Spyware / Malware / Virus Removal

[Resolved] Extremely slow and cumbersome. Probably simple fix.

11 min read

Looking for the outcome? Ask AI

shilohkid Topic Starter

Post #1May 2, 2009, 10:59 PM UTC

Computer moves extremely slowly. Programs such as excell, word, outlook and firefox have to be pressed numerous times to open. Often takes forever to close them.
Everything seems to get stuck intermittently. Screens won't close, can't work in other screens, takes forever.

Thank you so much for your help in advance.

Couldn't get the below files to upload so I pasted them.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:34 PM, on 5/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://office.microsoft.com/en-us/downloads/maincatalog.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [DrvListnr] C:\Program Files\Analog Devices\SoundMAX\DrvListnr.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\Scansoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175409746687
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: UPnPService - Unknown owner - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

–
End of file - 7181 bytes

Malwarebytes' Anti-Malware 1.36
Database version: 2002
Windows 5.1.2600 Service Pack 3

4/23/2009 6:26:02 PM
mbam-log-2009-04-23 (18-25-07).txt

Scan type: Full Scan (C:\|)
Objects scanned: 274566
Time elapsed: 5 hour(s), 24 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\a (Trojan.Agent) -> No action taken.

Tomk

Post #2May 9, 2009, 4:26 AM UTC

Hi shilohkid,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click Malwarebytes' Anti-Malware to start the program.
Click on the update tab.
Click on the Check of Updates button
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

shilohkid

Post #3May 10, 2009, 1:55 AM UTC

Dear Tomk I guess must have noticed that I already did this….so I'll do it again.

Tomk

Post #4May 10, 2009, 2:38 AM UTC

shilohkid,

I probably should have made it a little clearer.

Your Mbam log says:

C:\a (Trojan.Agent) -> No action taken.

My instructions say:

click Remove Selected.

Does that make more sense now?

shilohkid

Post #5May 10, 2009, 7:54 AM UTC

Yes Tomk….thank you…I really do appreciate your help.

Computer behaves at the moment:
Programs struggle to open, and I need to press them multiple times. If they do open they firefox will open multiple times and then shut down when I close or X one window. Outlook is hard pressed to open with out multiple clicks and has and archive error that it wants to repair which I usually cancel because it wants to every time I open it whether I allow it to repair or not.

See below Logs:

Malwarebytes' Anti-Malware 1.36
Database version: 2102
Windows 5.1.2600 Service Pack 3

5/9/2009 9:26:17 PM
mbam-log-2009-05-09 (21-26-17).txt

Scan type: Quick Scan
Objects scanned: 117925
Time elapsed: 22 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\a (Trojan.Agent) -> Delete on reboot.

After reboot
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:35 PM, on 5/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\System32\dllhost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://office.microsoft.com/en-us/downloads/maincatalog.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [DrvListnr] C:\Program Files\Analog Devices\SoundMAX\DrvListnr.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\Scansoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175409746687
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: UPnPService - Unknown owner - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

–
End of file - 7060 bytes

Tomk

Post #6May 10, 2009, 2:26 PM UTC

shilohkid,

Part of your slowness is because windows is trying to update. Outlook problem may or may not be related.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

shilohkid

Post #7May 11, 2009, 4:17 PM UTC

Here you go Tomk. Thanks ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, May 11, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Sunday, May 10, 2009 22:57:18 Records in database: 2156690 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Files scanned: 115740 Threat name: 2 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 15:42:25 File name / Threat name / Threats count C:\Documents and Settings\Cherie\My Documents\cherie-reee\music\miles apart-yellow card.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1 C:\Documents and Settings\Cherie\My Documents\LimeWire\Saved\ride for me casha.mp3 Infected: Trojan-Downloader.WMA.GetCodec.u 1 C:\RECYCLER\S-1-5-21-1292428093-1078145449-839522115-1004\Dc227.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1 The selected area was scanned.

Tomk

Post #8May 11, 2009, 4:55 PM UTC

shilohkid,

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

shilohkid

Post #9May 12, 2009, 6:26 AM UTC

Thank you Tomk

ComboFix 09-05-11.01 - Neil 05/11/2009 19:57.1 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-04-12 to 2009-05-12 )))))))))))))))))))))))))))))))
.

