19 23:13 28,672 a------- c:\windows\ieocx.dll

==================== Find3M ====================

2009-04-30 01:36 75,776 a------- c:\windows\system32\WS2Fix.exe
2009-03-06 10:44 283,648 a------- c:\windows\system32\pdh.dll
2009-02-28 23:47 24,696 a------- c:\docume~1\lori-a~1\applic~1\GDIPFONTCACHEV1.DAT
2009-02-12 17:05 8,192 a--sh--- c:\program files\Thumbs.db
2008-10-28 23:48 8,762,107 a------- c:\program files\DVD2iPodReg.exe
1999-05-29 04:08 308,120 a------- c:\program files\SCR256.BMP
1999-05-29 04:08 307,288 a------- c:\program files\SCR16.BMP
1999-05-29 04:08 127,488 a------- c:\program files\dsetup.dll
1999-05-29 04:08 104,398 a------- c:\program files\Llogo.bmp
1999-05-29 04:08 90,112 a------- c:\program files\rctrec.exe
1999-05-29 04:08 63,056 a------- c:\program files\dsetup16.dll
1999-05-29 04:08 45,568 a------- c:\program files\UniFish3.exe
1999-05-29 04:08 41,984 a------- c:\program files\dsetup32.dll
1999-05-29 04:08 40,678 a------- c:\program files\SLOGO.BMP
1999-05-29 04:08 61 a------- c:\program files\AUTORUN.INF

============= FINISH: 22:56:28.96 ===============

#2 Net_Surfer

Net_Surfer

• Banned
• 2,154 posts
• OFFLINE
•
• Gender:Male
• Local time:11:39 AM

Posted 15 June 2009 - 04:01 AM

Hello and to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here
.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.

Thanks and again sorry for the delay
.

-----------------------------------------------------------

We need to see some information about what is happening in your machine. Please perform the following scan:
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Kind regards
Net_Surfer

#3 L-A5

L-A5
• Topic Starter

• Members
• 2 posts
• OFFLINE
•
• Local time:02:39 PM

Posted 17 June 2009 - 02:35 PM

here is my updated dds.txt

DDS (Ver_09-05-14.01) - NTFSx86
Run by Lori-Anne at 15:30:32.43 on Wed 06/17/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.138 [GMT -4:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\Lori-Anne\Desktop\DAEMON Tools\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"C:\WINDOWS\system32\drivers\svchost.exe"
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Lori-Anne\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: WinInet Class: {39fc2065-c9c7-49cd-8942-44cc2dedc844} - c:\windows\ieocx.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
uRun: [DAEMON Tools] "c:\documents and settings\lori-anne\desktop\daemon tools\daemon.exe" -lang 1033
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [SVCHOST.EXE] c:\windows\system32\drivers\svchost.exe
mRun: [PRONoMgrWired] c:\program files\intel\prosetwired\ncs\proset\PRONoMgr.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [realteczs] "c:\documents and settings\lori-anne\application data\google\pfysw721318.exe" 2
mRun: [realteks] "c:\documents and settings\lori-anne\application data\google\uqrke8412012.exe" 2
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://go.divx.com/plugin/DivXBrowserPlugin.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: c:\windows\system32\debeviva.dll ,
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-6-2 42376]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-20 64160]
R1 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-6-2 66952]
R1 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-6-2 81288]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-1-15 201320]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-1-15 359248]
R2 McShield;McAfee Real-time Scanner;c:\program files\mcafee\virusscan\Mcshield.exe [2008-1-15 144704]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-2 356920]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-6-2 1073544]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-1-15 695624]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-1-15 79304]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-1-15 35240]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-1-15 40488]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-1-15 33832]
S3 Viaudan;Viaudan;c:\windows\system32\diantz.exe [2004-8-3 85504]

