What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] HijackThis Log HELP!

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
So please forgive me for being so clueless as to if I have been infected…but lately the internet connection at my house has been VERY out of whack, and with 4 of us living all together connected to the web wireless (through Broadstripe) there has been quite some moments of disconnections during virus/malaware updates. Recently I has to backup and restore my Blackberry, during this…there was a "web flux" and when I looked down I saw a blue icon with a white wrench in it's center, then it disappeared! I have searched and found that it is a Uniblue product that I DID not download to my computer….so I have heard of this service and need to know if you can see any "oddness" or infections with what it scanned. Thank you dearly, and to hell with Broadstripe!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seattle.craigslist.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1238488492878
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
Post #2
Hi sagealicious,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please be careful when posting logs that you actually post the whole log. The HijackThis log you have posted is missing the header information.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3
Hi Tomk,

I did what you instructed, I already had Malwarebytes' Anti-Malware and there are 2 area's C: & D: and here are the results~

Malwarebytes' Anti-Malware 1.36
Database version: 1983
Windows 5.1.2600 Service Pack 2

4/15/2009 12:20:24 AM
mbam-log-2009-04-15 (00-20-24).txt

Scan type: Full Scan (C:\|)
Objects scanned: 118296
Time elapsed: 44 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Malwarebytes' Anti-Malware 1.36
Database version: 1983
Windows 5.1.2600 Service Pack 2

4/14/2009 11:28:21 PM
mbam-log-2009-04-14 (23-28-21).txt

Scan type: Full Scan (D:\|)
Objects scanned: 67686
Time elapsed: 1 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

And below this is the new HijackThis logfile, you will see that I have added some new programs since the first scan, and before I
received your response I went to www.regsofts.com and used their Free Window Registry Repair 1.8, and after that I went to
www.secunia.com and used Secunia PSI scan which informed me of what apps I have and checked for any security patches, locates them, and applies them. I was missing Java all together, and the latest Adobe product so I downloaded what was needed.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:31:15 AM, on 4/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\My Documents\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seattle.craigslist.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UVS12 Preload] C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1238488492878
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 5214 bytes

So far everything appears to be running fine after I did what you instructed, my computer is a bit slow on closing or minimizing my browser windows, but for now all seems good. I will know more within a day or two, to really observe everything in action, but it rebooted fine, a little sluggish on the appearance of my desktop icons, and changed my task bar up a bit.
I thank you for your time in helping me with all of this and I WILL NOT download anymore programs until I hear from you. :thumbup:
Post #4
sagealicious,


Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post #5 last edited
TomK, so I hit the link and it went through it's program and at the end it shut my computer down, the screen went black and into a shut down mode. I received a yellow triangle with a { ! } in it before it shut down, after wards when my computer rebooted there was another warning symbol that was red with a { x } in it, I clicked on it and it lead me to my Microsoft security screen, everything there was normal. My firewall was on, my security virus program was set fine, and my update is set proper. So my next question is where do we go from here? I was never able to get the report of it's scan and I am a tad leary of doing it again.
Post #6
sagealicious,

Let's get a different look at what's going on.

