Spyware / Malware / Virus Removal

[Resolved] New Upgrades Slow PC

7 min read

Looking for the outcome? Ask AI

mesa215 Topic Starter

Post #1March 1, 2009, 6:16 PM UTC

This is for LDTate. We were working on a problem on my computer and you had asked me to let you know when I upgraded my memory. I have upgraded my memory from 512 to 2GB. I also upgraded my windows from XP to XP media. The previous topic we were working on was closed. Now that I have finished my upgrades I would like you to take a look at my HijackThis Log. I was on the PCH Scratchcards website when a window popped up telling me that I had infections and wanted me to download an antivirus program. I did not download it. When I tried to close the window a message appeared asking me was I sure I wanted to exit without downloading the software. I clicked yes and the window closed. I then ran a complete scan with my PCtools Threatfire and with my PCtools Antivirus. Neither program found any inferctions. My computer does seem to be a little slower now. Could you please check my HijackThis Log below and let me know if there are any problems?……..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:02:43 PM, on 3/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\WECPUpdate.exe -s
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /M "Stylus CX4800" /EF "HKCU"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1235429758638
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos…ronGameHost.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

–
End of file - 7815 bytes
________________________

Thank you for your time.

LDTate

Post #2March 3, 2009, 12:18 AM UTC

Sorry I didn't see your new log when you first posted it.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Note: Combofix will run without the Recovery Console installed.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please don't attach the scans / logs, use "copy/paste".

Also please describe how your computer behaves at the moment.

mesa215

Post #3March 3, 2009, 4:14 AM UTC last edited March 3, 2009, 4:44 AM UTC

Hi LDTate. Thank you for responding. I downloaded the ComboFix and here are the results:

ComboFix 09-03-02.01 - Mom 2009-03-02 23:18:04.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1523 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: PC Tools AntiVirus 5.0.1.1 *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-02-03 to 2009-03-03 )))))))))))))))))))))))))))))))
.

