[Closed] system very slow pos2a0.tmp files (page 2)

ComboFix 09-05-07.01 - BGCA-Admin 05/07/2009 13:08.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.255.77 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\BGCA-Admin\Desktop\CFScript.txt

FILE ::
c:\windows\system32\agremove.exe
c:\windows\system32\dkpccnbj.dllbox.vir
c:\windows\system32\luedghpo.tmp
c:\windows\system32\rpcnetp.dll
c:\windows\system32\rpcnetp.exe
c:\windows\system32\xolnwjyl.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\agremove.exe
c:\windows\system32\rpcnetp.dll
c:\windows\system32\rpcnetp.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_RPCNETP
——-\Service_rpcnetp

((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-04-30 03:19 . 2009-05-05 02:54 ——– d—–w c:\documents and settings\All Users\Application Data\avg8
2009-04-30 02:47 . 2009-04-06 19:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-30 02:47 . 2009-04-06 19:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-30 02:47 . 2009-04-30 02:47 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-22 18:00 . 2009-04-22 18:00 ——– d—–w c:\program files\AVG
2009-04-21 17:48 . 2009-04-21 17:48 ——– d—–w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-04-21 17:47 . 2009-04-21 20:25 ——– d—–w c:\program files\SUPERAntiSpyware
2009-04-21 17:47 . 2009-04-21 20:26 ——– d—–w c:\documents and settings\BGCA-Admin\Application Data\SUPERAntiSpyware.com
2009-04-17 18:43 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-17 18:43 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 18:43 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-17 18:43 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 18:43 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 18:43 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-17 18:43 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-17 18:43 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 18:43 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-17 18:31 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-17 18:31 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe
2009-04-15 20:26 . 2009-04-15 20:26 ——– d—–w c:\documents and settings\NetworkService\Local Settings\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-20 18:25 . 2007-08-20 13:47 ——– d—–w c:\program files\Broderbund
2009-04-01 23:51 . 2009-04-01 23:50 ——– d—–w c:\program files\iTunes
2009-04-01 23:50 . 2009-04-01 23:50 ——– d—–w c:\program files\iPod
2009-04-01 23:50 . 2009-04-01 23:43 ——– d—–w c:\program files\Common Files\Apple
2009-04-01 23:49 . 2009-04-01 23:49 ——– d—–w c:\program files\Bonjour
2009-04-01 23:48 . 2009-04-01 23:47 ——– d—–w c:\program files\QuickTime
2009-04-01 23:45 . 2009-04-01 23:45 ——– d—–w c:\program files\Apple Software Update
2009-03-25 22:55 . 2008-10-10 14:57 33280 —-a-w c:\windows\system32\identprv.dll
2009-03-06 14:22 . 2004-08-04 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-06 03:59 . 2009-04-01 23:44 36864 —-a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-06 03:59 . 2009-04-01 23:44 1900544 —-a-w c:\windows\system32\usbaaplrc.dll
2009-03-03 00:18 . 2004-08-04 12:00 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 12:00 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-08-04 12:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-04 12:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-04 12:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-04 12:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-04 12:00 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2004-08-03 22:59 2066048 —-a-w c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-04-28_01.56.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-07 17:17 . 2009-05-07 17:16 32768 c:\windows\temp\Temporary Internet Files\Content.IE5\index.dat
- 2009-04-28 01:56 . 2009-04-28 01:56 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2009-04-28 01:56 . 2009-04-28 01:56 16384 c:\windows\Temp\History\History.IE5\index.dat
+ 2009-05-07 17:17 . 2009-05-07 17:16 16384 c:\windows\temp\History\History.IE5\index.dat
+ 2009-05-07 17:17 . 2009-05-07 17:16 16384 c:\windows\temp\Cookies\index.dat
- 2009-04-28 01:56 . 2009-04-28 01:56 16384 c:\windows\Temp\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-09 68856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
"NVIEW"="nview.dll" - c:\windows\system32\nview.dll [2004-04-15 856135]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-04-15 4866048]
"NVRotateSysTray"="c:\windows\system32\nvsysrot.dll" [2004-04-15 49152]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-04-01 1368064]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-09-26 184320]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-09-09 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2004-04-15 323584]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\agrsmmsg.exe [2004-02-20 88363]
"TFNF5"="TFNF5.exe" - c:\windows\system32\TFNF5.exe [2003-11-18 73728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\BGCA-Admin\Start Menu\Programs\Startup\
Glove - Auto Update.lnk - c:\program files\Glove\Glove.exe [2008-8-4 179606]
MEMonitor.lnk - c:\program files\Sprint music manager\MEMonitor.exe [2008-1-8 951640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Monitor.lnk - c:\program files\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2005-2-4 53248]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-2-4 98304]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\WhlClnt1.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