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #7
Hi TomK, Here is what you asked for, I hope it helps~ DDS (Ver_09-03-16.01) - NTFSx86 Run by [removed] at 11:48:20.25 on Sun 04/19/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255.98 [GMT -7:00] AV: avast! antivirus 4.8.1335 [VPS 090419-0] *On-access scanning disabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Secunia\PSI\psi.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://seattle.craigslist.org/ uInternet Settings,ProxyOverride = *.local mWinlogon: SfcDisable=-99 (0xffffff9d) BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [UVS12 Preload] c:\program files\corel\corel videostudio 12\uvPL.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N StartupFolder: c:\docume~1\owner\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238488492878 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?e=1239730859250&h;=b32b4b5deca156699c5b773c210b6189/&filename;=jinstall-6u13-windows-i586-jc.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Notification Packages = :\windows\system32\srr ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\gu8pkrmk.default\ FF - prefs.js: browser.startup.homepage - hxxp://seattle.craigslist.org/ FF - prefs.js: network.proxy.type - 2 ============= SERVICES / DRIVERS =============== R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-9 130424] R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [2009-4-2 149376] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-4-2 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-4-2 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-4-2 138680] R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-3-24 7808] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-4-2 254040] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-4-2 352920] S3 sdAuxService;PC Tools Auxiliary Service; [x] S3 sdCoreService;PC Tools Security Service; [x] S4 getPlus® Helper;getPlus® Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-3-31 33176] =============== Created Last 30 ================ 2009-04-15 09:03 283,648 ——– c:\windows\system32\dllcache\pdh.dll 2009-04-15 09:03 60,416 ——– c:\windows\system32\dllcache\colbact.dll 2009-04-15 09:03 35,328 ——– c:\windows\system32\dllcache\sc.exe 2009-04-15 09:03 399,360 ——– c:\windows\system32\dllcache\rpcss.dll 2009-04-15 09:03 110,592 ——– c:\windows\system32\dllcache\services.exe 2009-04-15 09:03 473,088 ——– c:\windows\system32\dllcache\fastprox.dll 2009-04-15 09:03 227,840 ——– c:\windows\system32\dllcache\wmiprvse.exe 2009-04-15 09:03 453,120 ——– c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-15 09:03 616,960 ——– c:\windows\system32\dllcache\advapi32.dll 2009-04-15 09:03 714,752 ——– c:\windows\system32\dllcache\ntdll.dll 2009-04-15 09:02 215,552 ——– c:\windows\system32\dllcache\wordpad.exe 2009-04-14 12:09 –d—– c:\program files\Secunia 2009-04-14 10:44 410,984 a——- c:\windows\system32\deploytk.dll 2009-04-14 10:44 73,728 a——- c:\windows\system32\javacpl.cpl 2009-04-14 07:58 –d—– c:\program files\Free Window Registry Repair 2009-04-11 10:55 –d—– c:\program files\iPod 2009-04-11 10:55 –d—– c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-11 10:55 –d—– c:\program files\iTunes 2009-04-09 18:31 –d—– c:\docume~1\alluse~1\applic~1\InterVideo 2009-04-09 18:31 209,040 a——- c:\windows\system32\IVIresizeW7.dll 2009-04-09 18:31 192,656 a——- c:\windows\system32\IVIresizePX.dll 2009-04-09 18:31 204,944 a——- c:\windows\system32\IVIresizeA6.dll 2009-04-09 18:31 196,752 a——- c:\windows\system32\IVIresizeP6.dll 2009-04-09 18:31 196,752 a——- c:\windows\system32\IVIresizeM6.dll 2009-04-09 18:31 24,720 a——- c:\windows\system32\IVIresize.dll 2009-04-09 18:30 –d—– c:\program files\Windows Media Components 2009-04-09 18:28 –d—– c:\program files\common files\Ulead Systems 2009-04-09 18:22 –d—– c:\program files\Corel 2009-04-09 16:37 159,600 a——- c:\windows\system32\drivers\pctgntdi.sys 2009-04-09 16:36 130,424 a——- c:\windows\system32\drivers\PCTCore.sys 2009-04-09 16:36 73,840 a——- c:\windows\system32\drivers\PCTAppEvent.sys 2009-04-09 16:36 –d—– c:\program files\common files\PC Tools 2009-04-09 16:36 64,392 a——- c:\windows\system32\drivers\pctplsg.sys 2009-04-09 16:35 –d—– c:\docume~1\owner\applic~1\PC Tools 2009-04-09 16:35 –d—– c:\docume~1\alluse~1\applic~1\PC Tools 2009-04-09 04:21 –d—– c:\windows\system32\URTTemp 2009-04-09 03:37 –d—– c:\program files\common files\Research In Motion 2009-04-09 03:37 –dsh— c:\windows\ftpcache 2009-04-08 12:25 –d—– c:\docume~1\owner\applic~1\Uniblue 2009-04-08 00:38 –d—– c:\docume~1\owner\applic~1\Research In Motion 2009-04-08 00:38 26,752 a—-r– c:\windows\system32\drivers\RimSerial.sys 2009-04-08 00:37 –d—– c:\docume~1\owner\applic~1\Blackberry Desktop 2009-04-08 00:37 –d—– c:\program files\Research In Motion 2009-04-07 02:04 –d—– c:\program files\PhotoScape 2009-04-05 21:57 –d—– c:\docume~1\owner\applic~1\Malwarebytes 2009-04-05 21:57 15,504 a——- c:\windows\system32\drivers\mbam.sys 2009-04-05 21:57 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-05 21:57 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-04-05 21:57 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-04-05 16:48 –dsh— c:\documents and settings\owner\IECompatCache 2009-04-05 16:44 –dsh— c:\documents and settings\owner\PrivacIE 2009-04-05 16:01 -cd-h— c:\windows\ie8 2009-04-05 15:58 –d—– C:\7c2ea96219150eee07caf230d4 2009-04-05 15:46 –dsh— c:\documents and settings\owner\IETldCache 2009-04-05 15:06 –d—– c:\windows\ie8updates 2009-04-05 15:00 105,984 ——– c:\windows\system32\dllcache\iecompat.dll 2009-04-05 03:54 –d—– C:\f232687e6b3c85c76f6892 2009-04-04 08:34 –d—– c:\windows\system32\CatRoot_bak 2009-04-04 07:44 564,224 a——- c:\windows\system32\drivers\BCMWL5.SYS 2009-04-04 07:44 –d—– c:\program files\Broadcom 2009-04-04 06:45 –d—– C:\dell 2009-04-02 18:35 217,118 a——- c:\windows\system32\dllcache\apphelp.sdb 2009-04-02 18:34 1,287,680 a——- c:\windows\system32\dllcache\quartz.dll 2009-04-02 12:42 –d—– c:\program files\GRETECH 2009-04-02 10:48 –d—– c:\program files\CCleaner 2009-04-02 06:36 12,160 a——- c:\windows\system32\drivers\mouhid.sys 2009-04-02 06:36 12,160 a——- c:\windows\system32\dllcache\mouhid.sys 2009-04-02 06:36 10,368 a——- c:\windows\system32\drivers\hidusb.sys 2009-04-02 06:36 10,368 a——- c:\windows\system32\dllcache\hidusb.sys 2009-04-01 15:23 5,208 a——- c:\windows\system32\pid.PNF 2009-04-01 15:03 –d—– c:\windows\system32\xircom 2009-04-01 15:03 –d—– c:\program files\msn gaming zone 2009-04-01 14:51 –d—– c:\windows\system32\scripting 2009-04-01 14:51 –d—– c:\windows\system32\en 2009-04-01 14:51 –d—– c:\windows\l2schemas 2009-04-01 14:51 –d—– c:\windows\system32\bits 2009-04-01 14:46 –d—– c:\windows\network diagnostic 2009-04-01 14:44 –d—– c:\windows\system32\ReinstallBackups 2009-04-01 14:41 –d—– c:\windows\EHome 2009-04-01 09:28 –d—– C:\SWSetup 2009-04-01 08:49 594,432 a——- c:\windows\system32\dllcache\msfeeds.dll 2009-04-01 08:49 55,296 a——- c:\windows\system32\dllcache\msfeedsbs.dll 2009-04-01 08:49 1,985,024 a——- c:\windows\system32\dllcache\iertutil.dll 2009-04-01 08:49 59,904 a——- c:\windows\system32\dllcache\icardie.dll 2009-04-01 08:49 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe 2009-04-01 08:49 445,952 a——- c:\windows\system32\dllcache\ieapfltr.dll 2009-04-01 08:49 3,698,584 