2009-03-01 21:36 . 2009-03-01 21:36 d——– c:\program files\Unity
2009-03-01 12:13 . 2009-03-01 12:13 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-01 12:13 . 2009-03-01 12:13 d——– c:\documents and settings\Mom\Application Data\Malwarebytes
2009-03-01 12:13 . 2009-03-01 12:13 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-01 12:13 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-01 12:13 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-01 10:31 . 2009-03-01 10:31 d——– c:\documents and settings\Mom\Application Data\skypePM
2009-03-01 10:31 . 2009-03-01 10:31 56 –ah—– c:\windows\system32\ezsidmv.dat
2009-03-01 10:29 . 2009-03-01 10:29 dr——- c:\program files\Skype
2009-03-01 10:29 . 2009-03-01 10:29 d——– c:\program files\Common Files\Skype
2009-03-01 10:29 . 2009-03-01 11:05 d——– c:\documents and settings\Mom\Application Data\Skype
2009-03-01 10:29 . 2009-03-01 10:29 d——– c:\documents and settings\All Users\Application Data\Skype
2009-03-01 10:07 . 2009-03-01 10:07 d——– c:\program files\MSXML 4.0
2009-03-01 04:12 . 2009-03-01 04:12 d——– c:\program files\MSECache
2009-03-01 00:57 . 2009-03-01 01:00 d——– c:\program files\Microsoft Picture It! 9
2009-03-01 00:33 . 2004-09-28 13:08 458,112 –a—— c:\windows\system32\drivers\MarvinUsb.sys
2009-03-01 00:33 . 2005-01-28 15:36 171,008 –a—— c:\windows\system32\drivers\MarvinBus.sys
2009-03-01 00:26 . 2009-03-01 00:26 d——– c:\program files\Pinnacle Systems
2009-02-28 23:49 . 2009-02-28 23:49 d——– c:\program files\SmartSound Software
2009-02-28 23:49 . 2009-02-28 23:50 d——– c:\documents and settings\All Users\Application Data\SmartSound Software Inc
2009-02-28 23:48 . 2009-03-01 00:17 d——– c:\windows\system32\QuickTime
2009-02-28 23:48 . 2009-03-01 00:09 d——– c:\program files\QuickTime
2009-02-28 23:48 . 2009-03-01 00:02 d——– c:\documents and settings\All Users\Application Data\QuickTime
2009-02-28 23:48 . 1999-11-10 12:05 86,016 –a—— c:\windows\unvise32qt.exe
2009-02-28 23:47 . 2002-03-19 10:29 14,165 ——— c:\windows\system32\drivers\Pclepci.sys
2009-02-28 23:44 . 2003-11-19 17:54 1,047,552 –a—— c:\windows\system32\MFC71u.dll
2009-02-28 23:38 . 2009-03-01 00:23 d——– c:\documents and settings\All Users\Application Data\Pinnacle
2009-02-28 23:37 . 2009-03-01 00:43 d——– c:\program files\Pinnacle
2009-02-27 13:05 . 2009-03-01 00:14 d——– c:\documents and settings\Mom\Application Data\LimeWire
2009-02-27 13:04 . 2009-02-27 13:04 d——– c:\program files\LunaPlayer
2009-02-27 04:13 . 2009-02-27 04:13 d——– c:\documents and settings\All Users\Application Data\PopCap
2009-02-27 03:58 . 2009-02-27 03:58 d——– c:\windows\Sun
2009-02-27 02:57 . 2009-02-27 02:57 d——– c:\documents and settings\Mom\Application Data\Pogo Games
2009-02-27 02:56 . 2009-02-27 05:33 d——– c:\program files\Oberon Media
2009-02-25 02:54 . 2009-02-25 02:54 d——– c:\program files\Real
2009-02-25 02:54 . 2009-02-25 02:54 d——– c:\program files\Common Files\xing shared
2009-02-25 02:54 . 2009-02-25 02:54 d——– c:\program files\Common Files\Real
2009-02-24 09:25 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2009-02-24 09:25 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2009-02-23 14:33 . 2009-02-23 14:33 d——– c:\documents and settings\Mom\Application Data\Leadertech
2009-02-23 14:32 . 2009-02-23 14:32 d——– C:\EPSONREG
2009-02-23 14:31 . 2009-02-23 14:31 d——– c:\program files\ArcSoft
2009-02-23 14:31 . 1995-08-01 04:44 212,480 –a—— c:\windows\PCDLIB32.DLL
2009-02-23 14:31 . 2005-02-23 14:58 11,776 –a—— c:\windows\system32\drivers\afc.sys
2009-02-23 14:29 . 2009-02-23 14:32 d——– c:\program files\epson
2009-02-23 14:29 . 2005-02-25 00:00 46,080 –a—— c:\windows\system32\escimgd.dll
2009-02-23 14:29 . 2000-06-06 13:01 34,304 –a—— c:\windows\system32\E_FBCHADA.DLL
2009-02-23 14:29 . 2005-02-25 00:00 29,696 –a—— c:\windows\system32\escwiad.dll
2009-02-23 14:29 . 2005-02-25 00:00 22,016 –a—— c:\windows\system32\esccmd.dll
2009-02-23 14:29 . 2009-02-23 14:32 44 –a—— c:\windows\EPCX4800.ini
2009-02-23 14:28 . 2008-04-13 13:45 26,368 –a–c— c:\windows\system32\dllcache\usbstor.sys
2009-02-23 14:28 . 2008-04-13 13:47 25,856 –a—— c:\windows\system32\drivers\usbprint.sys
2009-02-23 14:28 . 2008-04-13 13:47 25,856 –a–c— c:\windows\system32\dllcache\usbprint.sys
2009-02-23 01:53 . 2009-02-23 01:53 d——– c:\documents and settings\Yashe\Application Data\PC Tools
2009-02-23 01:52 . 2009-03-02 23:17 d——– c:\documents and settings\Yashe
2009-02-21 22:29 . 2009-02-21 22:29 1,374 –a—— c:\windows\imsins.BAK
2009-02-21 14:31 . 2009-02-21 14:31 d——– c:\documents and settings\Nani\Application Data\PC Tools
2009-02-21 14:30 . 2009-03-02 23:17 d——– c:\documents and settings\Nani
2009-02-21 13:49 . 2009-02-21 13:49 d——– c:\documents and settings\BJ\Application Data\PC Tools
2009-02-21 13:48 . 2009-03-02 23:17 d——– c:\documents and settings\BJ
2009-02-21 07:27 . 2009-02-21 07:27 d——– c:\documents and settings\Mom\Application Data\PC Tools
2009-02-21 07:25 . 2009-02-21 07:25 d——– c:\program files\Common Files\PC Tools
2009-02-21 07:25 . 2007-12-06 16:51 28,568 –a—— c:\windows\system32\drivers\AVHook.sys
2009-02-21 07:25 . 2007-12-06 16:51 21,912 –a—— c:\windows\system32\drivers\AVRec.sys
2009-02-21 07:25 . 2008-02-12 11:44 21,904 –a—— c:\windows\system32\drivers\AVFilter.sys
2009-02-21 07:24 . 2009-03-02 23:18 d——– c:\program files\PC Tools AntiVirus
2009-02-21 07:13 . 2009-02-21 07:13 d——– c:\program files\Trend Micro
2009-02-21 07:00 . 2009-02-21 07:00 d——– C:\ConverterOutput
2009-02-21 06:47 . 2009-02-21 06:47 d——– c:\program files\Essentials Codec Pack
2009-02-21 06:46 . 2002-11-02 09:53 57,344 –a—— c:\windows\system32\WNASPINT.DLL
2009-02-21 06:43 . 2009-02-21 06:58 d——– c:\program files\Cucusoft
2009-02-21 06:43 . 2004-10-05 16:16 395,776 –a—— c:\windows\system32\libmplayer.dll
2009-02-21 06:43 . 2004-10-12 14:42 262,144 –a—— c:\windows\system32\TomsMoComp_ff.dll
2009-02-21 06:43 . 2003-04-03 00:17 172,032 –a—— c:\windows\system32\ac3filter.ax
2009-02-21 06:43 . 2004-10-04 01:50 112,640 –a—— c:\windows\system32\libmpeg2_ff.dll
2009-02-21 06:43 . 2004-09-10 13:50 34,820 –a—— c:\windows\system32\ffdshow.reg
2009-02-21 06:36 . 2009-02-21 06:36 d——– c:\documents and settings\All Users\Application Data\Azureus
2009-02-21 06:35 . 2009-02-28 03:10 d——– c:\program files\Vuze
2009-02-21 06:35 . 2009-02-21 06:35 d——– c:\program files\AskBarDis
2009-02-21 06:35 . 2009-03-02 00:01 d——– c:\documents and settings\Mom\Application Data\Azureus
2009-02-21 06:33 . 2009-02-28 03:10 d——– c:\program files\LimeWire
2009-02-21 06:33 . 2009-02-21 06:33 d——– c:\program files\Java
2009-02-21 06:33 . 2009-02-21 06:33 410,984 –a—— c:\windows\system32\deploytk.dll
2009-02-21 06:33 . 2009-02-21 06:33 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-02-21 06:31 . 2009-02-21 06:31 d——– c:\program files\Shockwave.com
2009-02-21 06:17 . 2009-02-22 19:30 d——– c:\program files\IObit
2009-02-21 06:17 . 2009-02-22 19:30 d——– c:\documents and settings\Mom\Application Data\IObit
2009-02-21 06:15 . 2009-02-21 06:15 d——– c:\windows\system32\Adobe
2009-02-21 06:15 . 2009-02-25 02:54 499,712 –a—— c:\windows\system32\msvcp71.dll
2009-02-21 06:15 . 2009-02-25 02:54 348,160 –a—— c:\windows\system32\msvcr71.dll
2009-02-21 06:13 . 2009-02-21 06:13 d——– c:\program files\Common Files\Adobe AIR
2009-02-21 06:12 . 2009-02-21 06:12 d——– c:\program files\Common Files\Adobe
2009-02-21 06:11 . 2009-02-21 22:28 d——– c:\program files\NOS
2009-02-21 06:11 . 2009-02-21 22:28 d——– c:\documents and settings\All Users\Application Data\NOS
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\system32\scripting
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\system32\en
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\system32\bits
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\l2schemas
2009-02-21 05:55 . 2009-02-21 05:55 d——– c:\windows\ServicePackFiles
2009-02-21 05:37 . 2008-12-20 18:15 6,066,688 —–c— c:\windows\system32\dllcache\ieframe.dll
2009-02-21 05:37 . 2007-04-17 04:32 2,455,488 —–c— c:\windows\system32\dllcache\ieapfltr.dat
2009-02-21 05:37 . 2007-03-08 00:10 991,232 —–c— c:\windows\system32\dllcache\ieframe.dll.mui
2009-02-21 05:37 . 2008-12-20 18:15 459,264 —–c— c:\windows\system32\dllcache\msfeeds.dll
2009-02-21 05:37 . 2008-12-20 18:15 383,488 —–c— c:\windows\system32\dllcache\ieapfltr.dll
2009-02-21 05:37 . 2008-12-20 18:15 267,776 —–c— c:\windows\system32\dllcache\iertutil.dll
2009-02-21 05:37 . 2008-12-20 18:15 63,488 —–c— c:\windows\system32\dllcache\icardie.dll
2009-02-21 05:37 . 2008-12-20 18:15 52,224 —–c— c:\windows\system32\dllcache\msfeedsbs.dll
2009-02-21 05:37 . 2008-12-19 04:10 13,824 —–c— c:\windows\system32\dllcache\ieudinit.exe
2009-02-21 05:21 . 2008-04-13 19:12 4,274,816 ——— c:\windows\system32\nv4_disp.dll
2009-02-21 05:20 . 2004-08-03 22:41 1,041,536 ——— c:\windows\system32\drivers\hsfdpsp2.sys
2009-02-21 05:11 . 2007-04-09 13:23 28,040 –a—— c:\windows\system32\mdimon.dll
2009-02-21 05:11 . 2009-02-27 23:16 376 –a—— c:\windows\ODBC.INI
2009-02-21 05:10 . 2009-02-21 05:10 d——– c:\program files\Common Files\L&H
2009-02-21 05:09 . 2009-02-21 05:22 d——– c:\program files\Microsoft Works
2009-02-21 05:09 . 2009-02-21 05:09 d——– c:\program files\Microsoft ActiveSync
2009-02-21 05:08 . 2009-02-21 05:09 d——– c:\windows\SHELLNEW
2009-02-21 05:07 . 2009-02-21 05:07 d——– c:\program files\Microsoft.NET
2009-02-21 05:06 . 2006-03-20 22:23 23,040 ——— c:\windows\kb913800.exe
2009-02-21 05:05 . 2009-02-21 05:05 dr-h—– C:\MSOCache
2009-02-21 05:04 . 2008-05-08 09:02 203,136 —–c— c:\windows\system32\dllcache\rmcast.sys
2009-02-21 05:02 . 2008-06-13 06:05 272,128 ——— c:\windows\system32\drivers\bthport.sys
2009-02-21 05:02 . 2008-06-13 06:05 272,128 —–c— c:\windows\system32\dllcache\bthport.sys
2009-02-21 05:01 . 2008-08-14 05:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-21 05:01 . 2008-08-14 05:09 2,145,280 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-21 05:01 . 2008-08-14 04:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-03 04:18 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-01 05:43 ——— d–h–w c:\program files\InstallShield Installation Information
2009-03-01 04:49 ——— d—–w c:\program files\Common Files\InstallShield
2009-02-21 12:27 ——— d—–w c:\documents and settings\All Users\Application Data\PC Tools
2009-02-21 11:23 ——— d—–w c:\program files\ESPNMotion
2009-02-21 11:23 ——— d—–w c:\program files\DIGStream
2009-02-21 09:58 ——— d—–w c:\documents and settings\Mom\Application Data\Creative
2009-02-21 09:53 ——— d—–w c:\program files\ThreatFire
2009-02-21 09:49 ——— d—–w c:\program files\Creative
2009-02-21 09:45 ——— d—–w c:\program files\CyberLink
2009-02-21 09:39 ——— d—–w c:\program files\ATI Technologies
2009-02-21 09:37 ——— d—–w c:\program files\Intel
2009-02-21 09:35 ——— d—–w c:\program files\Analog Devices
2009-02-21 09:23 ——— d—–w c:\program files\RGB
2009-02-21 09:21 ——— d—–w c:\program files\GemMaster
2009-02-21 09:21 ——— d—–w c:\program files\EnglishOtto
2009-02-21 09:21 ——— d—–w c:\documents and settings\All Users\Application Data\DIGStream
2009-02-21 09:10 ——— d—–w c:\program files\microsoft frontpage
2009-02-21 09:05 ——— d—–w c:\program files\Windows Plus
2009-02-02 19:04 39,184 —-a-w c:\windows\system32\drivers\TfSysMon.sys
2009-02-02 19:04 33,040 —-a-w c:\windows\system32\drivers\TfNetMon.sys
2009-02-02 19:04 12,560 —-a-w c:\windows\system32\drivers\TfKbMon.sys
2009-02-02 19:03 51,472 —-a-w c:\windows\system32\drivers\TfFsMon.sys
2008-12-20 23:15 826,368 —-a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-09 18:40 333192 –a—— c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-01 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-02-02 263440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-21 136600]
"Media Codec Update Service"="c:\program files\Essentials Codec Pack\WECPUpdate.exe" [2009-01-25 196608]
"PCTAVApp"="c:\program files\PC Tools AntiVirus\PCTAV.exe" [2008-12-04 1370000]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-01 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-25 198160]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"P17Helper"="P17.dll" [2004-06-10 c:\windows\system32\P17.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-02-21 51472]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-02-21 39184]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2009-02-21 464264]
R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-02-21 234888]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-02-21 33040]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-02-23 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-02-13 18:15]