2009-05-08 03:13 . 2009-05-08 03:13 ——– d—–w c:\documents and settings\Paula\Application Data\AVGTOOLBAR
2009-05-04 01:25 . 1993-04-28 10:00 72192 —-a-w c:\windows\system\GSWDLL.DLL
2009-05-04 01:25 . 1995-02-02 08:23 95232 —-a-w c:\windows\system\VBDB300.DLL
2009-05-04 01:25 . 1995-06-21 10:00 296832 —-a-w c:\windows\system\XBS200.DLL
2009-05-04 01:25 . 1995-11-16 02:13 50320 —-a-w c:\windows\system\DUNZIP.DLL
2009-05-04 01:25 . 1995-11-16 02:11 67296 —-a-w c:\windows\system\DZIP.DLL
2009-05-04 01:25 . 1992-05-14 21:41 192112 —-a-w c:\windows\system\QPRO.DLL
2009-05-04 01:25 . 1993-04-28 10:00 7008 —-a-w c:\windows\system\SETUPKIT.DLL
2009-05-04 01:25 . 1995-08-04 11:36 398416 —-a-w c:\windows\system\VBRUN300.DLL
2009-05-02 21:51 . 2001-12-20 03:39 18684 —-a-w c:\windows\system32\pdfmon158.dll
2009-05-02 21:50 . 2001-07-12 11:23 15008 —-a-r c:\windows\system32\rtfmon107.dll
2009-05-02 21:48 . 2001-11-15 01:07 53248 —-a-w c:\windows\system32\omacva.dll
2009-05-02 21:48 . 2001-12-21 22:10 90112 —-a-w c:\windows\system32\MB7tax.dll
2009-05-02 21:48 . 2001-05-03 02:46 155648 —-a-w c:\windows\system32\SSCE5232.dll
2009-05-02 21:48 . 1999-11-10 09:50 438272 —-a-w c:\windows\system32\C4dll.dll
2009-05-02 21:48 . 2001-05-03 02:45 31232 —-a-w c:\windows\system32\Bcfont32.dll
2009-05-02 21:48 . 2009-05-02 21:49 ——– d—–w C:\MB7
2009-05-02 03:44 . 2002-04-19 11:11 651264 ——w c:\windows\system32\brfxdial.dll
2009-05-02 03:44 . 2009-05-02 21:39 ——– d—–w c:\program files\Brother
2009-04-22 22:44 . 2009-04-22 22:42 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-22 02:56 . 2009-04-22 04:25 ——– d—–w c:\documents and settings\Neil.NEILPC\Application Data\Autodesk
2009-04-22 02:56 . 2009-05-04 01:25 ——– d—–w c:\documents and settings\Neil.NEILPC\Local Settings\Application Data\Autodesk
2009-04-22 02:16 . 2009-04-22 02:16 ——– d—–w c:\program files\Autodesk Network License Manager
2009-04-22 02:16 . 2009-05-04 02:19 ——– d—–w c:\documents and settings\All Users\Application Data\Autodesk
2009-04-21 23:10 . 2007-07-20 04:14 3727720 —-a-w c:\windows\system32\d3dx9_35.dll
2009-04-21 22:59 . 2009-04-21 22:59 ——– d—–w c:\program files\MSBuild
2009-04-21 22:58 . 2009-04-22 08:25 363264 —-a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-21 22:49 . 2009-04-21 22:49 ——– d—–w c:\windows\system32\XPSViewer
2009-04-21 22:45 . 2009-04-21 22:45 ——– d—–w c:\program files\Reference Assemblies
2009-04-21 22:41 . 2006-06-29 23:07 14048 ——w c:\windows\system32\spmsg2.dll
2009-04-18 21:52 . 2009-04-18 21:52 ——– d—–w c:\documents and settings\Neil.NEILPC\Application Data\Malwarebytes
2009-04-18 21:51 . 2009-04-07 01:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-18 21:51 . 2009-04-07 01:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-18 21:51 . 2009-04-18 21:51 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-18 21:51 . 2009-04-18 21:52 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-16 17:23 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-04-16 17:23 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 17:23 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-04-16 17:23 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 17:23 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 17:23 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 17:23 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 17:23 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 17:23 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 17:20 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 17:20 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 05:53 . 2009-02-02 07:19 0 —-a-w c:\documents and settings\Renee\Local Settings\Application Data\prvlcl.dat
2009-05-08 20:01 . 2009-01-29 04:42 11952 —-a-w c:\windows\system32\avgrsstx.dll
2009-05-08 20:01 . 2009-01-29 04:41 325896 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-02 21:39 . 2007-03-31 02:22 ——– d–h–w c:\program files\InstallShield Installation Information
2009-05-02 01:42 . 2007-03-31 05:42 ——– d—–w c:\program files\Common Files\Intuit
2009-05-02 01:24 . 2008-10-15 04:57 ——– d—–w c:\program files\Smart PDF Converter
2009-05-02 01:13 . 2007-03-31 02:20 ——– d—–w c:\program files\Scansoft
2009-04-23 18:31 . 2007-04-02 21:37 ——– d—–w c:\program files\Plaxo