a——- c:\windows\system32\dllcache\ieapfltr.dat 2009-04-01 08:49 1,241,088 a——- c:\windows\system32\dllcache\ieframe.dll.mui 2009-04-01 08:49 11,063,808 a——- c:\windows\system32\dllcache\ieframe.dll 2009-04-01 01:45 –d—– c:\windows\pss 2009-03-31 07:01 584,192 ——– c:\windows\system32\dllcache\rpcrt4.dll 2009-03-31 06:33 –d—– c:\program files\DivX 2009-03-31 06:33 –d—– c:\program files\common files\DivX Shared 2009-03-31 06:31 –d—– c:\program files\Combined Community Codec Pack 2009-03-31 06:22 –d—– c:\windows\system32\Adobe 2009-03-31 06:18 268,648 a——- c:\windows\system32\mucltui.dll 2009-03-31 06:18 27,496 a——- c:\windows\system32\mucltui.dll.mui 2009-03-31 06:07 107,368 a——- c:\windows\system32\GEARAspi.dll 2009-03-31 06:07 23,400 a——- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-03-31 06:06 –d—– c:\docume~1\alluse~1\applic~1\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} 2009-03-31 06:06 –d—– c:\program files\Bonjour 2009-03-31 06:05 1,900,544 a——- c:\windows\system32\usbaaplrc.dll 2009-03-31 06:05 36,864 a——- c:\windows\system32\drivers\usbaapl.sys 2009-03-31 05:24 81,984 a——- c:\windows\system32\bdod.bin 2009-03-31 05:18 –d—– c:\program files\common files\Softwin 2009-03-31 05:14 –d—– c:\program files\Windows Installer Clean Up 2009-03-31 05:14 –d—– c:\program files\MSECACHE 2009-03-31 03:37 1,024 a——- c:\windows\system32\AutoPartNt.let 2009-03-31 03:37 2,069,272 a——- c:\windows\system32\AutoPartNt.exe 2009-03-31 03:30 971,552 a——- c:\windows\system32\drivers\tdrpm174.sys 2009-03-31 03:30 540,000 a——- c:\windows\system32\drivers\timntr.sys 2009-03-31 03:30 44,704 a——- c:\windows\system32\drivers\tifsfilt.sys 2009-03-31 02:38 –d—– c:\program files\Windows Media Connect 2 2009-03-31 02:36 –d—– c:\windows\system32\LogFiles 2009-03-31 01:52 5,937,152 a——- c:\windows\system32\dllcache\mshtml.dll 2009-03-31 01:49 331,776 a——- c:\windows\system32\dllcache\msadce.dll 2009-03-31 01:48 247,326 a——- c:\windows\system32\dllcache\strmdll.dll 2009-03-31 01:48 1,106,944 a——- c:\windows\system32\dllcache\msxml3.dll 2009-03-31 01:43 –d—– c:\program files\SoundSpectrum 2009-03-31 01:32 –d—– c:\windows\system32\PreInstall 2009-03-31 01:32 26,144 a——- c:\windows\system32\spupdsvc.exe 2009-03-31 01:32 –d-h— c:\windows\$hf_mig$ 2009-03-24 04:03 7,808 a——- c:\windows\system32\drivers\psi_mf.sys ==================== Find3M ==================== 2009-04-04 05:49 76,487 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-03-21 07:18 986,112 ——– c:\windows\system32\dllcache\kernel32.dll 2009-03-08 14:09 638,816 a——- c:\windows\system32\dllcache\iexplore.exe 2009-03-08 14:09 391,536 a——- c:\windows\system32\dllcache\iedkcs32.dll 2009-03-08 04:34 914,944 a——- c:\windows\system32\wininet.dll 2009-03-08 04:34 914,944 a——- c:\windows\system32\dllcache\wininet.dll 2009-03-08 04:34 1,206,784 a——- c:\windows\system32\dllcache\urlmon.dll 2009-03-08 04:34 236,544 a——- c:\windows\system32\dllcache\webcheck.dll 2009-03-08 04:34 43,008 a——- c:\windows\system32\licmgr10.dll 2009-03-08 04:34 43,008 a——- c:\windows\system32\dllcache\licmgr10.dll 2009-03-08 04:34 105,984 a——- c:\windows\system32\dllcache\url.dll 2009-03-08 04:34 193,536 a——- c:\windows\system32\dllcache\msrating.dll 2009-03-08 04:34 109,568 a——- c:\windows\system32\dllcache\occache.dll 2009-03-08 04:33 759,296 a——- c:\windows\system32\dllcache\VGX.dll 2009-03-08 04:33 18,944 a——- c:\windows\system32\dllcache\corpol.dll 2009-03-08 04:33 18,944 a——- c:\windows\system32\corpol.dll 2009-03-08 04:33 25,600 a——- c:\windows\system32\dllcache\jsproxy.dll 2009-03-08 04:33 726,528 a——- c:\windows\system32\dllcache\jscript.dll 2009-03-08 04:33 229,376 a——- c:\windows\system32\dllcache\ieaksie.dll 2009-03-08 04:33 420,352 a——- c:\windows\system32\vbscript.dll 2009-03-08 04:33 420,352 a——- c:\windows\system32\dllcache\vbscript.dll 2009-03-08 04:33 125,952 a——- c:\windows\system32\dllcache\ieakeng.dll 2009-03-08 04:32 72,704 a——- c:\windows\system32\dllcache\admparse.dll 2009-03-08 04:32 72,704 a——- c:\windows\system32\admparse.dll 2009-03-08 04:32 173,056 a——- c:\windows\system32\dllcache\ie4uinit.exe 2009-03-08 04:32 163,840 a——- c:\windows\system32\dllcache\ieakui.dll 2009-03-08 04:32 71,680 a——- c:\windows\system32\iesetup.dll 2009-03-08 04:32 71,680 a——- c:\windows\system32\dllcache\iesetup.dll 2009-03-08 04:32 55,808 a——- c:\windows\system32\dllcache\iernonce.dll 2009-03-08 04:32 128,512 a——- c:\windows\system32\dllcache\advpack.dll 2009-03-08 04:32 94,720 a——- c:\windows\system32\dllcache\inseng.dll 2009-03-08 04:32 611,840 a——- c:\windows\system32\dllcache\mstime.dll 2009-03-08 04:31 183,808 a——- c:\windows\system32\dllcache\iepeers.dll 2009-03-08 04:31 348,160 a——- c:\windows\system32\dllcache\dxtmsft.dll 2009-03-08 04:31 216,064 a——- c:\windows\system32\dllcache\dxtrans.dll 2009-03-08 04:31 34,816 a——- c:\windows\system32\imgutil.dll 2009-03-08 04:31 34,816 a——- c:\windows\system32\dllcache\imgutil.dll 2009-03-08 04:31 46,592 a——- c:\windows\system32\dllcache\pngfilt.dll 2009-03-08 04:31 66,560 a——- c:\windows\system32\dllcache\mshtmled.dll 2009-03-08 04:31 48,128 a——- c:\windows\system32\mshtmler.dll 2009-03-08 04:31 48,128 a——- c:\windows\system32\dllcache\mshtmler.dll 2009-03-08 04:31 45,568 a——- c:\windows\system32\mshta.exe 2009-03-08 04:31 45,568 a——- c:\windows\system32\dllcache\mshta.exe 2009-03-08 04:24 68,608 a——- c:\windows\system32\dllcache\hmmapi.dll 2009-03-08 04:22 156,160 a——- c:\windows\system32\msls31.dll 2009-03-08 04:22 156,160 a——- c:\windows\system32\dllcache\msls31.dll 2009-03-07 00:16 140,288 a——- c:\windows\system32\sfc_os.dll 2009-03-07 00:16 984,576 a——- c:\windows\system32\syssetup.dll 2009-03-06 07:44 283,648 a——- c:\windows\system32\pdh.dll 2009-02-24 12:34 90,112 a——- c:\windows\system32\dpl100.dll 2009-02-24 12:34 823,296 a——- c:\windows\system32\divx_xx0c.dll 2009-02-24 12:34 823,296 a——- c:\windows\system32\divx_xx07.dll 2009-02-24 12:34 815,104 a——- c:\windows\system32\divx_xx0a.dll 2009-02-24 12:34 802,816 a——- c:\windows\system32\divx_xx11.dll 2009-02-24 12:34 684,032 a——- c:\windows\system32\DivX.dll 2009-02-09 03:20 723,456 a——- c:\windows\system32\lsasrv.dll 2009-02-09 03:20 399,360 a——- c:\windows\system32\rpcss.dll 2009-02-09 03:20 723,456 ——– c:\windows\system32\dllcache\lsasrv.dll 2009-02-09 03:20 714,752 a——- c:\windows\system32\ntdll.dll 2009-02-09 03:20 616,960 a——- c:\windows\system32\advapi32.dll 2009-02-09 03:19 1,846,272 a——- c:\windows\system32\win32k.sys 2009-02-09 03:19 1,846,272 a——- c:\windows\system32\dllcache\win32k.sys 2009-02-06 10:24 2,180,480 a——- c:\windows\system32\ntoskrnl.exe 2009-02-06 10:24 2,180,480 a——- c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 10:22 2,136,064 a——- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 10:14 110,592 a——- c:\windows\system32\services.exe 2009-02-06 09:54 35,328 a——- c:\windows\system32\sc.exe 2009-02-06 09:49 2,057,728 a——- c:\windows\system32\ntkrnlpa.exe 2009-02-06 09:49 2,057,728 a——- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-06 09:49 2,015,744 a——- c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-03 13:08 55,808 a——- c:\windows\system32\secur32.dll 2009-02-03 13:08 55,808 ——– c:\windows\system32\dllcache\secur32.dll ============= FINISH: 11:49:11.90 =============== Please let me know if I did anything wrong, or what else I may do to help you. ;)