2009-02-23 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\ [2009-02-22 19:30]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 23:22:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,49,c7,33,64,e6,
e6,ea,28,e2,63,26,f1,3f,c8,ff,68,c2,10,81,c5,89,b5,28,13,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,14,9c,09,ec,9e,
a5,5e,35,6a,9c,d6,61,af,45,84,18,41,cb,b9,89,8e,e3,0d,73,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,ed,bc,d9,a0,3d,
ab,da,64,ff,7c,85,e0,43,d4,0e,fe,dc,52,3b,4a,a0,07,50,11,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,ea,54,b0,28,f2,
e5,cc,7c,86,8c,21,01,be,91,eb,e7,df,74,ee,c2,5b,f2,6e,cb,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,02,64,1c,d1,ba,
50,b4,93,f5,1d,4d,73,a8,13,5c,05,ae,f5,b9,12,dd,2a,81,6b,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,b6,90,2b,c9,ea,
c9,9e,e3,df,20,58,62,78,6b,cf,c8,4e,cb,65,a4,02,39,f7,f6,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,0f,ef,f6,a1,8b,
64,5d,e6,fb,a7,78,e6,12,2f,9a,ea,7b,61,ae,7e,3d,db,ce,67,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,d2,40,19,4b,46,
e4,6b,55,01,3a,48,fc,e8,04,4a,f1,2a,6a,64,48,59,a7,bc,29,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,0d,55,37,6f,f9,
0e,cf,31,f6,0f,4e,58,98,5b,89,c9,32,6c,e6,7a,56,ba,3a,73,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,58,b3,ab,93,a1,
d8,7a,30,3d,ce,ea,26,2d,45,aa,78,26,61,19,0e,c1,92,2e,7d,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,ef,f9,4b,c2,b2,
ef,52,ad,2a,b7,cc,b5,b9,7f,41,e7,7f,85,40,f0,72,87,34,c4,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,80,3e,1c,19,a1,
ca,50,0e,6c,43,2d,1e,aa,22,2f,9c,30,92,a2,4f,7a,87,61,0b,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(700)
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll

- - - - - - - > 'lsass.exe'(756)
c:\program files\ThreatFire\TFWAH.dll

- - - - - - - > 'explorer.exe'(3816)
c:\program files\ThreatFire\TFWAH.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
Completion time: 2009-03-02 23:25:14
ComboFix-quarantined-files.txt 2009-03-03 04:25:08

Pre-Run: 61,875,249,152 bytes free
Post-Run: 61,952,749,568 bytes free

316 — E O F — 2009-03-01 15:08:10

LDTate

Post #4March 3, 2009, 1:21 PM UTC

Please go to http://virscan.org/ , click on Browse, and upload the following file for analysis:

c:\windows\unvise32qt.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virscan is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

http://www.virustotal.com/en/indexf.html

mesa215

Post #5March 4, 2009, 9:24 AM UTC last edited March 4, 2009, 9:34 AM UTC

After scanning this is the message i got with the options to click rescan or scan result: The file are unvise32qt.exe uploaded by other users and scanned successfully at 2009/01/01 22:05:52, and 37 softwares update the database from last scan to now. When I clicked scan result this is what came up: File information File Name : unvise32qt.exe File Size : 86016 byte File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5 : 23a458e8eb269a71a29ada0cb3e22e65 SHA1 : ed89dac3cc37f2d47f2df0824965a1bac8f4638f Scanner results Scanner results : All Scanners reported not find malware! Time : 2009/01/01 22:05:52 (CST) Scanner Engine Ver Sig Ver Sig Date Scan result Time a-squared 4.0.0.29 20081231214733 2008-12-31 - 2.764 AhnLab V3 2009.01.01.00 2009.01.01 2009-01-01 - 1.240 AntiVir 7.9.0.45 7.1.1.57 2008-12-31 - 1.681 Antiy 2.0.18 20090101.1949426 2009-01-01 - 0.120 Arcavir 1.0.5 200812131407 2008-12-13 - 1.241 Authentium 5.1.1 200901010724 2009-01-01 - 1.075 AVAST! 3.0.1 081231-1 2008-12-31 - 0.009 AVG 7.5.52.442 270.10.1/1870 2008-12-31 - 1.810 BitDefender 7.81008.2404036 7.22910 2009-01-01 - 2.195 CA (VET) 9.0.0.143 31.6.6286 2008-12-31 - 5.952 ClamAV 0.94.2 8823 2009-01-01 - 0.029 Comodo 3.0 859 2009-01-01 - 0.833 CP Secure 1.1.0.715 2009.01.01 2009-01-01 - 6.381 Dr.Web 4.44.0.9170 2009.01.01 2009-01-01 - 3.850 ewido 4.0.0.2 2008.12.31 2008-12-31 - 3.682 F-Prot 4.4.4.56 20090101 2009-01-01 - 1.069 F-Secure 5.51.6100 2009.01.01.01 2009-01-01 - 4.109 Fortinet 2.81-3.117 9.879 2008-12-31 - 0.203 GData 19.2202/19.167 20090101 2009-01-01 - 4.419 Ikarus T3.1.01.45 2009.01.01.72093 2009-01-01 - 4.108 JiangMin 11.0.706 2008.12.21 2008-12-21 - 1.925 Kaspersky 5.5.10 2009.01.01 2009-01-01 - 0.059 KingSoft 2008.9.8.18 2009.1.1.20 2009-01-01 - 0.692 McAfee 5.3.00 5480 2008-12-31 - 2.786 Microsoft 1.4205 2009.01.01 2009-01-01 - 4.076 mks_vir 2.01 2008.12.31 2008-12-31 - 2.676 Norman 5.93.01 5.93.00 2008-12-31 - 5.926 nProtect 20090101.01 2835575 2009-01-01 - 3.722 Panda 9.05.01 2008.12.31 2008-12-31 - 0.502 Quick Heal 10.00 2008.11.17 2008-11-17 - 0.909 Rising 20.0 21.10.22.00 2008-12-31 - 0.818 Sophos 2.82.1 4.37 2009-01-01 - 1.970 Sunbelt 4755 4755 2008-12-22 - 0.424 Symantec 1.3.0.24 20081231.003 2008-12-31 - 0.079 The Hacker [removed] v00202 2008-12-30 - 1.493 Trend Micro 8.700-1004 5.742.03 2009-01-01 - 0.030 VBA32 3.12.8.10 20081230.0938 2008-12-30 - 1.529 ViRobot 20081230 2008.12.30 2008-12-30 - 0.461 VirusBuster 4.5.11.10 10.100.11/757490 2008-12-31 - 1.021 Note: this file has been scanned before. Therefore, this file's scan result will not be stored in the database. …………………………………………………………………….. …. Also, if I open up more than 2 tabs in internet explorer, my browser closes without giving any error messages.