— Other Services/Drivers In Memory —

*NewlyCreated* - RPCNETP
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - upnphost
*Deregistered* - Viewpoint Manager Service
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - WinDefend
*Deregistered* - winmgmt
*Deregistered* - WMPNetworkSvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WudfSvc
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2009-04-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-05-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-01 20:57]

2009-05-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: bgcayouthnet.org\egap
Trusted Zone: bgcayouthnet.org\www
DPF: {7D9FC518-B490-4364-9F28-83DE01611527} - hxxp://www.bgcayouthnet.org/BGCAMacSniffer.CAB
DPF: {807D68C6-AF19-4005-85D3-1726F794B851} - hxxps://egap.bgcayouthnet.org/WhaleCom601AF82D7B319DCA317178328D61/WhaleCom0/SecurecookieauthPortalHomePage/WhlClntProxy.cab
FF - ProfilePath - c:\documents and settings\BGCA-Admin\Application Data\Mozilla\Firefox\Profiles\7u56vpf9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-07 13:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2848)
c:\windows\system32\nView.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Windows Defender\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\qoobox\Quarantine\c\WINDOWS\system32\rpcnetp.exe.vir
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Glove\X_Glove.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\Java\jre1.6.0_07\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-05-07 13:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 17:27
ComboFix2.txt 2009-05-05 03:20
ComboFix3.txt 2009-04-30 02:34
ComboFix4.txt 2009-04-28 02:06

Pre-Run: 591,282,176 bytes free
Post-Run: 575,877,120 bytes free

228 — E O F — 2009-05-07 16:39
combofix log thanks Tim

Hello.

Thanks system seems faster but still low space on C drive is there still .tmp files from virus? Thanks so much again

You'll have to do some maintenance yourself on the C:\ drive then. I don't get what you mean with the .tmp files?

Next…

Update Java to Version 6 Update 13

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Look for "Java Runtime Environment (JRE)" JRE 6 Update 13.
Click the Download button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u13-windows-i586-p.exe to install the newest version.

*If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
** If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
*** The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.
Run Scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Open the Kaspersky WebScanner
page.
Click on the 🖼Click to load external image (Posted Image) button on the main page.
The program will launch and fill in the Information section on the left.
Read the "Requirements and Limitations" then press the 🖼Click to load external image (Posted Image) button.
The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.
Once the files have been downloaded, click on the 🖼Click to load external image (Posted Image) …button.
In the scan settings make sure the following are selected:
- Detect malicious programs of the following categories:
  Viruses, Worms, Trojan Horses, Rootkits
  Spyware, Adware, Dialers and other potentially dangerous programs
- Scan compound files (doesn't apply to the File scan area):
  Archives
  Mail databases
  By default the above items should already be checked.
- Click the 🖼Click to load external image (Posted Image) button, if you made any changes.
Now under the Scan section on the left:

Select My Computer
The program will now start and scan your system. This will run for a while, be patient and let it finish.
Once the scan is complete, click on View scan report
Now, click on the Save Report as button.
Save the file to your desktop.
Copy and paste that information in your next post.

You can refer to this animation by sundavis.

With Regards,
Extremeboy

[Closed] system very slow pos2a0.tmp files

✨ Ask AI

Ask AI