Attachments:

Post #8
sagealicious,

You apparently have some ongoing errors with Ipod. You've also got a couple other nasies in there.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #9
Hi TomK,

I did as you requested and here is the log~

ComboFix 09-04-20.02 - Owner 04/19/2009 16:31.1 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090419-0] *On-access scanning disabled* (Updated)
.


——- Sigcheck ——-

[-] 2003-05-16 07:46 502272 6225F14B8CE08CCBA8B25AD27843C674 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"UVS12 Preload"="c:\program files\Corel\Corel VideoStudio 12\uvPL.exe" [2008-06-09 397456]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-04-03 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-14 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-3-24 748840]

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Desktop Manager.lnk]
backup=c:\windows\pss\Desktop Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"getPlus® Helper"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\SoundSpectrum\\G-Force\\G-Force Standalone.exe"=
"c:\\Program Files\\SoundSpectrum\\G-Force\\G-Force V-Bar.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 0 (0x0)
"AllowInboundRouterRequest"= 0 (0x0)
"AllowRedirect"= 0 (0x0)

R3 sdAuxService;PC Tools Auxiliary Service; [x]
R4 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-03 33176]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424]
S0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\DRIVERS\tffsport.sys [2004-08-04 149376]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2009-03-24 7808]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{153aab41-8732-11d7-ab07-806d6172696f}]
\shell\play\command - "c:\program files\iTunes\iTunes.exe" /playCD "%L"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-04-19 c:\windows\Tasks\User_Feed_Synchronization-{25DAB1DE-4C55-47EE-A530-CE17152012C3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
Notify-dimsntfy - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://seattle.craigslist.org/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\gu8pkrmk.default\
FF - prefs.js: browser.startup.homepage - hxxp://seattle.craigslist.org/
FF - prefs.js: network.proxy.type - 2
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 16:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1409082233-688789844-1343024091-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(4036)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-04-19 16:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-19 23:44

Pre-Run: 28,841,840,640 bytes free
Post-Run: 28,991,242,240 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
122 — E O F — 2009-04-15 16:48

So now what happens? You said some of my problems were with my iPod, is there the possibility that it has my nasties stored inside it? And can you explain, if possible, the other nasties I had going on?

I will await your reply, and once again, Thank You!!!!!! :thumbup:
Post #10
This is your event log for the last week.

==== Event Viewer Messages From Past Week ========

4/19/2009 11:31:52 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
4/19/2009 11:31:52 AM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/19/2009 11:31:44 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
4/16/2009 3:35:19 AM, error: Service Control Manager [7001] - The Universal Plug and Play Device Host service depends on the SSDP Discovery Service service which failed to start because of the following error: The account specified for this service is different from the account specified for other services running in the same process.
4/16/2009 3:35:15 AM, error: DCOM [10005] - DCOM got error "%1068" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
4/15/2009 9:01:18 AM, error: Dhcp [1002] - The IP address lease 192.168.1.107 for the Network Card with network address 001641193F2E has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
4/15/2009 4:48:50 AM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.109 with the system having network hardware address 00:0C:41:14:11:FF. Network operations on this system may be disrupted as a result.
4/15/2009 2:31:32 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
4/14/2009 8:59:57 PM, error: Service Control Manager [7000] - The SSDP Discovery Service service failed to start due to the following error: The account specified for this service is different from the account specified for other services running in the same process.
4/14/2009 8:58:04 PM, error: Service Control Manager [7034] - The avast! Web Scanner service terminated unexpectedly. It has done this 1 time(s).
4/14/2009 8:57:06 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the avast! Web Scanner service to connect.
4/14/2009 8:57:06 PM, error: Service Control Manager [7000] - The avast! Web Scanner service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/14/2009 8:55:56 PM, error: Service Control Manager [7000] - The WebClient service failed to start due to the following error: The account specified for this service is different from the account specified for other services running in the same process.
4/14/2009 8:55:56 PM, error: Service Control Manager [7000] - The Upload Manager service failed to start due to the following error: The account specified for this service is different from the account specified for other services running in the same process.
4/14/2009 11:38:12 AM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
4/12/2009 12:56:32 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

==== End Of File ===========================

I don't know much about Ipods but you will notice that it is named in several of the errors.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::

Folder::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{153aab41-8732-11d7-ab07-806d6172696f}]

Driver::
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.



Then, let's try Kaspersky online again please.
Post #11 last edited
Tomk,

Ok, I did notice those iPod errors, very interesting. And I did as you requested, after this I will run the K scan, so here is what came up this time. I also noticed that Uniblue that I said I saw "jump" into my system in this last Combofix~2009-04-08 19:25 . 2009-04-08 19:25 ——– d—–w c:\documents and settings\Owner\Application Data\Uniblue

ComboFix 09-04-20.02 - Owner 04/19/2009 18:37.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255.58 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090419-0] *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 )))))))))))))))))))))))))))))))
.