LDTate

Post #6March 4, 2009, 10:45 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

Folder::
c:\program files\AskBarDis

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.

mesa215

Post #7March 5, 2009, 12:12 AM UTC

Here are the results to the ComboFix Log:

ComboFix 09-03-03.01 - Mom 2009-03-04 18:54:20.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1530 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mom\Desktop\CFScript.txt
AV: PC Tools AntiVirus 5.0.1.1 *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\AskService.exe
c:\program files\AskBarDis\bar\bin\AskSplash.exe
c:\program files\AskBarDis\bar\bin\AskTBApp.exe
c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\001E6252
c:\program files\AskBarDis\bar\Cache\001E6426
c:\program files\AskBarDis\bar\Cache\001E64A3.bin
c:\program files\AskBarDis\bar\Cache\001E658E.bin
c:\program files\AskBarDis\bar\Cache\001E65FB.bin
c:\program files\AskBarDis\bar\Cache\001E6678.bin
c:\program files\AskBarDis\bar\Cache\001E66E5.bin
c:\program files\AskBarDis\bar\Cache\001E6762.bin
c:\program files\AskBarDis\bar\Cache\001E67D0.bin
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\AskLogo.ico
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe

.
((((((((((((((((((((((((( Files Created from 2009-02-04 to 2009-03-04 )))))))))))))))))))))))))))))))
.