=============== Created Last 30 ================

2009-06-12 16:34 <DIR> --d----- C:\b419c62f6c4335863dddfa5250
2009-06-02 23:05 42,376 a------- c:\windows\system32\drivers\ikfilesec.sys
2009-06-02 23:05 29,576 a------- c:\windows\system32\drivers\kcom.sys
2009-06-02 23:05 81,288 a------- c:\windows\system32\drivers\iksyssec.sys
2009-06-02 23:05 66,952 a------- c:\windows\system32\drivers\iksysflt.sys
2009-06-02 23:05 <DIR> --d----- c:\program files\Spyware Doctor
2009-06-02 23:05 <DIR> --d----- c:\docume~1\lori-a~1\applic~1\PC Tools
2009-06-02 23:04 <DIR> --d----- c:\docume~1\lori-a~1\applic~1\GetRightToGo
2009-05-31 23:04 <DIR> --d----- c:\windows\system32\KB905474
2009-05-31 11:06 45,740 a------- c:\windows\system32\drivers\svchost.exe
2009-05-22 21:12 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-22 21:12 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-22 21:12 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-22 02:29 15,688 a------- c:\windows\system32\lsdelete.exe
2009-05-21 23:49 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-05-21 23:49 <DIR> --d----- c:\docume~1\lori-a~1\applic~1\SUPERAntiSpyware.com
2009-05-21 23:06 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-05-20 23:51 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-05-20 23:49 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-20 23:49 <DIR> --d----- c:\program files\Lavasoft
2009-05-20 23:43 <DIR> --d----- c:\program files\SpyWall
2009-05-20 23:30 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-05-19 23:15 190 a------- c:\docume~1\lori-a~1\applic~1\asd.bat
2009-05-19 23:13 28,672 a------- c:\windows\ieocx.dll

==================== Find3M ====================

2009-05-07 11:44 344,064 a------- c:\windows\system32\localspl.dll
2009-04-30 01:36 75,776 a------- c:\windows\system32\WS2Fix.exe
2009-04-29 00:52 3,060,736 a------- c:\windows\system32\SETC1.tmp
2009-04-29 00:52 1,023,488 a------- c:\windows\system32\SETC9.tmp
2009-04-29 00:52 616,448 a------- c:\windows\system32\SETBA.tmp
2009-04-29 00:52 474,112 a------- c:\windows\system32\SETBB.tmp
2009-04-29 00:52 16,384 a------- c:\windows\system32\SETC2.tmp
2009-04-29 00:52 1,495,552 a------- c:\windows\system32\SETBC.tmp
2009-04-29 00:52 659,456 a------- c:\windows\system32\wininet.dll
2009-04-29 00:52 659,456 a------- c:\windows\system32\SETB9.tmp
2009-04-29 00:52 81,920 a------- c:\windows\system32\ieencode.dll
2009-04-27 05:18 351,744 a------- c:\windows\system32\SETCB.tmp
2009-04-17 05:58 1,846,656 a------- c:\windows\system32\win32k.sys
2009-04-15 11:11 584,192 a------- c:\windows\system32\rpcrt4.dll
2009-02-28 23:47 24,696 a------- c:\docume~1\lori-a~1\applic~1\GDIPFONTCACHEV1.DAT
2009-02-12 17:05 8,192 a--sh--- c:\program files\Thumbs.db
2008-10-28 23:48 8,762,107 a------- c:\program files\DVD2iPodReg.exe
1999-05-29 04:08 308,120 a------- c:\program files\SCR256.BMP
1999-05-29 04:08 307,288 a------- c:\program files\SCR16.BMP
1999-05-29 04:08 127,488 a------- c:\program files\dsetup.dll
1999-05-29 04:08 104,398 a------- c:\program files\Llogo.bmp
1999-05-29 04:08 90,112 a------- c:\program files\rctrec.exe
1999-05-29 04:08 63,056 a------- c:\program files\dsetup16.dll
1999-05-29 04:08 45,568 a------- c:\program files\UniFish3.exe
1999-05-29 04:08 41,984 a------- c:\program files\dsetup32.dll
1999-05-29 04:08 40,678 a------- c:\program files\SLOGO.BMP
1999-05-29 04:08 61 a------- c:\program files\AUTORUN.INF

============= FINISH: 15:33:42.48 ===============

#4 Net_Surfer

Net_Surfer

• Banned
• 2,154 posts
• OFFLINE
•
• Gender:Male
• Local time:11:39 AM

Posted 17 June 2009 - 03:57 PM

Hello L-A5, and to Bleeping Computer Malware Removal Forum, My Nick is Net_Surfer I'll be glad to help you with your computer problems.

I will be working on your Malware issues, this may or may not solve other issues you may have with your machine.

Sorry about the delay, but the amount of people posting with infected computers is through the roof and sometimes we can't get to logs as fast as we would like to.

Please note that whatever repairs we make, are for fixing "your computer problems only" and by no means should be used on another computer.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown Here.

-----------------------------------------------------------

Please be patient and I'd be grateful if you would note the following:

The cleaning process is not instant. DDS logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.

2. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
3. All of my posts need to be checked by my coach, so please be patient while I attempt to remove your malware.
4. Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

In the meantime Please, Do NOT install any new programs or update anything unless told to do so while we are fixing your problem.

Please give me some time to review your logs and take the steps necessary with you to get your machine back in working order clean and free of malware.

Thanks and again sorry for the delay
.