2009-04-15 16:03 . 2009-03-06 14:44 283648 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 16:03 . 2009-02-06 16:54 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 16:03 . 2005-07-26 04:39 60416 ——w c:\windows\system32\dllcache\colbact.dll
2009-04-15 16:03 . 2009-02-09 10:20 399360 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 16:03 . 2009-02-06 17:14 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 16:03 . 2009-02-09 10:20 473088 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 16:03 . 2009-02-06 16:39 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 16:03 . 2009-02-09 10:20 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 16:03 . 2009-02-09 10:20 616960 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 16:03 . 2009-02-09 10:20 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 16:02 . 2008-04-21 10:02 215552 ——w c:\windows\system32\dllcache\wordpad.exe
2009-04-14 17:46 . 2009-04-14 17:46 ——– d—–w c:\windows\Sun
2009-04-14 17:44 . 2009-04-14 17:44 73728 —-a-w c:\windows\system32\javacpl.cpl
2009-04-14 17:44 . 2009-04-14 17:44 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-11 17:55 . 2009-04-11 17:56 ——– d—–w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-11 00:58 . 2009-04-11 00:58 ——– d—–w c:\documents and settings\Guest\Local Settings\Application Data\Adobe
2009-04-10 23:20 . 2009-04-10 23:20 21000 —-a-w c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-10 20:51 . 2009-04-10 23:24 ——– d—–w c:\documents and settings\Guest
2009-04-10 05:52 . 2009-04-10 05:52 ——– d—–w c:\documents and settings\Owner\Application Data\Ulead Systems
2009-04-10 01:31 . 2009-04-10 01:31 ——– d—–w c:\documents and settings\All Users\Application Data\InterVideo
2009-04-10 01:31 . 2008-04-02 04:40 209040 —-a-w c:\windows\system32\IVIresizeW7.dll
2009-04-10 01:31 . 2008-04-02 04:40 192656 —-a-w c:\windows\system32\IVIresizePX.dll
2009-04-10 01:31 . 2008-04-02 04:40 196752 —-a-w c:\windows\system32\IVIresizeP6.dll
2009-04-10 01:31 . 2008-04-02 04:40 196752 —-a-w c:\windows\system32\IVIresizeM6.dll
2009-04-10 01:31 . 2008-04-02 04:40 204944 —-a-w c:\windows\system32\IVIresizeA6.dll
2009-04-10 01:31 . 2008-04-02 04:40 24720 —-a-w c:\windows\system32\IVIresize.dll
2009-04-10 01:28 . 2009-04-10 05:51 ——– d—–w c:\documents and settings\All Users\Application Data\Ulead Systems
2009-04-10 01:21 . 2009-04-10 01:21 ——– d—–w c:\documents and settings\Owner\Application Data\InstallShield
2009-04-09 23:37 . 2008-12-11 15:38 159600 —-a-w c:\windows\system32\drivers\pctgntdi.sys
2009-04-09 23:36 . 2009-03-06 23:45 130424 —-a-w c:\windows\system32\drivers\PCTCore.sys
2009-04-09 23:36 . 2008-12-18 19:16 73840 —-a-w c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-09 23:36 . 2009-04-12 07:31 ——– d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-09 23:36 . 2008-12-10 19:36 64392 —-a-w c:\windows\system32\drivers\pctplsg.sys
2009-04-09 23:35 . 2009-04-09 23:35 ——– d—–w c:\documents and settings\Owner\Application Data\PC Tools
2009-04-09 23:35 . 2009-04-09 23:35 ——– d—–w c:\documents and settings\All Users\Application Data\PC Tools
2009-04-09 11:23 . 2009-04-10 06:55 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory
2009-04-09 11:21 . 2009-04-09 11:22 ——– d—–w c:\windows\system32\URTTemp
2009-04-09 10:38 . 2009-04-09 10:38 ——– d—–w c:\documents and settings\Owner\Application Data\AdobeUM
2009-04-09 10:37 . 2009-04-09 10:37 ——– d-sh–w c:\windows\ftpcache
2009-04-08 19:25 . 2009-04-08 19:25 ——– d—–w c:\documents and settings\Owner\Application Data\Uniblue
2009-04-08 15:16 . 2009-04-14 18:32 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Adobe
2009-04-08 08:16 . 2009-04-08 08:16 ——– d—–w c:\documents and settings\Owner\Application Data\Media Player Classic
2009-04-08 07:38 . 2009-04-08 07:38 ——– d—–w c:\documents and settings\Owner\Application Data\Research In Motion
2009-04-08 07:38 . 2006-06-30 23:10 26752 —-a-r c:\windows\system32\drivers\RimSerial.sys
2009-04-08 07:37 . 2009-04-12 09:32 ——– d—–w c:\documents and settings\Owner\Application Data\Blackberry Desktop
2009-04-06 04:57 . 2009-04-06 04:57 ——– d—–w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-04-06 04:57 . 2009-04-06 22:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-06 04:57 . 2009-04-06 22:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 04:57 . 2009-04-06 04:57 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-06 04:33 . 2009-04-06 04:33 ——– d-sh–w c:\documents and settings\NetworkService\IETldCache
2009-04-05 23:48 . 2009-04-05 23:48 ——– d-sh–w c:\documents and settings\Owner\IECompatCache
2009-04-05 23:44 . 2009-04-05 23:44 ——– d-sh–w c:\documents and settings\Owner\PrivacIE
2009-04-05 23:01 . 2009-04-05 23:04 ——– dc-h–w c:\windows\ie8
2009-04-05 22:58 . 2009-04-05 23:04 ——– d—–w C:\7c2ea96219150eee07caf230d4
2009-04-05 22:46 . 2009-04-05 22:46 ——– d-sh–w c:\documents and settings\Owner\IETldCache
2009-04-05 22:06 . 2009-04-05 22:55 ——– d—–w c:\windows\ie8updates
2009-04-05 22:00 . 2009-02-28 04:55 105984 ——w c:\windows\system32\dllcache\iecompat.dll
2009-04-05 10:54 . 2009-04-05 10:54 ——– d—–w C:\f232687e6b3c85c76f6892
2009-04-04 20:53 . 2009-04-09 10:37 ——– d—–w c:\documents and settings\All Users\Application Data\Lavasoft
2009-04-04 15:34 . 2009-04-09 17:26 ——– d—–w c:\windows\system32\CatRoot_bak
2009-04-04 14:44 . 2006-06-26 19:20 564224 —-a-w c:\windows\system32\drivers\BCMWL5.SYS
2009-04-04 13:45 . 2009-04-04 13:45 ——– d—–w C:\dell
2009-04-03 20:22 . 2009-04-03 20:22 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\WMTools Downloaded Files
2009-04-03 01:35 . 2006-10-04 14:06 217118 —-a-w c:\windows\system32\dllcache\apphelp.sdb
2009-04-03 01:34 . 2008-12-20 22:43 1287680 —-a-w c:\windows\system32\dllcache\quartz.dll
2009-04-02 20:58 . 2009-04-02 20:58 ——– d—–w c:\documents and settings\Owner\Application Data\DivX
2009-04-02 13:36 . 2001-08-17 20:48 12160 —-a-w c:\windows\system32\drivers\mouhid.sys
2009-04-02 13:36 . 2001-08-17 20:48 12160 —-a-w c:\windows\system32\dllcache\mouhid.sys
2009-04-02 13:36 . 2008-04-13 18:45 10368 —-a-w c:\windows\system32\drivers\hidusb.sys
2009-04-02 13:36 . 2008-04-13 18:45 10368 —-a-w c:\windows\system32\dllcache\hidusb.sys
2009-04-01 22:23 . 2009-04-01 22:23 5208 —-a-w c:\windows\system32\pid.PNF
2009-04-01 22:03 . 2009-04-01 22:03 ——– d—–w c:\windows\system32\xircom
2009-04-01 21:51 . 2009-04-04 12:51 ——– d—–w c:\windows\system32\scripting