2009-03-04 04:51 . 2009-03-04 05:23 d——– c:\program files\a-squared Free
2009-03-03 16:10 . 2009-03-03 16:24 d——– c:\documents and settings\Nani\Application Data\Azureus
2009-03-01 21:36 . 2009-03-01 21:36 d——– c:\program files\Unity
2009-03-01 12:13 . 2009-03-01 12:13 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-01 12:13 . 2009-03-01 12:13 d——– c:\documents and settings\Mom\Application Data\Malwarebytes
2009-03-01 12:13 . 2009-03-01 12:13 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-01 12:13 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-01 12:13 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-01 10:31 . 2009-03-01 10:31 d——– c:\documents and settings\Mom\Application Data\skypePM
2009-03-01 10:31 . 2009-03-01 10:31 56 –ah—– c:\windows\system32\ezsidmv.dat
2009-03-01 10:29 . 2009-03-03 18:45 d——– c:\documents and settings\All Users\Application Data\Skype
2009-03-01 10:07 . 2009-03-01 10:07 d——– c:\program files\MSXML 4.0
2009-03-01 04:12 . 2009-03-01 04:12 d——– c:\program files\MSECache
2009-03-01 00:57 . 2009-03-01 01:00 d——– c:\program files\Microsoft Picture It! 9
2009-03-01 00:33 . 2004-09-28 13:08 458,112 –a—— c:\windows\system32\drivers\MarvinUsb.sys
2009-03-01 00:33 . 2005-01-28 15:36 171,008 –a—— c:\windows\system32\drivers\MarvinBus.sys
2009-03-01 00:26 . 2009-03-01 00:26 d——– c:\program files\Pinnacle Systems
2009-02-28 23:49 . 2009-02-28 23:49 d——– c:\program files\SmartSound Software
2009-02-28 23:49 . 2009-02-28 23:50 d——– c:\documents and settings\All Users\Application Data\SmartSound Software Inc
2009-02-28 23:48 . 2009-03-01 00:17 d——– c:\windows\system32\QuickTime
2009-02-28 23:48 . 2009-03-01 00:09 d——– c:\program files\QuickTime
2009-02-28 23:48 . 2009-03-01 00:02 d——– c:\documents and settings\All Users\Application Data\QuickTime
2009-02-28 23:48 . 1999-11-10 12:05 86,016 –a—— c:\windows\unvise32qt.exe
2009-02-28 23:47 . 2002-03-19 10:29 14,165 ——— c:\windows\system32\drivers\Pclepci.sys
2009-02-28 23:44 . 2003-11-19 17:54 1,047,552 –a—— c:\windows\system32\MFC71u.dll
2009-02-28 23:38 . 2009-03-01 00:23 d——– c:\documents and settings\All Users\Application Data\Pinnacle
2009-02-28 23:37 . 2009-03-01 00:43 d——– c:\program files\Pinnacle
2009-02-27 13:05 . 2009-03-01 00:14 d——– c:\documents and settings\Mom\Application Data\LimeWire
2009-02-27 13:04 . 2009-02-27 13:04 d——– c:\program files\LunaPlayer
2009-02-27 04:13 . 2009-02-27 04:13 d——– c:\documents and settings\All Users\Application Data\PopCap
2009-02-27 03:58 . 2009-02-27 03:58 d——– c:\windows\Sun
2009-02-27 02:56 . 2009-02-27 05:33 d——– c:\program files\Oberon Media
2009-02-25 02:54 . 2009-02-25 02:54 d——– c:\program files\Real
2009-02-25 02:54 . 2009-02-25 02:54 d——– c:\program files\Common Files\xing shared
2009-02-25 02:54 . 2009-02-25 02:54 d——– c:\program files\Common Files\Real
2009-02-24 09:25 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2009-02-24 09:25 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2009-02-23 14:33 . 2009-02-23 14:33 d——– c:\documents and settings\Mom\Application Data\Leadertech
2009-02-23 14:32 . 2009-02-23 14:32 d——– C:\EPSONREG
2009-02-23 14:31 . 2009-02-23 14:31 d——– c:\program files\ArcSoft
2009-02-23 14:31 . 1995-08-01 04:44 212,480 –a—— c:\windows\PCDLIB32.DLL
2009-02-23 14:31 . 2005-02-23 14:58 11,776 –a—— c:\windows\system32\drivers\afc.sys
2009-02-23 14:29 . 2009-02-23 14:32 d——– c:\program files\epson
2009-02-23 14:29 . 2005-02-25 00:00 46,080 –a—— c:\windows\system32\escimgd.dll
2009-02-23 14:29 . 2000-06-06 13:01 34,304 –a—— c:\windows\system32\E_FBCHADA.DLL
2009-02-23 14:29 . 2005-02-25 00:00 29,696 –a—— c:\windows\system32\escwiad.dll
2009-02-23 14:29 . 2005-02-25 00:00 22,016 –a—— c:\windows\system32\esccmd.dll
2009-02-23 14:29 . 2009-02-23 14:32 44 –a—— c:\windows\EPCX4800.ini
2009-02-23 14:28 . 2008-04-13 13:45 26,368 –a–c— c:\windows\system32\dllcache\usbstor.sys
2009-02-23 14:28 . 2008-04-13 13:47 25,856 –a—— c:\windows\system32\drivers\usbprint.sys
2009-02-23 14:28 . 2008-04-13 13:47 25,856 –a–c— c:\windows\system32\dllcache\usbprint.sys
2009-02-23 01:53 . 2009-02-23 01:53 d——– c:\documents and settings\Yashe\Application Data\PC Tools
2009-02-23 01:52 . 2009-03-04 12:25 d——– c:\documents and settings\Yashe
2009-02-21 22:29 . 2009-02-21 22:29 1,374 –a—— c:\windows\imsins.BAK
2009-02-21 14:31 . 2009-02-21 14:31 d——– c:\documents and settings\Nani\Application Data\PC Tools
2009-02-21 14:30 . 2009-03-04 12:25 d——– c:\documents and settings\Nani
2009-02-21 13:49 . 2009-02-21 13:49 d——– c:\documents and settings\BJ\Application Data\PC Tools
2009-02-21 13:48 . 2009-03-04 12:25 d——– c:\documents and settings\BJ
2009-02-21 07:27 . 2009-02-21 07:27 d——– c:\documents and settings\Mom\Application Data\PC Tools
2009-02-21 07:25 . 2009-02-21 07:25 d——– c:\program files\Common Files\PC Tools
2009-02-21 07:25 . 2007-12-06 16:51 28,568 –a—— c:\windows\system32\drivers\AVHook.sys
2009-02-21 07:25 . 2007-12-06 16:51 21,912 –a—— c:\windows\system32\drivers\AVRec.sys
2009-02-21 07:25 . 2008-02-12 11:44 21,904 –a—— c:\windows\system32\drivers\AVFilter.sys
2009-02-21 07:24 . 2009-03-04 17:14 d——– c:\program files\PC Tools AntiVirus
2009-02-21 07:13 . 2009-02-21 07:13 d——– c:\program files\Trend Micro
2009-02-21 07:00 . 2009-02-21 07:00 d——– C:\ConverterOutput
2009-02-21 06:47 . 2009-02-21 06:47 d——– c:\program files\Essentials Codec Pack
2009-02-21 06:46 . 2002-11-02 09:53 57,344 –a—— c:\windows\system32\WNASPINT.DLL
2009-02-21 06:43 . 2009-02-21 06:58 d——– c:\program files\Cucusoft
2009-02-21 06:43 . 2004-10-05 16:16 395,776 –a—— c:\windows\system32\libmplayer.dll
2009-02-21 06:43 . 2004-10-12 14:42 262,144 –a—— c:\windows\system32\TomsMoComp_ff.dll
2009-02-21 06:43 . 2003-04-03 00:17 172,032 –a—— c:\windows\system32\ac3filter.ax
2009-02-21 06:43 . 2004-10-04 01:50 112,640 –a—— c:\windows\system32\libmpeg2_ff.dll
2009-02-21 06:43 . 2004-09-10 13:50 34,820 –a—— c:\windows\system32\ffdshow.reg
2009-02-21 06:36 . 2009-02-21 06:36 d——– c:\documents and settings\All Users\Application Data\Azureus
2009-02-21 06:35 . 2009-02-28 03:10 d——– c:\program files\Vuze
2009-02-21 06:35 . 2009-03-02 00:01 d——– c:\documents and settings\Mom\Application Data\Azureus
2009-02-21 06:33 . 2009-02-28 03:10 d——– c:\program files\LimeWire
2009-02-21 06:33 . 2009-02-21 06:33 d——– c:\program files\Java
2009-02-21 06:33 . 2009-02-21 06:33 410,984 –a—— c:\windows\system32\deploytk.dll
2009-02-21 06:33 . 2009-02-21 06:33 73,728 –a—— c:\windows\system32\javacpl.cpl
2009-02-21 06:31 . 2009-02-21 06:31 d——– c:\program files\Shockwave.com
2009-02-21 06:17 . 2009-02-22 19:30 d——– c:\program files\IObit
2009-02-21 06:17 . 2009-02-22 19:30 d——– c:\documents and settings\Mom\Application Data\IObit
2009-02-21 06:15 . 2009-02-21 06:15 d——– c:\windows\system32\Adobe
2009-02-21 06:15 . 2009-02-25 02:54 499,712 –a—— c:\windows\system32\msvcp71.dll
2009-02-21 06:15 . 2009-02-25 02:54 348,160 –a—— c:\windows\system32\msvcr71.dll
2009-02-21 06:13 . 2009-02-21 06:13 d——– c:\program files\Common Files\Adobe AIR
2009-02-21 06:12 . 2009-02-21 06:12 d——– c:\program files\Common Files\Adobe
2009-02-21 06:11 . 2009-02-21 22:28 d——– c:\program files\NOS
2009-02-21 06:11 . 2009-02-21 22:28 d——– c:\documents and settings\All Users\Application Data\NOS
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\system32\scripting
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\system32\en
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\system32\bits
2009-02-21 05:57 . 2009-02-21 05:57 d——– c:\windows\l2schemas
2009-02-21 05:55 . 2009-02-21 05:55 d——– c:\windows\ServicePackFiles
2009-02-21 05:37 . 2008-12-20 18:15 6,066,688 —–c— c:\windows\system32\dllcache\ieframe.dll
2009-02-21 05:37 . 2007-04-17 04:32 2,455,488 —–c— c:\windows\system32\dllcache\ieapfltr.dat
2009-02-21 05:37 . 2007-03-08 00:10 991,232 —–c— c:\windows\system32\dllcache\ieframe.dll.mui
2009-02-21 05:37 . 2008-12-20 18:15 459,264 —–c— c:\windows\system32\dllcache\msfeeds.dll
2009-02-21 05:37 . 2008-12-20 18:15 383,488 —–c— c:\windows\system32\dllcache\ieapfltr.dll
2009-02-21 05:37 . 2008-12-20 18:15 267,776 —–c— c:\windows\system32\dllcache\iertutil.dll
2009-02-21 05:37 . 2008-12-20 18:15 63,488 —–c— c:\windows\system32\dllcache\icardie.dll
2009-02-21 05:37 . 2008-12-20 18:15 52,224 —–c— c:\windows\system32\dllcache\msfeedsbs.dll
2009-02-21 05:37 . 2008-12-19 04:10 13,824 —–c— c:\windows\system32\dllcache\ieudinit.exe
2009-02-21 05:21 . 2008-04-13 19:12 4,274,816 ——— c:\windows\system32\nv4_disp.dll
2009-02-21 05:20 . 2004-08-03 22:41 1,041,536 ——— c:\windows\system32\drivers\hsfdpsp2.sys
2009-02-21 05:11 . 2007-04-09 13:23 28,040 –a—— c:\windows\system32\mdimon.dll
2009-02-21 05:11 . 2009-02-27 23:16 376 –a—— c:\windows\ODBC.INI
2009-02-21 05:10 . 2009-02-21 05:10 d——– c:\program files\Common Files\L&H
2009-02-21 05:09 . 2009-02-21 05:22 d——– c:\program files\Microsoft Works
2009-02-21 05:09 . 2009-02-21 05:09 d——– c:\program files\Microsoft ActiveSync
2009-02-21 05:08 . 2009-02-21 05:09 d——– c:\windows\SHELLNEW
2009-02-21 05:07 . 2009-02-21 05:07 d——– c:\program files\Microsoft.NET
2009-02-21 05:06 . 2006-03-20 22:23 23,040 ——— c:\windows\kb913800.exe
2009-02-21 05:05 . 2009-02-21 05:05 dr-h—– C:\MSOCache
2009-02-21 05:04 . 2008-05-08 09:02 203,136 —–c— c:\windows\system32\dllcache\rmcast.sys
2009-02-21 05:02 . 2008-06-13 06:05 272,128 ——— c:\windows\system32\drivers\bthport.sys
2009-02-21 05:02 . 2008-06-13 06:05 272,128 —–c— c:\windows\system32\dllcache\bthport.sys
2009-02-21 05:01 . 2008-08-14 05:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-21 05:01 . 2008-08-14 05:09 2,145,280 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-21 05:01 . 2008-08-14 04:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-21 05:01 . 2008-08-14 04:33 2,023,936 —–c— c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-21 05:01 . 2008-09-15 07:12 1,846,400 —–c— c:\windows\system32\dllcache\win32k.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-04 23:50 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-01 05:43 ——— d–h–w c:\program files\InstallShield Installation Information
2009-03-01 04:49 ——— d—–w c:\program files\Common Files\InstallShield
2009-02-21 12:27 ——— d—–w c:\documents and settings\All Users\Application Data\PC Tools
2009-02-21 11:23 ——— d—–w c:\program files\ESPNMotion
2009-02-21 11:23 ——— d—–w c:\program files\DIGStream
2009-02-21 09:58 ——— d—–w c:\documents and settings\Mom\Application Data\Creative
2009-02-21 09:53 ——— d—–w c:\program files\ThreatFire
2009-02-21 09:49 ——— d—–w c:\program files\Creative
2009-02-21 09:45 ——— d—–w c:\program files\CyberLink
2009-02-21 09:39 ——— d—–w c:\program files\ATI Technologies
2009-02-21 09:37 ——— d—–w c:\program files\Intel
2009-02-21 09:35 ——— d—–w c:\program files\Analog Devices
2009-02-21 09:23 ——— d—–w c:\program files\RGB
2009-02-21 09:21 ——— d—–w c:\program files\GemMaster
2009-02-21 09:21 ——— d—–w c:\program files\EnglishOtto
2009-02-21 09:21 ——— d—–w c:\documents and settings\All Users\Application Data\DIGStream
2009-02-21 09:10 ——— d—–w c:\program files\microsoft frontpage
2009-02-21 09:05 ——— d—–w c:\program files\Windows Plus
2009-02-02 19:04 39,184 —-a-w c:\windows\system32\drivers\TfSysMon.sys
2009-02-02 19:04 33,040 —-a-w c:\windows\system32\drivers\TfNetMon.sys
2009-02-02 19:04 12,560 —-a-w c:\windows\system32\drivers\TfKbMon.sys
2009-02-02 19:03 51,472 —-a-w c:\windows\system32\drivers\TfFsMon.sys
2008-12-20 23:15 826,368 —-a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-03-02_23.23.37.73 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-10 21:54:56 409,168 —-a-w c:\windows\Downloaded Program Files\MSDcode.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-01 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"CTSysVol"="c:\program files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-02-02 263440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-21 136600]
"Media Codec Update Service"="c:\program files\Essentials Codec Pack\WECPUpdate.exe" [2009-01-25 196608]
"PCTAVApp"="c:\program files\PC Tools AntiVirus\PCTAV.exe" [2008-12-04 1370000]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-01 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-25 198160]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"P17Helper"="P17.dll" [2004-06-10 c:\windows\system32\P17.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-02-21 51472]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-02-21 39184]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-02-21 33040]
S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe –> c:\program files\AskBarDis\bar\bin\AskService.exe [?]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe –> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - A2FREE
*NewlyCreated* - APPMGMT
*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-02-23 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-02-13 18:15]