Kind regards
Net_Surfer

#5 Net_Surfer

Net_Surfer

• Banned
• 2,154 posts
• OFFLINE
•
• Gender:Male
• Local time:11:39 AM

Posted 18 June 2009 - 11:09 AM

Hello L-A5 again,

Sorry for the delay. The forum is exceptionally busy. I have reviewed your logs and proposed a fix. I am patiently waiting for my coach to approve the clean-up.

If possible I would encourage you to minimize use of that computer until we can get it cleaned up. I appreciate your patience.

Regards,
Net_Surfer

#6 Net_Surfer

Net_Surfer

• Banned
• 2,154 posts
• OFFLINE
•
• Gender:Male
• Local time:11:39 AM

Posted 20 June 2009 - 07:21 AM

Hello L-A5.

You had ran the DDS Scan with the anti-virus enabled.
"AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}"

Please I need that you ensure the disabling of anti-virus, spybot teatimer. before you attempt to run the following tools.

Before we start fixing anything you should write/print out these instructions or copy/paste them to a NotePad file.

If you can not download and run the following tools, then I would like for you to try another approach.

If you have the use of another computer please either use a Flash Drive or a CD to download the following and transfer them for use on the infected machine.
Be sure you put them on the desktop of the infected computer.

-------*******************^********************--------

Ok.. L-A5, please observe these rules while we work:
• Perform all actions in the order given.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Do not attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.
• In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.
• Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
• Please continue to review my answers until I tell you that your machine is clean and free of malware. (Remember absence of symptoms does not mean that everything is clear).
Just because you can't see a problem doesn't mean it isn't there.

If you can do these things, everything should go smoothly
.

----------------------------^-------------------------------

AskBar.dll is a file that has been reported by many as an adware or malware related software BHO program. This file will run as a BHO in your browser everytime you browse the internet.
Normally this is also found with one or more other Askbar files on your computer,

if you did not install this intentionally on your computer then I recommend removing this as soon as possible or disabling your browser BHOs. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
This spyware commonly goes by the name "Ask Bar".
---
This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

http://vil.nai.com/vil/content/v_146646.htm

----------------------------^-------------------------------

One or more of the identified infections is a backdoor trojan/Rootkit.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

If you decide you want to proceed with trying to clean your machine please follow these next steps
:

Step #1.
I see you are running Teatimer. I suggest you to disable it
Firstly, we need to disable SpyBot's Teatimer which can interfere with the fixes.

TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.
• Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
• If prompted with a legal dialog, accept the warning.
• Click and then on "Advanced Mode"
• You may be presented with a warning dialog. If so, press
• Click on
• Click on
• Uncheck this checkbox:
• Close/Exit Spybot Search and Destroy
If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

You need to disable your McAfee Antivirus and Spyware Doctor before running OTM, as they will prevent it from running.

To disable McAfee Virusscan:
Please navigate to the system tray on the bottom right hand corner and look for a sign.
• right-click it -> chose "Change Settings."
• Turn everything OFF from within "Advanced" option button.
• a popup will warn that protection will now be disabled. Click on "Yes" to disable the Antivirus guard.
You succesfully disabled the McAfee Guard.

To disable Spyware Doctor from running on your system startup:
1. First, disable the OnGuard Tools. This way, when you exit Spyware Doctor, these tools won't stay resident in the background.
2. Click the "Settings" button on the left side.
3. Click the "Startup Settings" link.
4. Uncheck "Run at Windows Startup".
5. Click the "Apply" button.

Step #2.

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

c:\windows\system32\diantz.exe

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal:
http://www.virustotal.com/

Step #3.

Install ERUNT
(This tool will create a complete backup of your registry to ensure we have a safety net If something goes wrong. Do not delete the backup until we are finished).
• Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.
• Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program HERE

When we are finished with fixing your computer (I will make it clear when we are), you can uninstall ERUNT through Add/Remove Programs. The backups will be stored at C:\WINDOWS\erdnt, and will not be deleted when ERUNT is uninstalled.

Warning: Altering system files; & or modifying the registry can be risky and BleepingComputer.com and its members cannot accept liability for any adverse effects caused by following advice freely given on this site.

Step #4.

*Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of OTM fixing tool.. Please visit HERE if you don't know how...Please re-enable them back after performing all steps given

We need to execute an OTM script
• Double click the icon on your desktop to run it.
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right click and choose Copy.) Then..Paste the code under the area. Do not include the word "Code".
:processes
explorer.exe

:services

:files
c:\windows\system32\drivers\svchost.exe
c:\windows\ieocx.dll
c:\windows\system32\debeviva.dll

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39fc2065-c9c7-49cd-8942-44cc2dedc844}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=""
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"realteczs"=-
"realteks"=-
"SVCHOST.EXE"=-

:Commands
[EmptyTemp]
[Reboot]
• Push the large button.
• Copy/Paste the contents under the line here in your next reply.
• If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
CAUTION:
The above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Step #5.
If you are unsure on how to do this, please read this guide
Your anti spyware program is: TeaTimer from Spybot S&D
MBAM
If you have a previous version of MBAM, remove it via Add/Remove Programs and download a fresh copy.
• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
• Update Malwarebytes' Anti-Malware
• Launch Malwarebytes' Anti-Malware
• Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
• If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
• Make sure the "Perform Full Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.
Tutorial if needed

Step #6.

Run random's system information tool (RSIT)

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

Please note that it is important that RSIT be run and a log created while in normal mode. *If you run it and create your log while in safe mode, you will be asked to redo it again properly.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open.

log.txt (<<--- will be maximized) and info.txt (<<--- will be minimized)
• the report log from Jotti or virustotal
• The report log from OTM
• The report log of MBAM
• The two logs of RSIT.
And a description of any remaining problems in your next post.

How is your Computer running now?.

Upon completing the above steps I will review your logs again and take the steps necessary with you to get your machine back in working order clean and free of malware.

Thanks.
Kind regards
Net_Surfer

#7 Net_Surfer

Net_Surfer

• Banned
• 2,154 posts
• OFFLINE
•
• Gender:Male
• Local time:11:39 AM

Posted 22 June 2009 - 07:10 PM

Bump
Hello L-A5.

Are you still there
???

Please continue to review my answers until I tell you your machine appears to be clear. Remember absence of symptoms does not mean that everything is clear.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Unfortunately, if I do not hear back from you within 2 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread.

Kind regards
Net_Surfer

Edited by Net_Surfer, 22 June 2009 - 07:11 PM.

#8 kahdah

kahdah

• Security Colleague
• 11,138 posts
• OFFLINE
•
• Gender:Male
• Location:Florida
• Local time:02:39 PM

Posted 25 June 2009 - 06:06 AM

Due to lack of feedback, this topic has been closed.


text:
# X-Ray Diffraction

In X-ray diffraction when we accelerate the electron with some potential say $$V$$ and make collision with plate that produces $$X-$$ray (frequency $$\nu$$). $$h\nu_{max}=eV$$ But as we know that the accelearated charge particle radiate electromagnetic radiation which have energy. Why we don't take it into account in our calculations?

One can do a rough non-relativistic calculation to compare the energy radiated, $$E_{\rm radiation}$$, and the kinetic energy gained, $$E_{\rm kinetic}$$, by an electron when traversing a distance $$d$$ which has an accelerating potential difference $$V$$ across it.

The electric field is assumed to be uniform $$E = \dfrac Vd$$ and the transit time for an electron being $$t$$.

$$E_{\rm kinetic} = \frac 12 m \,a^2\,t^2$$ where $$a$$ is the acceleration of the electron.

The Larmor formula states that the power of the emitted radiation from an accelerating electron, charge $$e$$ and mass $$m$$, is $$P = \dfrac{e^2\,a^2}{6\,\pi\,\epsilon_0\,c^3}$$ where $$c$$ is the speed of light.

With $$E_{\rm radiation} = \dfrac{e^2\,a^2\,t}{6\,\pi\,\epsilon_0\,c^3} \Rightarrow \dfrac{E_{\rm radiation}}{E_{\rm kinetic}} = \dfrac{e^2}{3\,\pi\, \epsilon_0\,c^3 \,m\,t}$$.

$$s= ut+\dfrac 12 at^2 \Rightarrow d = \dfrac 12 \dfrac {e\,V}{m\,d}\,t^2 \Rightarrow t = \sqrt{\dfrac{2\,m\,d^2}{e\,V}}$$

With $$V= 30 \,\rm kV$$ and $$d=0.1\,\rm m$$ the transit time $$t \approx 2\times 10^{-9}\,\rm s$$.

Putting in the values relating to an electron gives $$\dfrac{E_{\rm radiation}}{E_{\rm kinetic}} \approx 6 \times 10^{-12}$$ which gives a reason to the question

But as we know that the accelerated charge particle radiate electromagnetic radiation . . . . . . Why we don't take it into account in our calculations?

• That's great! Thanks for Help. – Himanshu Sahu Feb 20 at 8:11

This relationship is not an absolute formula.It is just a precise relationship , which has been derived experimentally. Also it is not only frequency $$\nu$$ mentioned but its maximal value $$\nu_{max}.$$