2009-04-01 21:51 . 2009-04-04 12:51 ——– d—–w c:\windows\system32\en
2009-04-01 21:51 . 2009-04-04 12:51 ——– d—–w c:\windows\l2schemas
2009-04-01 21:51 . 2009-04-04 12:51 ——– d—–w c:\windows\system32\bits
2009-04-01 21:41 . 2009-04-03 01:33 ——– d—–w c:\windows\EHome
2009-04-01 16:28 . 2009-04-01 16:28 ——– d—–w C:\SWSetup
2009-04-01 15:49 . 2009-03-08 11:32 594432 —-a-w c:\windows\system32\dllcache\msfeeds.dll
2009-04-01 15:49 . 2009-03-08 11:31 55296 —-a-w c:\windows\system32\dllcache\msfeedsbs.dll
2009-04-01 15:49 . 2009-03-08 11:32 1985024 —-a-w c:\windows\system32\dllcache\iertutil.dll
2009-04-01 15:49 . 2009-03-08 11:31 59904 —-a-w c:\windows\system32\dllcache\icardie.dll
2009-04-01 15:49 . 2008-12-19 09:10 13824 ——w c:\windows\system32\dllcache\ieudinit.exe
2009-04-01 15:49 . 2009-03-08 11:11 445952 —-a-w c:\windows\system32\dllcache\ieapfltr.dll
2009-04-01 15:49 . 2009-03-08 21:22 1241088 —-a-w c:\windows\system32\dllcache\ieframe.dll.mui
2009-04-01 15:49 . 2009-02-07 04:07 3698584 —-a-w c:\windows\system32\dllcache\ieapfltr.dat
2009-04-01 15:49 . 2009-03-08 11:39 11063808 —-a-w c:\windows\system32\dllcache\ieframe.dll
2009-04-01 08:49 . 2009-04-01 08:49 ——– d—–w c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-04-01 04:56 . 2009-04-01 04:56 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Identities
2009-03-31 14:01 . 2007-07-09 13:09 584192 ——w c:\windows\system32\dllcache\rpcrt4.dll
2009-03-31 13:33 . 2009-03-31 13:33 ——– d—–w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-03-31 13:33 . 2009-04-06 11:46 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Google
2009-03-31 13:22 . 2009-03-31 13:22 ——– d—–w c:\documents and settings\All Users\Application Data\NOS
2009-03-31 13:22 . 2009-03-31 13:22 ——– d—–w c:\windows\system32\Adobe
2009-03-31 13:18 . 2008-10-16 21:06 27496 —-a-w c:\windows\system32\mucltui.dll.mui
2009-03-31 13:18 . 2008-10-16 21:06 268648 —-a-w c:\windows\system32\mucltui.dll
2009-03-31 13:07 . 2009-03-31 13:07 ——– d—–w c:\documents and settings\Owner\Application Data\Apple Computer
2009-03-31 13:07 . 2009-03-19 23:32 23400 —-a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-31 13:07 . 2008-04-17 19:12 107368 —-a-w c:\windows\system32\GEARAspi.dll
2009-03-31 13:06 . 2009-03-31 13:07 ——– d—–w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-31 13:05 . 2009-03-31 13:06 ——– d—–w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-31 13:05 . 2009-03-31 13:05 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Apple
2009-03-31 13:05 . 2009-04-11 17:57 ——– dc—-w c:\windows\system32\DRVSTORE
2009-03-31 13:05 . 2009-03-06 06:59 36864 —-a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-31 13:05 . 2009-03-06 06:59 1900544 —-a-w c:\windows\system32\usbaaplrc.dll
2009-03-31 13:04 . 2009-03-31 13:04 ——– d—–w c:\documents and settings\All Users\Application Data\Apple
2009-03-31 13:02 . 2009-03-31 13:07 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Apple Computer
2009-03-31 12:24 . 2009-04-02 23:48 81984 —-a-w c:\windows\system32\bdod.bin
2009-03-31 10:37 . 2009-03-31 10:38 1024 —-a-w c:\windows\system32\AutoPartNt.let
2009-03-31 10:37 . 2009-03-31 10:37 2069272 —-a-w c:\windows\system32\AutoPartNt.exe
2009-03-31 10:35 . 2009-03-31 10:35 ——– d—–w c:\documents and settings\Owner\Application Data\Acronis
2009-03-31 10:31 . 2009-03-31 10:31 ——– d—–w c:\documents and settings\All Users\Application Data\Acronis
2009-03-31 10:30 . 2009-03-31 12:03 971552 —-a-w c:\windows\system32\drivers\tdrpm174.sys
2009-03-31 10:30 . 2009-03-31 12:03 540000 —-a-w c:\windows\system32\drivers\timntr.sys
2009-03-31 10:30 . 2009-03-31 12:03 44704 —-a-w c:\windows\system32\drivers\tifsfilt.sys
2009-03-31 10:00 . 2009-03-31 10:00 0 —-a-w c:\windows\nsreg.dat
2009-03-31 10:00 . 2009-03-31 10:00 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\Mozilla
2009-03-31 09:36 . 2009-03-31 09:37 ——– d—–w c:\windows\system32\drivers\UMDF
2009-03-31 09:36 . 2009-03-31 09:36 ——– d—–w c:\windows\system32\LogFiles
2009-03-31 08:52 . 2009-03-08 11:41 5937152 —-a-w c:\windows\system32\dllcache\mshtml.dll
2009-03-31 08:49 . 2008-05-01 14:30 331776 —-a-w c:\windows\system32\dllcache\msadce.dll
2009-03-31 08:48 . 2008-10-03 10:15 247326 —-a-w c:\windows\system32\dllcache\strmdll.dll
2009-03-31 08:48 . 2008-09-04 16:42 1106944 —-a-w c:\windows\system32\dllcache\msxml3.dll
2009-03-31 08:48 . 2009-04-03 11:30 ——– d—–w c:\documents and settings\Owner\Application Data\SoundSpectrum
2009-03-31 08:32 . 2009-01-08 01:21 26144 —-a-w c:\windows\system32\spupdsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 19:09 . 2009-04-14 19:09 ——– d—–w c:\program files\Secunia
2009-04-14 18:31 . 2009-04-14 18:31 ——– d—–w c:\program files\Common Files\Adobe AIR
2009-04-14 18:30 . 2009-04-14 18:29 ——– d—–w c:\program files\Common Files\Adobe
2009-04-14 17:44 . 2009-04-14 17:44 ——– d—–w c:\program files\Java
2009-04-14 16:31 . 2009-04-14 14:58 ——– d—–w c:\program files\Free Window Registry Repair
2009-04-11 17:56 . 2009-04-11 17:55 ——– d—–w c:\program files\iTunes
2009-04-11 17:55 . 2009-04-11 17:55 ——– d—–w c:\program files\iPod
2009-04-11 17:55 . 2009-03-31 13:04 ——– d—–w c:\program files\Common Files\Apple
2009-04-11 17:01 . 2009-04-06 04:57 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-10 20:53 . 2009-04-10 20:53 ——– d—–w c:\documents and settings\Guest\Application Data\Ulead Systems
2009-04-10 05:52 . 2003-05-16 08:59 21000 —-a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-10 01:31 . 2009-04-04 14:44 ——– d–h–w c:\program files\InstallShield Installation Information
2009-04-10 01:30 . 2009-04-10 01:30 ——– d—–w c:\program files\Windows Media Components
2009-04-10 01:30 . 2009-04-10 01:28 ——– d—–w c:\program files\Common Files\Ulead Systems
2009-04-10 01:28 . 2009-04-10 01:22 ——– d—–w c:\program files\Corel
2009-04-10 00:25 . 2009-04-09 23:36 ——– d—–w c:\program files\Common Files\PC Tools
2009-04-09 20:40 . 2009-03-31 13:33 ——– d—–w c:\program files\Google
2009-04-09 10:38 . 2009-04-07 09:04 ——– d—–w c:\program files\PhotoScape
2009-04-09 10:37 . 2009-04-09 10:37 ——– d—–w c:\program files\Common Files\Research In Motion
2009-04-09 10:13 . 2009-04-05 09:17 4476 —-a-w C:\aaw7boot.log
2009-04-08 07:37 . 2009-04-08 07:37 ——– d—–w c:\program files\Research In Motion
2009-04-08 07:32 . 2003-05-16 07:56 ——– d—–w c:\program files\Common Files\InstallShield
2009-04-04 14:48 . 2009-04-01 16:28 90 —-a-w C:\bcmwl5.log