2009-02-23 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\ [2009-02-22 19:30]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-04 18:59:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,49,c7,33,64,e6,
e6,ea,28,e2,63,26,f1,3f,c8,ff,68,c2,10,81,c5,89,b5,28,13,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,14,9c,09,ec,9e,
a5,5e,35,6a,9c,d6,61,af,45,84,18,41,cb,b9,89,8e,e3,0d,73,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,ed,bc,d9,a0,3d,
ab,da,64,ff,7c,85,e0,43,d4,0e,fe,dc,52,3b,4a,a0,07,50,11,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,ea,54,b0,28,f2,
e5,cc,7c,86,8c,21,01,be,91,eb,e7,df,74,ee,c2,5b,f2,6e,cb,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,02,64,1c,d1,ba,
50,b4,93,f5,1d,4d,73,a8,13,5c,05,ae,f5,b9,12,dd,2a,81,6b,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,b6,90,2b,c9,ea,
c9,9e,e3,df,20,58,62,78,6b,cf,c8,4e,cb,65,a4,02,39,f7,f6,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,0f,ef,f6,a1,8b,
64,5d,e6,fb,a7,78,e6,12,2f,9a,ea,7b,61,ae,7e,3d,db,ce,67,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,d2,40,19,4b,46,
e4,6b,55,01,3a,48,fc,e8,04,4a,f1,2a,6a,64,48,59,a7,bc,29,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,0d,55,37,6f,f9,
0e,cf,31,f6,0f,4e,58,98,5b,89,c9,32,6c,e6,7a,56,ba,3a,73,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,58,b3,ab,93,a1,
d8,7a,30,3d,ce,ea,26,2d,45,aa,78,26,61,19,0e,c1,92,2e,7d,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,ef,f9,4b,c2,b2,
ef,52,ad,2a,b7,cc,b5,b9,7f,41,e7,7f,85,40,f0,72,87,34,c4,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,80,3e,1c,19,a1,
ca,50,0e,6c,43,2d,1e,aa,22,2f,9c,30,92,a2,4f,7a,87,61,0b,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(700)
c:\program files\ThreatFire\TFWAH.dll
c:\program files\ThreatFire\TFNI.dll

- - - - - - - > 'lsass.exe'(756)
c:\program files\ThreatFire\TFWAH.dll
.
Completion time: 2009-03-04 19:01:48
ComboFix-quarantined-files.txt 2009-03-05 00:01:44
ComboFix2.txt 2009-03-03 04:25:17

Pre-Run: 61,051,011,072 bytes free
Post-Run: 61,257,244,672 bytes free

337 — E O F — 2009-03-01 15:08:10
……………………………………………………………………..
…………….
I have not recieved any more popups alerting me of infections and asking me to download antivirus software. So far my browser has not closed when opening up more than two tabs. Thank you for your time in helping me. I really appreciate it. Also I was wondering, last time you had mentioned things I could use to keep my computer safe, one of which was a firewall. The only firewall I have is the one that comes with windows. Do I need to download one? If so, which one do you recommend? Also, my kids like to go on myspace and youtube, is there anything I can use besides the intelliguard from PC Tools Antivirus and my PC Tools Threatfire to help ensure that they are not causing harm to the PC from these sites?

LDTate

Post #8March 5, 2009, 12:20 AM UTC last edited March 5, 2009, 12:20 AM UTC

intelliguard from PC Tools Antivirus and my PC Tools Threatfire are as good as any others that I know of.

For firewalls it's try and see what you like. Your windows firewall protects you from incoming but doesn't check outgoing.

Below is a list of some free firewalls (in no order of preference).
- Agnitum Outpost FIrewall
- Blink
- Comodo
- Jetico Personal Firewall
- Primedius Firewall Lite
- R-Firewall
- Soft perfect
- Sunbelt Kerio Firewall
It is important to note that you should only have one firewall installed at a time, but you can download to your Desktop and install each in turn to see which one you prefer.

Be sure to do this:

Good job

The following will implement some cleanup procedures as well as reset System Restore points:
- Click START then RUN
- Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  - [external image: Posted Image]
  Here's my usual all clean post
  
  Log looks good
  - Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
    5. Change the Download signed ActiveX controls to Prompt
    6. Change the Download unsigned ActiveX controls to Disable
    7. Change the Initialize and script ActiveX controls not marked as safe to Disable
    8. Change the Installation of desktop items to Prompt
    9. Change the Launching programs and files in an IFRAME to Prompt
    10. Change the Navigate sub-frames across different domains to Prompt
    11. When all these settings have been made, click on the OK button.
    12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

LDTate

Post #9March 8, 2009, 6:24 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] New Upgrades Slow PC

✨ Ask AI

Ask AI