2009-04-22 22:42 . 2007-04-08 22:22 ——– d—–w c:\program files\Java
2009-04-22 03:49 . 2007-04-02 01:47 103072 —-a-w c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-04-18 02:12 . 2008-11-03 08:57 71056 —-a-w c:\documents and settings\Paula\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-04 05:53 . 2007-11-03 03:23 71056 —-a-w c:\documents and settings\Cherie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 04:40 . 2007-12-04 17:50 71056 —-a-w c:\documents and settings\heather\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 03:01 . 2007-10-22 02:52 71056 —-a-w c:\documents and settings\Renee\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 02:54 . 2008-01-04 16:29 256 —-a-w c:\windows\system32\pool.bin
2009-03-31 23:33 . 2009-03-31 23:33 ——– d—–w c:\program files\Pitney Bowes
2009-03-31 04:24 . 2009-03-31 04:24 ——– d—–w c:\program files\Common Files\AnswerWorks 5.0
2009-03-31 03:54 . 2008-03-06 01:52 ——– d—–w c:\program files\TurboTax
2009-03-25 21:39 . 2009-03-25 21:39 ——– d—–w c:\program files\Nuance
2009-03-25 21:19 . 2007-03-31 02:20 ——– d—–w c:\program files\Common Files\scansoft shared
2009-03-25 05:45 . 2008-11-04 22:33 ——– d—–w c:\program files\Common Files\Research In Motion
2009-03-06 14:22 . 2003-03-31 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 18:33 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 —-a-w c:\windows\system32\ieencode.dll
2003-09-18 19:32 . 2007-03-31 08:00 13824 -c–a-w c:\program files\gfc.xls
2002-09-11 14:26 . 2007-06-22 16:07 63730 —-a-w c:\program files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2009-01-10 02:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2009-01-10 02:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2009-01-10 02:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"Smapp"="c:\program files\Analog Devices\SoundMAX\Smtray.exe" [2002-01-31 81920]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-03-12 106496]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-29 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-28 185896]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-08 1947928]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2009-01-10 669840]
"PPort11reminder"="c:\program files\Scansoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2007-9-12 1527808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-08 20:01 11952 —-a-w c:\windows\system32\avgrsstx.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"MIDI1"= SYNCOR11.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Metro Hi Speed Fax Printer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Metro Hi Speed Fax Printer.lnk
backup=c:\windows\pss\Metro Hi Speed Fax Printer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SmartUI.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SmartUI.lnk
backup=c:\windows\pss\SmartUI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Sonic CinePlayer Quick Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Sonic CinePlayer Quick Launch.lnk
backup=c:\windows\pss\Sonic CinePlayer Quick Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Neil.NEILPC^Start Menu^Programs^Startup^Wintab Mouse Emulator.lnk]
path=c:\documents and settings\Neil.NEILPC\Start Menu\Programs\Startup\Wintab Mouse Emulator.lnk
backup=c:\windows\pss\Wintab Mouse Emulator.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Program Files\\Metro Hi Speed\\FaxPrinter\\FaxPrinter.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R3 DM150Drv;DM150Drv;c:\windows\system32\DRIVERS\DM150Drv.sys [2008-04-01 20600]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\magix\Common\Database\bin\fbserver.exe [x]
R3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2005-11-08 647242]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-05-08 325896]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-05-08 298776]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\Drivers\Brfilt.sys [2001-08-17 2944]
S3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\Drivers\BrSerWdm.sys [2001-08-17 60416]
S3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\Drivers\BrUsbMdm.sys [2001-08-17 11008]
S3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\Drivers\BrUsbScn.sys [2001-08-17 10368]
S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\DRIVERS\wg111v3.sys [2007-04-23 224896]