2009-04-04 14:48 . 2009-04-04 14:44 ——– d—–w c:\program files\Broadcom
2009-04-04 12:51 . 2004-08-04 11:00 250032 –sha-r C:\ntldr
2009-04-04 12:49 . 2003-05-16 07:40 76487 —-a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-03 01:36 . 2009-04-03 01:36 ——– d—–w c:\documents and settings\Owner\Application Data\GRETECH
2009-04-02 23:49 . 2009-03-31 12:18 ——– d—–w c:\program files\Common Files\Softwin
2009-04-02 23:19 . 2009-04-02 23:19 ——– d—–w c:\program files\Alwil Software
2009-04-02 19:42 . 2009-04-02 19:42 ——– d—–w c:\program files\GRETECH
2009-04-02 17:48 . 2009-04-02 17:48 ——– d—–w c:\program files\CCleaner
2009-04-01 22:03 . 2009-04-01 22:03 ——– d—–w c:\program files\microsoft frontpage
2009-03-31 13:33 . 2009-03-31 13:33 ——– d—–w c:\program files\DivX
2009-03-31 13:33 . 2009-03-31 13:33 ——– d—–w c:\program files\Common Files\DivX Shared
2009-03-31 13:31 . 2009-03-31 13:31 ——– d—–w c:\program files\Combined Community Codec Pack
2009-03-31 13:22 . 2009-03-31 13:22 ——– d—–w c:\program files\NOS
2009-03-31 13:06 . 2009-03-31 13:06 ——– d—–w c:\program files\Bonjour
2009-03-31 13:06 . 2009-03-31 13:05 ——– d—–w c:\program files\QuickTime
2009-03-31 13:05 . 2009-03-31 13:05 ——– d—–w c:\program files\Apple Software Update
2009-03-31 12:14 . 2009-03-31 12:14 ——– d—–w c:\program files\Windows Installer Clean Up
2009-03-31 12:14 . 2009-03-31 12:14 ——– d—–w c:\program files\MSECACHE
2009-03-31 12:07 . 2009-03-31 10:29 ——– d—–w c:\program files\Common Files\Acronis
2009-03-31 09:38 . 2009-03-31 09:38 ——– d—–w c:\program files\Windows Media Connect 2
2009-03-31 08:43 . 2009-03-31 08:43 ——– d—–w c:\program files\SoundSpectrum
2009-03-21 14:18 . 2007-04-16 15:52 986112 ——w c:\windows\system32\dllcache\kernel32.dll
2009-03-08 21:09 . 2007-08-14 01:43 638816 —-a-w c:\windows\system32\dllcache\iexplore.exe
2009-03-08 21:09 . 2007-08-14 01:39 391536 —-a-w c:\windows\system32\dllcache\iedkcs32.dll
2009-03-08 11:34 . 2009-03-31 08:55 914944 —-a-w c:\windows\system32\dllcache\wininet.dll
2009-03-08 11:34 . 2004-08-04 11:00 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-03-31 08:55 1206784 —-a-w c:\windows\system32\dllcache\urlmon.dll
2009-03-08 11:34 . 2007-08-14 01:54 236544 —-a-w c:\windows\system32\dllcache\webcheck.dll
2009-03-08 11:34 . 2007-08-14 01:44 43008 —-a-w c:\windows\system32\dllcache\licmgr10.dll
2009-03-08 11:34 . 2004-08-04 11:00 43008 —-a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:34 . 2007-08-14 01:44 105984 —-a-w c:\windows\system32\dllcache\url.dll
2009-03-08 11:34 . 2009-03-31 08:55 193536 —-a-w c:\windows\system32\dllcache\msrating.dll
2009-03-08 11:34 . 2007-08-14 01:44 109568 —-a-w c:\windows\system32\dllcache\occache.dll
2009-03-08 11:33 . 2007-08-14 01:54 759296 —-a-w c:\windows\system32\dllcache\VGX.dll
2009-03-08 11:33 . 2009-04-03 01:35 18944 —-a-w c:\windows\system32\dllcache\corpol.dll
2009-03-08 11:33 . 2004-08-04 11:00 18944 —-a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-03-31 08:55 25600 —-a-w c:\windows\system32\dllcache\jsproxy.dll
2009-03-08 11:33 . 2008-05-09 10:53 726528 —-a-w c:\windows\system32\dllcache\jscript.dll
2009-03-08 11:33 . 2007-08-14 01:39 229376 —-a-w c:\windows\system32\dllcache\ieaksie.dll
2009-03-08 11:33 . 2008-05-09 10:53 420352 —-a-w c:\windows\system32\dllcache\vbscript.dll
2009-03-08 11:33 . 2004-08-04 11:00 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 11:33 . 2007-08-14 01:39 125952 —-a-w c:\windows\system32\dllcache\ieakeng.dll
2009-03-08 11:32 . 2007-08-14 01:39 72704 —-a-w c:\windows\system32\dllcache\admparse.dll
2009-03-08 11:32 . 2004-08-04 11:00 72704 —-a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2007-08-14 01:39 173056 —-a-w c:\windows\system32\dllcache\ie4uinit.exe
2009-03-08 11:32 . 2007-08-14 00:56 163840 —-a-w c:\windows\system32\dllcache\ieakui.dll
2009-03-08 11:32 . 2007-08-14 01:39 71680 —-a-w c:\windows\system32\dllcache\iesetup.dll
2009-03-08 11:32 . 2007-08-14 01:39 55808 —-a-w c:\windows\system32\dllcache\iernonce.dll
2009-03-08 11:32 . 2004-08-04 11:00 71680 —-a-w c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2007-08-14 01:39 128512 —-a-w c:\windows\system32\dllcache\advpack.dll
2009-03-08 11:32 . 2009-03-31 08:55 94720 —-a-w c:\windows\system32\dllcache\inseng.dll
2009-03-08 11:32 . 2009-03-31 08:55 611840 —-a-w c:\windows\system32\dllcache\mstime.dll
2009-03-08 11:31 . 2009-03-31 08:55 183808 —-a-w c:\windows\system32\dllcache\iepeers.dll
2009-03-08 11:31 . 2009-03-31 08:55 348160 —-a-w c:\windows\system32\dllcache\dxtmsft.dll
2009-03-08 11:31 . 2009-03-31 08:55 216064 —-a-w c:\windows\system32\dllcache\dxtrans.dll
2009-03-08 11:31 . 2007-08-14 01:36 34816 —-a-w c:\windows\system32\dllcache\imgutil.dll
2009-03-08 11:31 . 2004-08-04 11:00 34816 —-a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-03-31 08:55 46592 —-a-w c:\windows\system32\dllcache\pngfilt.dll
2009-03-08 11:31 . 2009-03-31 08:55 66560 —-a-w c:\windows\system32\dllcache\mshtmled.dll
2009-03-08 11:31 . 2007-08-14 01:01 48128 —-a-w c:\windows\system32\dllcache\mshtmler.dll
2009-03-08 11:31 . 2004-08-04 11:00 48128 —-a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2007-08-14 01:32 45568 —-a-w c:\windows\system32\dllcache\mshta.exe
2009-03-08 11:31 . 2004-08-04 11:00 45568 —-a-w c:\windows\system32\mshta.exe
2009-03-08 11:24 . 2007-08-14 01:18 68608 —-a-w c:\windows\system32\dllcache\hmmapi.dll
2009-03-08 11:22 . 2007-08-14 01:54 156160 —-a-w c:\windows\system32\dllcache\msls31.dll
2009-03-08 11:22 . 2004-08-04 11:00 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-07 07:16 . 2009-03-07 07:16 140288 —-a-w c:\windows\system32\sfc_os.dll
2009-03-07 07:16 . 2009-04-03 01:34 984576 —-a-w c:\windows\system32\syssetup.dll
2009-03-06 14:44 . 2004-08-04 11:00 283648 —-a-w c:\windows\system32\pdh.dll
2009-02-24 19:34 . 2009-02-24 19:34 90112 —-a-w c:\windows\system32\dpl100.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx0c.dll
2009-02-24 19:34 . 2009-02-24 19:34 823296 —-a-w c:\windows\system32\divx_xx07.dll
2009-02-24 19:34 . 2009-02-24 19:34 815104 —-a-w c:\windows\system32\divx_xx0a.dll
2009-02-24 19:34 . 2009-02-24 19:34 802816 —-a-w c:\windows\system32\divx_xx11.dll
2009-02-24 19:34 . 2009-02-24 19:34 684032 —-a-w c:\windows\system32\DivX.dll
2009-02-09 10:20 . 2009-04-03 01:34 723456 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:20 . 2007-11-07 09:26 723456 ——w c:\windows\system32\dllcache\lsasrv.dll
.