— Other Services/Drivers In Memory —

*Deregistered* - aawservice
*Deregistered* - ALG
*Deregistered* - AudioSrv
*Deregistered* - avg8wd
*Deregistered* - Browser
*Deregistered* - CarboniteService
*Deregistered* - COMSysApp
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IntelIde
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - Kbdclass
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDC8021X
*Deregistered* - mnmdd
*Deregistered* - Mouclass
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - MSDTC
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RimVSerPort
*Deregistered* - ROOTMODEM
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - Sentinel
*Deregistered* - SentinelProtectionServer
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - SwPrv
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - VSS
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WudfPf
*Deregistered* - WudfSvc
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2008-10-30 c:\windows\Tasks\Microsoft_Hardware_Launch_IType_exe.job
- c:\program files\Microsoft IntelliType Pro\itype.exe [2008-06-10 22:56]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-DrvListnr - c:\program files\Analog Devices\SoundMAX\DrvListnr.exe
Notify-NavLogon - (no file)

.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Neil.NEILPC\Application Data\Mozilla\Firefox\Profiles\uglasdg9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-11 20:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL

- - - - - - - > 'winlogon.exe'(2180)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL

- - - - - - - > 'explorer.exe'(6036)
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll

- - - - - - - > 'explorer.exe'(6012)
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-12 20:18
ComboFix-quarantined-files.txt 2009-05-12 06:17

Pre-Run: 61,526,179,840 bytes free
Post-Run: 62,442,430,464 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

328 — E O F — 2009-04-22 08:24

Tomk

Post #10May 12, 2009, 3:41 PM UTC

shilohkid,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
C:\Documents and Settings\Cherie\My Documents\cherie-reee\music\miles apart-yellow card.mp3
C:\Documents and Settings\Cherie\My Documents\LimeWire\Saved\ride for me casha.mp3
C:\RECYCLER\S-1-5-21-1292428093-1078145449-839522115-1004\Dc227.mp3

Folder::

Registry::

Driver::

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

shilohkid

Post #11May 13, 2009, 5:58 AM UTC

Thank you Tomk
ComboFix 09-05-12.04 - Neil 05/12/2009 19:15.2 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Neil.NEILPC\Desktop\CFScript.txt

FILE ::
c:\documents and settings\Cherie\My Documents\cherie-reee\music\miles apart-yellow card.mp3
c:\documents and settings\Cherie\My Documents\LimeWire\Saved\ride for me casha.mp3
c:\recycler\S-1-5-21-1292428093-1078145449-839522115-1004\Dc227.mp3
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Cherie\My Documents\cherie-reee\music\miles apart-yellow card.mp3
c:\documents and settings\Cherie\My Documents\LimeWire\Saved\ride for me casha.mp3

.
((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-08 03:13 . 2009-05-08 03:13 ——– d—–w c:\documents and settings\Paula\Application Data\AVGTOOLBAR
2009-05-04 01:25 . 1993-04-28 10:00 72192 —-a-w c:\windows\system\GSWDLL.DLL
2009-05-04 01:25 . 1995-02-02 08:23 95232 —-a-w c:\windows\system\VBDB300.DLL
2009-05-04 01:25 . 1995-06-21 10:00 296832 —-a-w c:\windows\system\XBS200.DLL
2009-05-04 01:25 . 1995-11-16 02:13 50320 —-a-w c:\windows\system\DUNZIP.DLL
2009-05-04 01:25 . 1995-11-16 02:11 67296 —-a-w c:\windows\system\DZIP.DLL
2009-05-04 01:25 . 1992-05-14 21:41 192112 —-a-w c:\windows\system\QPRO.DLL
2009-05-04 01:25 . 1993-04-28 10:00 7008 —-a-w c:\windows\system\SETUPKIT.DLL
2009-05-04 01:25 . 1995-08-04 11:36 398416 —-a-w c:\windows\system\VBRUN300.DLL
2009-05-02 21:51 . 2001-12-20 03:39 18684 —-a-w c:\windows\system32\pdfmon158.dll
2009-05-02 21:50 . 2001-07-12 11:23 15008 —-a-r c:\windows\system32\rtfmon107.dll
2009-05-02 21:48 . 2001-11-15 01:07 53248 —-a-w c:\windows\system32\omacva.dll
2009-05-02 21:48 . 2001-12-21 22:10 90112 —-a-w c:\windows\system32\MB7tax.dll
2009-05-02 21:48 . 2001-05-03 02:46 155648 —-a-w c:\windows\system32\SSCE5232.dll
2009-05-02 21:48 . 1999-11-10 09:50 438272 —-a-w c:\windows\system32\C4dll.dll
2009-05-02 21:48 . 2001-05-03 02:45 31232 —-a-w c:\windows\system32\Bcfont32.dll
2009-05-02 21:48 . 2009-05-02 21:49 ——– d—–w C:\MB7
2009-05-02 03:44 . 2002-04-19 11:11 651264 ——w c:\windows\system32\brfxdial.dll
2009-05-02 03:44 . 2009-05-02 21:39 ——– d—–w c:\program files\Brother
2009-04-22 22:44 . 2009-04-22 22:42 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-22 02:56 . 2009-04-22 04:25 ——– d—–w c:\documents and settings\Neil.NEILPC\Application Data\Autodesk
2009-04-22 02:56 . 2009-05-04 01:25 ——– d—–w c:\documents and settings\Neil.NEILPC\Local Settings\Application Data\Autodesk
2009-04-22 02:16 . 2009-04-22 02:16 ——– d—–w c:\program files\Autodesk Network License Manager
2009-04-22 02:16 . 2009-05-04 02:19 ——– d—–w c:\documents and settings\All Users\Application Data\Autodesk
2009-04-21 23:10 . 2007-07-20 04:14 3727720 —-a-w c:\windows\system32\d3dx9_35.dll
2009-04-21 22:59 . 2009-04-21 22:59 ——– d—–w c:\program files\MSBuild
2009-04-21 22:58 . 2009-04-22 08:25 363264 —-a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-21 22:49 . 2009-04-21 22:49 ——– d—–w c:\windows\system32\XPSViewer
2009-04-21 22:45 . 2009-04-21 22:45 ——– d—–w c:\program files\Reference Assemblies
2009-04-21 22:41 . 2006-06-29 23:07 14048 ——w c:\windows\system32\spmsg2.dll
2009-04-18 21:52 . 2009-04-18 21:52 ——– d—–w c:\documents and settings\Neil.NEILPC\Application Data\Malwarebytes
2009-04-18 21:51 . 2009-04-07 01:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-18 21:51 . 2009-04-07 01:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-18 21:51 . 2009-04-18 21:51 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-18 21:51 . 2009-04-18 21:52 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-16 17:23 . 2009-03-06 14:22 284160 -c—-w c:\windows\system32\dllcache\pdh.dll
2009-04-16 17:23 . 2009-02-09 12:10 401408 -c—-w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 17:23 . 2009-02-06 11:11 110592 -c—-w c:\windows\system32\dllcache\services.exe
2009-04-16 17:23 . 2009-02-09 12:10 473600 -c—-w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 17:23 . 2009-02-06 10:10 227840 -c—-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 17:23 . 2009-02-09 12:10 453120 -c—-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 17:23 . 2009-02-09 12:10 729088 -c—-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 17:23 . 2009-02-09 12:10 617472 -c—-w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 17:23 . 2009-02-09 12:10 714752 -c—-w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 17:20 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 17:20 . 2008-04-21 12:08 215552 -c—-w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 02:53 . 2009-02-02 07:19 0 —-a-w c:\documents and settings\Renee\Local Settings\Application Data\prvlcl.dat
2009-05-08 20:01 . 2009-01-29 04:42 11952 —-a-w c:\windows\system32\avgrsstx.dll
2009-05-08 20:01 . 2009-01-29 04:41 325896 —-a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-02 21:39 . 2007-03-31 02:22 ——– d–h–w c:\program files\InstallShield Installation Information
2009-05-02 01:42 . 2007-03-31 05:42 ——– d—–w c:\program files\Common Files\Intuit
2009-05-02 01:24 . 2008-10-15 04:57 ——– d—–w c:\program files\Smart PDF Converter
2009-05-02 01:13 . 2007-03-31 02:20 ——– d—–w c:\program files\Scansoft
2009-04-23 18:31 . 2007-04-02 21:37 ——– d—–w c:\program files\Plaxo
2009-04-22 22:42 . 2007-04-08 22:22 ——– d—–w c:\program files\Java
2009-04-22 03:49 . 2007-04-02 01:47 103072 —-a-w c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-04-18 02:12 . 2008-11-03 08:57 71056 —-a-w c:\documents and settings\Paula\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-04 05:53 . 2007-11-03 03:23 71056 —-a-w c:\documents and settings\Cherie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 04:40 . 2007-12-04 17:50 71056 —-a-w c:\documents and settings\heather\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 03:01 . 2007-10-22 02:52 71056 —-a-w c:\documents and settings\Renee\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 02:54 . 2008-01-04 16:29 256 —-a-w c:\windows\system32\pool.bin
2009-03-31 23:33 . 2009-03-31 23:33 ——– d—–w c:\program files\Pitney Bowes
2009-03-31 04:24 . 2009-03-31 04:24 ——– d—–w c:\program files\Common Files\AnswerWorks 5.0
2009-03-31 03:54 . 2008-03-06 01:52 ——– d—–w c:\program files\TurboTax
2009-03-25 21:39 . 2009-03-25 21:39 ——– d—–w c:\program files\Nuance
2009-03-25 21:19 . 2007-03-31 02:20 ——– d—–w c:\program files\Common Files\scansoft shared
2009-03-25 05:45 . 2008-11-04 22:33 ——– d—–w c:\program files\Common Files\Research In Motion
2009-03-06 14:22 . 2003-03-31 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 18:33 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 —-a-w c:\windows\system32\ieencode.dll
2003-09-18 19:32 . 2007-03-31 08:00 13824 -c–a-w c:\program files\gfc.xls
2002-09-11 14:26 . 2007-06-22 16:07 63730 —-a-w c:\program files\viewsonicinstruct_xp.pdf
.

((((((((((((((((((((((((((((( SnapShot@2009-05-12_06.09.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-12 18:36 . 2009-05-12 18:36 16384 c:\windows\Temp\Perflib_Perfdata_614.dat
+ 2009-05-12 18:37 . 2009-05-12 18:37 16384 c:\windows\Temp\Perflib_Perfdata_51c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2009-01-10 02:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2009-01-10 02:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2009-01-10 02:13 583312 —-a-r c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]
"Smapp"="c:\program files\Analog Devices\SoundMAX\Smtray.exe" [2002-01-31 81920]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-03-12 106496]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-29 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-28 185896]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-08 1947928]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2009-01-10 669840]
"PPort11reminder"="c:\program files\Scansoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
NETGEAR WG111v3 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2007-9-12 1527808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-08 20:01 11952 —-a-w c:\windows\system32\avgrsstx.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"MIDI1"= SYNCOR11.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Metro Hi Speed Fax Printer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Metro Hi Speed Fax Printer.lnk
backup=c:\windows\pss\Metro Hi Speed Fax Printer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SmartUI.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SmartUI.lnk
backup=c:\windows\pss\SmartUI.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Sonic CinePlayer Quick Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Sonic CinePlayer Quick Launch.lnk
backup=c:\windows\pss\Sonic CinePlayer Quick Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Neil.NEILPC^Start Menu^Programs^Startup^Wintab Mouse Emulator.lnk]
path=c:\documents and settings\Neil.NEILPC\Start Menu\Programs\Startup\Wintab Mouse Emulator.lnk
backup=c:\windows\pss\Wintab Mouse Emulator.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Program Files\\Metro Hi Speed\\FaxPrinter\\FaxPrinter.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/28/2009 6:41 PM 325896]
R3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [3/30/2007 4:22 PM 2944]
R3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [3/30/2007 4:22 PM 60416]
R3 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\system32\drivers\BrUsbMdm.sys [3/30/2007 4:22 PM 11008]
R3 BrUsbScn;Brother MFC USB Scanner driver;c:\windows\system32\drivers\BrUsbScn.sys [3/30/2007 4:22 PM 10368]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [4/23/2007 11:11 AM 224896]
S3 DM150Drv;DM150Drv;c:\windows\system32\drivers\DM150Drv.sys [4/8/2009 8:59 AM 20600]

— Other Services/Drivers In Memory —

*Deregistered* - aawservice
*Deregistered* - ALG
*Deregistered* - AudioSrv
*Deregistered* - avg8wd
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - CarboniteService
*Deregistered* - COMSysApp
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - ImapiService
*Deregistered* - JavaQuickStarterService
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MSDTC
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - NtmsSvc
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasMan
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SentinelProtectionServer
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - SwPrv
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - VSS
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WudfSvc
*Deregistered* - WZCSVC
.
Contents of the 'Scheduled Tasks' folder

2008-10-30 c:\windows\Tasks\Microsoft_Hardware_Launch_IType_exe.job
- c:\program files\Microsoft IntelliType Pro\itype.exe [2008-06-10 22:56]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Neil.NEILPC\Application Data\Mozilla\Firefox\Profiles\uglasdg9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-12 19:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL

- - - - - - - > 'winlogon.exe'(3740)
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL
.
Completion time: 2009-05-13 19:32
ComboFix-quarantined-files.txt 2009-05-13 05:31
ComboFix2.txt 2009-05-12 06:18

Pre-Run: 62,730,117,120 bytes free
Post-Run: 62,611,939,328 bytes free

272 — E O F — 2009-04-22 08:24

Tomk

Post #12May 13, 2009, 1:51 PM UTC

shilohkid, How's it running?

shilohkid

Post #13May 14, 2009, 11:48 PM UTC

Dear Tomk About the same unfortunately…..Slow and clunky…

Tomk

Post #14May 15, 2009, 2:23 AM UTC

shilohkid,

Let's try this:

Download Rooter.exe to your desktop

Then doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

shilohkid

Post #15May 15, 2009, 4:55 AM UTC

Thank you Microsoft Windows XP Professional (5.1.2600) Service Pack 3 A:\ [Removable] (Total:0 Mo/Free:0 Mo) C:\ [Fixed] - NTFS - (Total:114463 Mo/Free:2649 Mo) D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) Thu 05/14/2009|18:51 ———————-\\ Processes.. –Locked– [System Process] ———- System ———- \SystemRoot\System32\smss.exe ———- \??\C:\WINDOWS\system32\csrss.exe ———- \??\C:\WINDOWS\system32\winlogon.exe ———- C:\WINDOWS\system32\services.exe ———- C:\WINDOWS\system32\lsass.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\System32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\System32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe ———- C:\WINDOWS\system32\spoolsv.exe ———- C:\WINDOWS\System32\svchost.exe ———- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ———- C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe ———- C:\Program Files\Java\jre6\bin\jqs.exe ———- C:\PROGRA~1\AVG\AVG8\avgrsx.exe ———- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe ———- C:\WINDOWS\System32\svchost.exe ———- C:\WINDOWS\system32\BRMFRSMG.EXE ———- C:\WINDOWS\System32\alg.exe ———- C:\WINDOWS\Explorer.EXE ———- C:\Program Files\Microsoft IntelliPoint\ipoint.exe ———- C:\Program Files\Analog Devices\SoundMAX\Smtray.exe ———- C:\WINDOWS\System32\hkcmd.exe ———- C:\Program Files\Common Files\Real\Update_OB\realsched.exe ———- C:\Program Files\Microsoft IntelliType Pro\itype.exe ———- C:\PROGRA~1\AVG\AVG8\avgtray.exe ———- C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe ———- C:\WINDOWS\system32\ctfmon.exe ———- C:\Program Files\NETGEAR\WG111v3\WG111v3.exe ———- C:\Program Files\Scansoft\PaperPort\pptd40nt.exe ———- C:\WINDOWS\System32\dllhost.exe ———- C:\WINDOWS\System32\msdtc.exe ———- C:\Program Files\Mozilla Firefox\firefox.exe ———- C:\WINDOWS\System32\vssvc.exe ———- C:\WINDOWS\System32\dllhost.exe ———- C:\WINDOWS\system32\cmd.exe ———- C:\Rooter$\RK.exe ———————-\\ Search.. ———————-\\ ROOTKIT !! 1 - "C:\Rooter$\Rooter_1.txt" - Thu 05/14/2009|18:53 ———————-\\ Scan completed at 18:53

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Extremely slow and cumbersome. Probably simple fix.

✨ Ask AI

Ask AI