——- Sigcheck ——-

[-] 2003-05-16 07:46 502272 6225F14B8CE08CCBA8B25AD27843C674 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"UVS12 Preload"="c:\program files\Corel\Corel VideoStudio 12\uvPL.exe" [2008-06-09 397456]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-04-03 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-14 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-3-24 748840]

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Desktop Manager.lnk]
backup=c:\windows\pss\Desktop Manager.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"getPlus® Helper"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\SoundSpectrum\\G-Force\\G-Force Standalone.exe"=
"c:\\Program Files\\SoundSpectrum\\G-Force\\G-Force V-Bar.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 0 (0x0)
"AllowInboundRouterRequest"= 0 (0x0)
"AllowRedirect"= 0 (0x0)

R3 sdAuxService;PC Tools Auxiliary Service; [x]
R4 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-03 33176]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424]
S0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\DRIVERS\tffsport.sys [2004-08-04 149376]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2009-03-24 7808]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-04-20 c:\windows\Tasks\User_Feed_Synchronization-{25DAB1DE-4C55-47EE-A530-CE17152012C3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://seattle.craigslist.org/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\gu8pkrmk.default\
FF - prefs.js: browser.startup.homepage - hxxp://seattle.craigslist.org/
FF - prefs.js: network.proxy.type - 2
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 18:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1409082233-688789844-1343024091-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2044)
c:\program files\iTunes\iTunesMiniPlayer.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-04-20 18:44
ComboFix-quarantined-files.txt 2009-04-20 01:43
ComboFix2.txt 2009-04-19 23:45

Pre-Run: 29,027,418,112 bytes free
Post-Run: 29,015,105,536 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
333 — E O F — 2009-04-15 16:48

:yeah:
Thanks once again, off to Kaspersky online I go!
Post #12
Hey Tomk,

So I did the Kaspersky online scan again, 2 1/2 hrs later it says that there is NO malware detected. So is that it? Is my computer healed?
Please let me know what's up,
Sagealicious. :popcorn:
Post #13
sagealicious,

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.
Please delete DDS.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #14
TomK,

Thank you kindly for all your help, I WILL take the time to read the suggested material prescribed to me, it has been a few years since I have been back on the web….and so ALL the new viruses, malware, and such kinda blows my mind. I remember a time when the web was a free information highway and now everyone wants your personal data and such, this service you offer here at WhattheTech has been of GREAT value.
Now before I go, what is DDS? Combofix uninstalled itself…so I am just a wee bit confused on what DDS is, other than that my system appears to be running great, and I cannot thank you enough.

May the Universe shine bright upon your path,

Sagealicious :wavey:
Post #15
sagealicious, DDS is a program that you downloaded in post #6. If it isn't on your desktop, then it was removed with ComboFix's uninstall routine. You are very welcome. Good Luck and Be Well. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI