What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Help - Infostealer.Gampass

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi,

Please do the following:


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Quotebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the quote box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
C:\shira laptop\BSINSTALL.exe
F:\temp\BSINSTALL.exe
F:\temp\BSINSTALL.exe
L:\temp\BSINSTALL.exe

Folder::
C:\data

SkipFix::


Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2


This other file identified by Kaspersky is located in your email. Unfortunately it doesn't pinpoint which file it is. You will have to use your best judgment to determine which email is suspicious (and that doesn't necessarily mean it is infected for certain) - perhaps one with an attachment or picture. To be on the safe side, unless there is something important or totally trusted, I would delete them all.



Also please describe how your computer is running now and if there are any outstanding issues.
Post #17
The computer seems fine except for one weird thing: on 2 occasions I was trying to type, first, in reply to one of your posts and secondly in my Yahoo email account, both times the typing happened backwards so

What the Tech

appeared as

hcet eht tahw

I think I was in Firefox both times. I opened a notepad and was able to type just fine, I then copied and pasted into the email or post.

Here's the latest log

ComboFix 09-06-13.05 - Peter 06/15/2009 23:17.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1535.986 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Peter\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
- REDUCED FUNCTIONALITY MODE -

FILE ::
"c:\shira laptop\BSINSTALL.exe"
"f:\temp\BSINSTALL.exe"
"l:\temp\BSINSTALL.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\shira laptop\BSINSTALL.exe
f:\temp\BSINSTALL.exe
l:\temp\BSINSTALL.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
.

2009-06-15 14:52 . 2009-06-15 14:52 ——– d-s—w- c:\documents and settings\Peter\UserData
2009-06-14 16:51 . 2009-06-14 16:51 ——– d—–w- c:\documents and settings\Peter\Application Data\Malwarebytes
2009-06-14 16:51 . 2009-05-26 17:20 40160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-14 16:51 . 2009-06-14 16:51 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-14 16:51 . 2009-06-14 16:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-14 16:51 . 2009-05-26 17:19 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-14 14:31 . 2002-01-08 21:00 176128 —-a-w- c:\windows\system32\RcdScan.dll
2009-06-14 14:31 . 1998-06-18 03:00 89360 —-a-w- c:\windows\system32\VB5DB.DLL
2009-06-14 03:28 . 2004-08-04 07:56 39424 —-a-w- c:\windows\system32\grpconv.exe
2009-06-14 03:28 . 2004-08-04 07:56 39424 —-a-w- c:\windows\system32\dllcache\grpconv.exe
2009-06-14 01:24 . 2009-06-14 02:05 ——– d–h–w- C:\$AVG8.VAULT$
2009-06-13 13:54 . 2009-06-13 13:54 ——– d—–w- c:\program files\Trend Micro
2009-06-13 12:55 . 2009-06-13 12:55 ——– d—–w- c:\documents and settings\All Users\Application Data\RegCure
2009-06-13 12:55 . 2009-06-13 14:15 ——– d—–w- c:\program files\RegCure
2009-06-13 12:49 . 2009-06-13 12:49 ——– d—–w- c:\documents and settings\Peter\Local Settings\Application Data\AVG Security Toolbar
2009-06-13 12:20 . 2009-06-13 12:20 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Help
2009-06-13 05:00 . 2009-06-02 17:37 1004800 —-a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-06-13 04:54 . 2009-06-13 04:54 ——– d—–w- c:\documents and settings\Administrator.HOME\Local Settings\Application Data\AVG Security Toolbar
2009-06-13 04:52 . 2009-06-13 04:52 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-13 04:52 . 2009-06-13 04:52 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-06-13 04:52 . 2009-06-13 04:52 327688 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-13 04:52 . 2009-06-13 04:52 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-13 04:51 . 2009-06-13 04:51 ——– d—–w- c:\windows\system32\drivers\Avg
2009-06-13 04:39 . 2009-06-13 04:39 ——– d—–w- c:\program files\Safer Networking
2009-06-13 04:29 . 2009-06-13 05:00 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-13 04:01 . 2009-06-13 04:01 ——– d—–w- c:\program files\AVG
2009-06-13 04:01 . 2009-06-14 15:39 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-06-13 02:44 . 2009-06-13 02:44 ——– d—–w- c:\documents and settings\Administrator.HOME\Local Settings\Application Data\Mozilla
2009-06-10 18:06 . 2009-06-10 18:06 ——– d—–w- c:\temp\logs
2009-06-10 18:06 . 2009-06-10 18:06 ——– d—–w- C:\Temp
2009-06-02 01:59 . 2009-06-02 01:59 ——– d—–w- c:\documents and settings\Peter\Application Data\Auslogics
2009-06-02 01:59 . 2009-06-02 01:59 ——– d—–w- c:\program files\Auslogics
2009-05-27 20:48 . 2009-05-27 23:38 ——– d—–w- c:\program files\F1 Challenge 99-02
2009-05-18 20:29 . 2009-05-18 20:29 542 —-a-w- c:\windows\eReg.dat
2009-05-18 19:41 . 2009-05-18 19:41 ——– d—–w- C:\Programme
2009-05-18 19:41 . 1999-06-25 13:55 149504 —-a-w- C:\UNWISE.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 03:03 . 2008-11-13 15:31 ——– d—–w- c:\documents and settings\Peter\Application Data\BitTorrent
2009-06-15 20:14 . 2008-05-25 14:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-15 14:24 . 2008-11-20 13:32 ——– d—–w- c:\documents and settings\Peter\Application Data\HPAppData
2009-06-15 11:07 . 2008-01-28 15:52 16 —-a-w- c:\windows\system32\magicpvt.dat
2009-06-15 03:22 . 2004-07-15 00:32 ——– d—–w- c:\documents and settings\Peter\Application Data\XnView
2009-06-14 15:46 . 2004-02-02 13:29 ——– d—–w- c:\program files\Symantec_Client_Security
2009-06-14 15:44 . 2004-02-02 13:29 ——– d—–w- c:\program files\Symantec
2009-06-14 15:44 . 2004-02-02 13:29 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-06-14 14:33 . 2003-10-07 18:41 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-14 13:14 . 2008-11-13 15:31 ——– d—–w- c:\documents and settings\Peter\Application Data\DNA
2009-06-14 11:42 . 2008-09-05 17:21 ——– d—–w- c:\program files\Verizon
2009-06-14 11:26 . 2008-11-13 15:31 ——– d—–w- c:\program files\DNA
2009-06-13 04:21 . 2007-04-13 01:33 ——– d—–w- c:\program files\BearShare
2009-06-13 03:15 . 2005-08-03 01:54 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-13 02:00 . 2007-03-22 06:12 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-09 00:27 . 2007-09-05 19:11 ——– d—–w- c:\documents and settings\Peter\Application Data\dvdcss
2009-06-03 21:22 . 2009-04-22 22:55 2004 —-a-w- c:\windows\Registration\e10f24f0-652e-11dd-ad8b-0800200c9a66.dll
2009-06-02 01:33 . 2004-07-26 19:00 ——– d—–w- c:\program files\Innovative Solutions
2009-05-19 23:16 . 2004-03-13 22:20 ——– d—–w- c:\program files\Qimage
2009-05-19 19:24 . 2007-03-22 06:12 ——– d—–w- c:\program files\Spyware Doctor
2009-05-18 20:29 . 2008-12-22 18:39 ——– d—–w- c:\program files\EA SPORTS
2009-05-16 01:32 . 2009-03-19 17:24 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-05-13 12:17 . 2005-07-20 15:27 ——– d—–w- c:\program files\ZipForm Desktop
2009-04-23 02:22 . 2009-04-22 23:06 ——– d—–w- c:\documents and settings\Peter\Application Data\Nik Software
2009-04-23 00:46 . 2009-04-23 00:46 ——– d—–w- c:\documents and settings\Peter\Application Data\Apple Computer
2009-04-23 00:39 . 2003-10-07 18:41 ——– d—–w- c:\program files\QuickTime
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\program files\Apple Software Update
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2009-04-22 21:48 . 2009-04-22 21:48 ——– d—–w- c:\documents and settings\Peter\Application Data\onOne Software
2009-04-22 21:48 . 2009-04-22 21:48 ——– d—–w- c:\documents and settings\All Users\Application Data\onOne Software
2009-04-22 21:48 . 2006-06-12 04:57 ——– d—–w- c:\program files\onOne Software
2009-04-22 21:14 . 2005-01-09 00:58 ——– d—–w- c:\program files\Extensis
2009-04-21 11:53 . 2008-02-23 02:04 ——– d—–w- c:\documents and settings\All Users\Application Data\Napster
2009-03-22 14:14 . 2003-10-12 14:35 71384 -c–a-w- c:\documents and settings\Peter\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2005-05-26 22:15 . 2005-10-04 02:59 174080 -csha-w- c:\windows\SYSTEM32\sfpsys.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-14_03.34.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2003-01-03 15:36 . 2003-01-03 15:36 20480 c:\windows\SYSTEM32\ControlSuite.exe
+ 2002-08-20 18:54 . 2002-08-20 18:54 94208 c:\windows\SYSTEM32\cabw32.dll
+ 2002-12-26 20:53 . 2002-12-26 20:53 36864 c:\windows\SYSTEM32\BSelList.dll
+ 2003-01-03 15:36 . 2003-01-03 15:36 98304 c:\windows\SYSTEM32\BacsTray.exe
+ 2009-06-14 11:42 . 2009-06-14 13:27 29696 c:\windows\Installer\{F9AD4AFD-0533-4172-98CA-2D3D418FB18D}\IconF0CEFCC9.exe
+ 2008-06-13 14:39 . 2008-03-04 21:58 77312 c:\windows\DEVCON.EXE
+ 2000-11-10 18:57 . 2000-11-10 18:57 5025 c:\windows\SYSTEM32\patterns.dat
+ 2002-03-13 19:20 . 2002-03-13 19:20 6057 c:\windows\SYSTEM32\DRIVERS\BASFND.sys
+ 2002-12-09 17:58 . 2002-12-09 17:58 393216 c:\windows\SYSTEM32\BMAPI.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 22:20 279944 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced Uninstaller PRO Installation Monitor"="c:\program files\Innovative Solutions\Advanced Uninstaller PRO - Version 9\monitor.exe" [2008-11-26 1340389]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-10-08 221184]
"PinnacleDriverCheck"="c:\windows\System32\PSDrvCheck.exe" [2003-12-04 406016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-09-19 294912]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]
"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2007-12-05 1626112]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Monitor.lnk - c:\program files\SanDisk\SanDisk TransferMate\SD Monitor.exe [2008-12-30 114688]
SentriLockCardUtility.lnk - c:\windows\Installer\{C9B8D365-A6C3-4C4D-9624-0F0078FEB1B4}\Icon037926361.exe [2008-12-5 84480]
Spyder3Utility.lnk - c:\program files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe [2008-3-19 6333954]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-13 04:52 11952 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\beep.sys]
@="beep"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^DMI RAID Manager.lnk]
backup=c:\windows\pss\DMI RAID Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^palmOne Registration.lnk]
backup=c:\windows\pss\palmOne Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MagicTuneEngine"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpnsvr.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\WINDOWS\\SYSTEM32\\dxdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=
"c:\\Program Files\\Microsoft Expression\\Web 2\\WebDesigner\\EXPRWD.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R0 inic1622;inic1622;c:\windows\SYSTEM32\DRIVERS\dmi1622.sys [12/24/2004 12:35 PM 45056]
R0 PCTCore;PCTools KDS;c:\windows\SYSTEM32\DRIVERS\PCTCore.sys [3/19/2009 1:24 PM 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [6/13/2009 12:52 AM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [6/13/2009 12:52 AM 108552]
R1 magicpvt;magicpvt;c:\windows\SYSTEM32\DRIVERS\magicpvt.sys [1/28/2008 11:52 AM 9728]
R2 P1C1394;Phase One 1394 Camera Driver;c:\windows\SYSTEM32\DRIVERS\p1c1394.sys [6/9/2004 6:12 PM 23168]
R3 SCR3xx USB Smart Card Reader;SCR3xx USB Smart Card Reader;c:\windows\SYSTEM32\DRIVERS\SCR3XX2K.sys [12/5/2008 10:28 AM 47488]
R3 Spyder3;Datacolor Spyder3;c:\windows\SYSTEM32\DRIVERS\Spyder3.sys [3/19/2008 4:26 PM 12288]
S2 avg8wd;AVG Free8 WatchDog; [x]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/26/2008 12:55 PM 348752]
S3 SNL320XP;SONIX MULTIMEDIA USB DEVICE DRIVER;c:\windows\SYSTEM32\DRIVERS\9kdUSBXP.sys [12/29/2008 2:01 PM 16000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-06-15 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-25 15:47]

2003-10-12 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2002-08-29 07:56]

2009-06-15 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-15 c:\windows\Tasks\RegCure Startup.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-13 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-15 c:\windows\Tasks\SDMsgUpdate (SD).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-02-18 19:39]

2009-06-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-02-02 22:38]
.
- - - - ORPHANS REMOVED - - - -

BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
ShellExecuteHooks-{AD0ACA58-656F-61DA-9DFE-5D20F4F611BA} - (no file)


.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.dellnet.com
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} - hxxp://www.virgindigital.co.uk/activeX/VirginWMA.cab
DPF: {2AD5DBAE-2DDB-11D4-A96C-00E09872DF17} - hxxp://www.printroom.com/_vti_dnl/PrintroomUploaderX3.CAB
DPF: {85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326} - hxxp://www.printroom.com/ImageUploader4.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-15 23:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,28,2d,d3,bf,81,
87,09,da,e2,63,26,f1,3f,c8,ff,68,c8,19,07,00,81,c0,17,ab,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,74,00,0d,8d,b6,
87,52,3e,6a,9c,d6,61,af,45,84,18,ab,e2,ef,4f,de,4d,a7,75,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,03,bc,e7,ee,b1,
ae,ec,e4,ff,7c,85,e0,43,d4,0e,fe,ab,4e,74,ac,f0,df,59,2b,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,fe,3c,a9,b6,2f,
02,3b,f9,86,8c,21,01,be,91,eb,e7,45,4d,91,14,29,87,aa,b7,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,7b,b7,fb,0e,11,
3c,d1,85,f5,1d,4d,73,a8,13,5c,05,58,5f,15,6d,5a,14,1f,04,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ad,7e,84,e5,3c,
86,48,52,df,20,58,62,78,6b,cf,c8,60,c8,11,04,99,74,4f,dd,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,27,a4,45,8f,1f,
d8,db,f8,fb,a7,78,e6,12,2f,9a,ea,98,dc,1d,42,15,c7,1b,5a,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,f7,05,35,16,94,
89,6d,14,01,3a,48,fc,e8,04,4a,f1,68,e2,ce,fe,e5,29,ec,a2,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ea,60,f2,2d,8a,
3b,5e,72,f6,0f,4e,58,98,5b,89,c9,07,4d,d9,3c,2b,3b,2e,a9,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,ee,d2,5e,d5,93,
8f,ea,a3,3d,ce,ea,26,2d,45,aa,78,a9,d8,4c,08,8c,b4,c6,c9,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,ab,62,2e,91,5f,
68,c1,fe,2a,b7,cc,b5,b9,7f,41,e7,0d,c5,1a,0c,f0,b4,53,5c,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,e2,5b,25,9d,08,
c1,2a,1b,6c,43,2d,1e,aa,22,2f,9c,ee,72,de,f9,4c,96,a0,a6,6c,43,2d,1e,aa,22,\
.
Completion time: 2009-06-16 23:22
ComboFix-quarantined-files.txt 2009-06-16 03:22
ComboFix2.txt 2009-06-14 16:41
ComboFix3.txt 2009-06-14 16:16
ComboFix4.txt 2009-06-14 03:42

Pre-Run: 58,557,407,232 bytes free
Post-Run: 58,590,023,680 bytes free

315
Post #18
Hi,

The backwards writing will dissappear with a reboot or two..it happens a lot, not sure why but it does correct itself on a reboot.

please post a fresh DDS log so I can make certain you are clean then we can begin the final tool clean up.

Next

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button.
  • Download and install the latest Java Runtime Environment (JRE) version for your computer.(Version 6 update 14)

NEXT

P2P - I see you have P2P software BitTorrent, Napster and bearshare installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may have contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.
Post #19
Here's the DDS DDS (Ver_09-05-14.01) - NTFSx86 Run by [removed] at 9:40:50.00 on Wed 06/17/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1535.1073 [GMT -4:00] FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\RegCure\RegCure.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\LVCOMSX.EXE C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\WINDOWS\System32\DSentry.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Verizon\McciTrayApp.exe C:\Program Files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Peter\Desktop\dds.pif ============== Pseudo HJT Report =============== mStart Page = hxxp://www.dellnet.com uInternet Settings,ProxyOverride = 127.0.0.1;*.local uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s uURLSearchHooks: H - No File uURLSearchHooks: H - No File BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [Advanced Uninstaller PRO Installation Monitor] "c:\program files\innovative solutions\advanced uninstaller pro - version 9\monitor.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe" mRun: [BCMSMMSG] BCMSMMSG.exe mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Verizon_McciTrayApp] c:\program files\verizon\McciTrayApp.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monitor.lnk - c:\program files\sandisk\sandisk transfermate\SD Monitor.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sentri~1.lnk - c:\windows\installer\{c9b8d365-a6c3-4c4d-9624-0f0078feb1b4}\Icon037926361.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spyder~1.lnk - c:\program files\datacolor\spyder3pro\utility\Spyder3Utility.exe IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - {A1EDC4A1-940F-48E0-8DFD-E38F1D501021} IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mic273~1\web2~1\office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} - hxxp://www.virgindigital.co.uk/activeX/VirginWMA.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {2AD5DBAE-2DDB-11D4-A96C-00E09872DF17} - hxxp://www.printroom.com/_vti_dnl/PrintroomUploaderX3.CAB DPF: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} - hxxp://www.alamy.com/uploader/alamy_uploader.cab DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123506939171 DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123506924625 DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab DPF: {85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326} - hxxp://www.printroom.com/ImageUploader4.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} - hxxp://www.candystand.com/assets/activex/virtools/CacheManager.CAB SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {AD0ACA58-656F-61DA-9DFE-5D20F4F611BA} - No File ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\iiv1fu3w.default\ FF - plugin: c:\documents and settings\peter\application data\mozilla\firefox\profiles\iiv1fu3w.default\extensions\[removed]\plugins\npImgCtl.dll FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint_03050024.dll FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll ============= SERVICES / DRIVERS =============== R0 inic1622;inic1622;c:\windows\system32\drivers\dmi1622.sys [2004-12-24 45056] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-3-19 130936] R1 magicpvt;magicpvt;c:\windows\system32\drivers\magicpvt.sys [2008-1-28 9728] R2 P1C1394;Phase One 1394 Camera Driver;c:\windows\system32\drivers\p1c1394.sys [2004-6-9 23168] R3 SCR3xx USB Smart Card Reader;SCR3xx USB Smart Card Reader;c:\windows\system32\drivers\SCR3XX2K.sys [2008-12-5 47488] R3 Spyder3;Datacolor Spyder3;c:\windows\system32\drivers\Spyder3.sys [2008-3-19 12288] S2 navapsvc;Norton AntiVirus Auto Protect Service;"c:\program files\norton systemworks\norton antivirus\navapsvc.exe" –> c:\program files\norton systemworks\norton antivirus\navapsvc.exe [?] S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-4-26 348752] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-4-26 1095560] S3 SNL320XP;SONIX MULTIMEDIA USB DEVICE DRIVER;c:\windows\system32\drivers\9kdUSBXP.sys [2008-12-29 16000] =============== Created Last 30 ================ 2009-06-16 08:01 –d—– c:\docume~1\peter\applic~1\Comodo 2009-06-16 08:01 –d—– c:\program files\COMODO 2009-06-16 07:57 55,640 a——- c:\windows\system32\drivers\avgntflt.sys 2009-06-15 23:17 1,224 a——- C:\CF-Submit.htm 2009-06-15 10:52 –ds—- c:\documents and settings\peter\UserData 2009-06-14 12:51 –d—– c:\docume~1\peter\applic~1\Malwarebytes 2009-06-14 12:51 40,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-14 12:51 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-06-14 12:51 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-06-14 12:51 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-06-14 12:44 a-dshr– C:\autorun.inf 2009-06-14 12:25 a-dshr– C:\cmdcons 2009-06-14 12:23 161,792 a——- c:\windows\SWREG.exe 2009-06-14 12:23 155,136 a——- c:\windows\PEV.exe 2009-06-14 12:23 98,816 a——- c:\windows\sed.exe 2009-06-14 10:31 176,128 a——- c:\windows\system32\RcdScan.dll 2009-06-14 10:31 414,944 a——- c:\windows\system32\COMCT332.OCX 2009-06-14 10:31 328,480 a——- c:\windows\system32\ssa3d30.ocx 2009-06-14 10:31 171,967 a——- c:\windows\system32\Odbcjet.hlp 2009-06-14 10:31 7,348 a——- c:\windows\system32\Odbcjet.cnt 2009-06-14 10:31 89,360 a——- c:\windows\system32\VB5DB.DLL 2009-06-13 23:28 39,424 a——- c:\windows\system32\grpconv.exe 2009-06-13 23:28 39,424 a——- c:\windows\system32\dllcache\grpconv.exe 2009-06-13 21:24 –d-h— C:\$AVG8.VAULT$ 2009-06-13 09:54 –d—– c:\program files\Trend Micro 2009-06-13 08:55 –d—– c:\docume~1\alluse~1\applic~1\RegCure 2009-06-13 00:39 –d—– c:\program files\Safer Networking 2009-06-13 00:21 300 a——- c:\windows\wininit.ini 2009-06-13 00:01 –d—– c:\docume~1\alluse~1\applic~1\avg8 2009-06-10 14:06 –d—– c:\temp\logs 2009-06-10 14:06 –d—– C:\Temp 2009-06-01 21:59 –d—– c:\docume~1\peter\applic~1\Auslogics 2009-06-01 21:59 –d—– c:\program files\Auslogics 2009-05-27 16:48 –d—– c:\program files\F1 Challenge 99-02 2009-05-18 16:29 542 a——- c:\windows\eReg.dat 2009-05-18 15:41 149,504 a——- C:\UNWISE.EXE 2009-05-18 15:41 –d—– C:\Programme ==================== Find3M ==================== 2009-06-03 17:22 2,004 a——- c:\windows\registration\e10f24f0-652e-11dd-ad8b-0800200c9a66.dll 2009-05-15 21:32 130,936 a——- c:\windows\system32\drivers\PCTCore.sys 2008-01-29 12:25 439,296 a——- c:\documents and settings\peter\GoToAssist_phone__317_en.exe 2005-12-12 14:40 46,296 ac—— c:\docume~1\peter\applic~1\GDIPFONTCACHEV1.DAT 2005-05-26 18:15 174,080 ac-sh— c:\windows\system32\sfpsys.exe ============= FINISH: 9:41:33.70 =============== Here's the Attach UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-05-14.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume4 Install Date: 10/12/2003 10:34:57 AM System Uptime: 6/17/2009 9:19:56 AM (0 hours ago) Motherboard: Dell Computer Corp. | | 0M2035 Processor: Intel® Pentium® 4 CPU 2.60GHz | Microprocessor | 2593/800mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (NTFS) - 112 GiB total, 54.319 GiB free. D: is CDROM () E: is CDROM () F: is FIXED (NTFS) - 233 GiB total, 158.649 GiB free. G: is FIXED (NTFS) - 298 GiB total, 213.296 GiB free. H: is Removable I: is Removable J: is Removable K: is Removable L: is FIXED (NTFS) - 596 GiB total, 256.971 GiB free. ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1685: 3/20/2009 12:39:35 PM - Removed Adobe Photoshop CS2 RP1686: 4/5/2009 11:37:15 PM - System Checkpoint RP1687: 4/7/2009 12:37:31 AM - System Checkpoint RP1688: 4/16/2009 3:55:10 PM - System Checkpoint RP1689: 4/21/2009 7:43:59 AM - Installed Napster RP1690: 4/21/2009 7:44:35 AM - Installed Napster Burn Engine RP1691: 4/21/2009 7:52:49 AM - Removed Napster RP1692: 4/21/2009 7:53:21 AM - Removed Napster Burn Engine RP1693: 4/21/2009 1:48:25 PM - Removed Diskeeper Professional Edition RP1694: 4/21/2009 1:48:49 PM - Installed Diskeeper 2009 Pro Premier. RP1695: 4/21/2009 2:36:52 PM - Removed Diskeeper 2009 Pro Premier. RP1696: 4/21/2009 2:41:00 PM - Installed Diskeeper 2009 Pro Premier. RP1697: 4/22/2009 8:25:38 PM - System Checkpoint RP1698: 4/22/2009 8:38:26 PM - Installed QuickTime RP1699: 4/24/2009 2:30:43 PM - System Checkpoint RP1700: 4/29/2009 8:37:08 AM - System Checkpoint RP1701: 5/3/2009 5:40:03 PM - System Checkpoint RP1702: 5/6/2009 6:55:48 PM - System Checkpoint RP1703: 5/8/2009 8:18:30 AM - System Checkpoint RP1704: 5/10/2009 9:30:43 AM - System Checkpoint RP1705: 5/11/2009 11:55:28 AM - System Checkpoint RP1706: 5/12/2009 4:13:47 PM - System Checkpoint RP1707: 5/14/2009 9:00:05 AM - System Checkpoint RP1708: 5/15/2009 11:17:22 AM - System Checkpoint RP1709: 5/16/2009 5:23:21 PM - System Checkpoint RP1710: 5/18/2009 8:42:11 AM - System Checkpoint RP1711: 5/19/2009 4:08:51 PM - System Checkpoint RP1712: 5/20/2009 7:03:37 PM - System Checkpoint RP1713: 5/22/2009 8:41:41 AM - System Checkpoint RP1714: 5/23/2009 2:41:54 PM - System Checkpoint RP1715: 5/24/2009 7:22:23 PM - System Checkpoint RP1716: 5/26/2009 9:24:27 AM - System Checkpoint RP1717: 5/27/2009 9:37:22 AM - System Checkpoint RP1718: 5/28/2009 12:53:32 PM - System Checkpoint RP1719: 5/29/2009 3:29:53 PM - System Checkpoint RP1720: 5/30/2009 10:03:39 PM - System Checkpoint RP1721: 6/1/2009 10:54:48 AM - System Checkpoint RP1722: 6/1/2009 8:58:54 PM - Removed Diskeeper 2009 Pro Premier. RP1723: 6/1/2009 9:04:54 PM - Installed Diskeeper 2009 Pro Premier. RP1724: 6/1/2009 9:15:20 PM - Removed Diskeeper 2009 Pro Premier. RP1725: 6/1/2009 9:47:21 PM - Installed Diskeeper 2009 Pro Premier. RP1726: 6/1/2009 9:54:33 PM - Removed Diskeeper 2009 Pro Premier. RP1727: 6/2/2009 11:24:54 PM - System Checkpoint RP1728: 6/4/2009 1:03:12 PM - System Checkpoint RP1729: 6/5/2009 4:27:51 PM - System Checkpoint RP1730: 6/6/2009 5:48:21 PM - System Checkpoint RP1731: 6/8/2009 8:35:32 AM - System Checkpoint RP1732: 6/9/2009 3:14:26 PM - System Checkpoint RP1733: 6/11/2009 5:37:57 PM - System Checkpoint RP1734: 6/13/2009 12:02:21 AM - Installed AVG Free 8.5 RP1735: 6/13/2009 12:29:45 AM - Installed AVG Free 8.5 RP1736: 6/13/2009 12:39:30 AM - Installed AVG Free 8.5 RP1737: 6/14/2009 7:42:04 AM - Installed Verizon FiOS Connection Wizard RP1738: 6/14/2009 10:33:31 AM - Installed Broadcom Advanced Control Suite RP1739: 6/14/2009 11:27:34 AM - Removed Sygate Personal Firewall Pro RP1740: 6/14/2009 11:40:08 AM - Removed AVG Free 8.5 RP1741: 6/14/2009 11:43:35 AM - Removed Symantec AntiVirus Client RP1742: 6/15/2009 9:14:32 PM - System Checkpoint RP1743: 6/16/2009 7:41:51 AM - Installed AVG Free 8.5 RP1744: 6/16/2009 7:48:06 AM - Removed AVG Free 8.5 RP1745: 6/16/2009 7:48:51 AM - Installed AVG Free 8.5 RP1746: 6/16/2009 7:55:39 AM - Avira AntiVir Personal - 6/16/2009 7:55 ==== Installed Programs ====================== 3D Groove Playback Engine 3DVIA player 4.1 ABBYY FineReader 5.0 Sprint Active Camera 2004 fix version 2.1 (FS9.0) Active Camera 2004 version 2.1 for FS 9.0 Add or Remove Adobe Creative Suite 3 Master Collection Adobe Acrobat 7.0.1 and Reader 7.0.1 Update Adobe Acrobat 7.0.2 and Reader 7.0.2 Update Adobe After Effects CS3 Adobe After Effects CS3 Presets Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge 1.0 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe BridgeTalk Plugin CS3 Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Common File Installer Adobe Contribute CS3 Adobe Creative Suite 2 Adobe Creative Suite 3 Master Collection Adobe Default Language CS3 Adobe Device Central CS3 Adobe Dreamweaver CS3 Adobe Encore CS3 Adobe Encore CS3 Codecs Adobe ExtendScript Toolkit 2 Adobe Extension Manager CS3 Adobe Fireworks CS3 Adobe Flash CS3 Adobe Flash Player 10 Plugin Adobe Flash Player 9 ActiveX Adobe Flash Player ActiveX Adobe Flash Video Encoder Adobe Fonts All Adobe Help Center 1.0 Adobe Help Viewer CS3 Adobe Illustrator CS3 Adobe InDesign CS3 Adobe InDesign CS3 Icon Handler Adobe Linguistics CS3 Adobe MotionPicture Color Files Adobe PDF Library Files Adobe Photoshop CS3 Adobe Premiere Pro CS3 Adobe Premiere Pro CS3 Functional Content Adobe Premiere Pro CS3 Third Party Content Adobe Reader 7.0 Adobe Reader for Palm OS, 3.05 Adobe Setup Adobe Shockwave Player Adobe SING CS3 Adobe Soundbooth CS3 Adobe Soundbooth CS3 Codecs Adobe Stock Photos CS3 Adobe SVG Viewer 3.0 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe Version Cue CS3 Server Adobe Video Profiles Adobe WAS CS3 Adobe WinSoft Linguistics Plugin Adobe XMP DVA Panels CS3 Adobe XMP Panels CS3 Advanced Uninstaller PRO - Version 9 Aerodesigns Airbus A318 aerosoft's - London Heathrow 2008 AHV content for Acrobat and Flash Airbus Series Vol.1 Deluxe (FS2004) Airbus Series Vol.2 (FS2004) Apple Software Update Ask Toolbar Audio Mid Recorder 3.65 AusLogics Disk Defrag AutoRotation Premium AVS Video Converter 6 AVS4YOU Software Navigator 1.3 BACS BCM V.92 56K Modem BeerSmith Brewing Software BitTorrent BookSmart™ 1.8.1 1.8.1 Broadcom Advanced Control Suite C1 PRO 3.5 Canon Camera Access Library Canon Camera Support Core Library Canon Camera Window DC_DV 5 for ZoomBrowser EX Canon Camera Window DC_DV 6 for ZoomBrowser EX Canon Camera Window MC 6 for ZoomBrowser EX Canon EOS-1Ds Mark II WIA Driver Canon EOS 5D WIA Driver Canon EOS Kiss_N REBEL_XT 350D WIA Driver Canon iP1600 Canon RAW Image Task for ZoomBrowser EX Canon RemoteCapture Task for ZoomBrowser EX Canon Utilities Digital Photo Professional 2.1 Canon Utilities Easy-PhotoPrint Canon Utilities EOS Utility Canon Utilities PhotoStitch Canon Utilities ZoomBrowser EX Capture One 3.7.4 Capture One 3.7.8 Capture One PRO 3.6 CDex extraction audio CERTS Writer Cleaner 5 EZ CLOUD9 Washington 1.01 CLOUD9 Washington 1.01 upd Color Efex Pro 3.0 Complete DAO Dell ResourceCD DeMoirize Dfine 2.0 Digital Studio v5 5 DMI SATA RAID Manager DNA Documents To Go DocuSign Express 2.5 doPDF 6.0 printer DS21Patch DUBAÏ 2004 DUBAÏ landclass DUBAÏ mesh DV NETWORK SOLUTION DISK DVD X Copy Platinum 4.0.3 DVD X Rescue DVDSentry Earthmate Image Tagger Easy-WebPrint EPSON Perf 4870 Reference Guide EPSON Scan ETCC 2003 Mod Extensis Mask Pro 3.0 Extensis PhotoGraphics 1.0 Extensis PhotoTools 2.0 F1 Challenge 99-02 FileAlyzer FileZilla (remove only) FileZilla Client [removed] Form Viewer FPCleaner 3.5.0.0 FSAutoStart GamesBar 1.1.0.5 Google Earth Google Toolbar for Internet Explorer Google Updater HijackThis 2.0.2 Hollywood FX Pack 26 - Extra FX Hotfix for MDAC 2.80 (KB911562) Hotfix for Windows XP (KB926239) HP Deskjet D1500 Printer Driver Software 10.0 Rel .3 HP Imaging Device Functions 10.0 HP Photosmart Essential 2.5 HP Smart Web Printing ICC Color Profiles IF Plugin Pack iFly 747-400 iFly 747-400 Service Pack 1 iFly 747-400 Service Pack 2 Intel® PRO Network Adapters and Drivers Intel® PROSet IsoBuster 2.5 J2SE Runtime Environment 5.0 Update 5 Java™ 6 Update 3 Java™ 6 Update 5 Java™ 6 Update 7 Just Flight - Spitfire Mk1a v1.00 LiveUpdate 1.90 (Symantec Corporation) Logitech® Camera Driver Macromedia Extension Manager Malwarebytes' Anti-Malware Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 3.0 Service Pack 1 Microsoft .NET Framework 3.5 Microsoft Color Control Panel Applet for Windows XP Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft Expression Web 2 Microsoft Expression Web 2 MUI (English) Microsoft Kernel-Mode Driver Framework Feature Pack 1.1 Microsoft Location Finder Microsoft Office Professional Edition 2003 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Silverlight Microsoft Streets & Trips 2006 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works 2002 Setup Launcher Modem Helper Move Networks Media Player for Internet Explorer Mozilla Firefox (3.0.11) MSN MSN Music Assistant MSXML 6.0 Parser (KB925673) Netflix Movie Viewer Netscape (7.2) Next Generation Visualisations nik Color Efex Pro Classic Set NVIDIA Drivers PDF Settings PhotoTools 1.0 Professional Edition Pinnacle Hollywood FX 4.6 PMDG 747-400 FS9 Update V1R12 (Unifies to FSX) PMDG_747-400_Sound_Update PMDG747_400 Queen of the Skies PowerDVD Qimage QualityWings 757-200 v1.00 (Model Package Beta) Quicken 2002 New User Edition QuickTime QuickTime 3.0 Real Alternative 1.50 RealAir Spitfire XIV RegCure 1.6.0.0 SanDisk TransferMate SCRABBLE Deluxe Security Update for Step By Step Interactive Training (KB898458) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB958644) Sentrilock Card Utility Sharpener Pro 3.0 Shockwave Shop for HP Supplies Silver Efex Pro SilverFast Epson SilverFast Epson TWAIN SilverFast SE CD Documentation 6.1.1 SmartDraw 2008 SmartDraw PDF Filter Sonic MyDVD Sonic RecordNow! Spybot - Search & Destroy 1.4 Spyder3Pro Spyware Doctor 6.0 SSC Service Utility v4.00 Studio 8 Studio Content CD System Requirements Lab The Panorama Factory The Panorama Factory V4 m32 Edition The Panorama Factory V5 m32 Edition TweakNow RegCleaner Standard Update for Windows XP (KB898461) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Verizon FiOS Connection Wizard Verizon Online Verizon Online Help and Support Version 1.0 VideoLAN VLC media player 0.8.5 Viewpoint Media Player (Remove Only) Virtual Earth 3D (Beta) Viveza WebEx What's Running 2.2 Windows Driver Package - SCM Microsystems Inc. (SCR3xx USB Smart Card Reader) SmartCardReader (11/07/2006 4.35.00.01) Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Media Format 11 runtime Windows Media Player 11 Windows Presentation Foundation Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Service Pack 2 WinPcap 3.1 beta3 WinRAR archiver XnView 1.92 ZipForm Desktop ==== Event Viewer Messages From Past Week ======== 6/17/2009 9:17:54 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cmdGuard Fips intelppm magicpvt PenClass 6/17/2009 9:04:42 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio avipbb cmdGuard Fips intelppm magicpvt PenClass ssmdrv 6/14/2009 9:21:07 AM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 9:21:02 AM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 9:21:02 AM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 9:21:02 AM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 9:20:55 AM, error: Service Control Manager [7034] - The hpqcxs08 service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 9:20:55 AM, error: Service Control Manager [7034] - The HP CUE DeviceDiscovery Service service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 9:20:45 AM, error: Service Control Manager [7034] - The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 7:47:49 AM, error: Dhcp [1002] - The IP address lease 169.254.127.213 for the Network Card with network address 0007E955E5F6 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 6/14/2009 12:50:24 PM, error: NetBT [4321] - The name "GENTLE :1d" could not be registered on the Interface with IP address 192.168.1.2. The machine with the IP address 192.168.1.3 did not allow the name to be claimed by this machine. 6/14/2009 12:27:09 PM, error: Service Control Manager [7034] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 12:00:22 PM, error: Service Control Manager [7034] - The Smart Card service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 12:00:22 PM, error: Service Control Manager [7034] - The LightScribeService Direct Disc Labeling Service service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 12:00:22 PM, error: Service Control Manager [7034] - The EpsonBidirectionalService service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 12:00:22 PM, error: Service Control Manager [7034] - The EPSON Printer Status Agent2 service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 12:00:22 PM, error: Service Control Manager [7034] - The Canon Camera Access Library 8 service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 12:00:22 PM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s). 6/14/2009 12:00:22 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 6/14/2009 11:46:37 AM, error: Service Control Manager [7000] - The AVG Free8 WatchDog service failed to start due to the following error: The system cannot find the path specified. 6/13/2009 8:52:32 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 f7457cf9, parameter3 b63f9b18, parameter4 00000000. 6/13/2009 8:51:01 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:. 6/13/2009 12:51:22 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 6/13/2009 12:02:17 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AVG Free8 WatchDog service to connect. 6/13/2009 12:02:17 AM, error: Service Control Manager [7000] - The AVG Free8 WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 6/13/2009 11:31:52 PM, error: Service Control Manager [7024] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service terminated with service-specific error 4294967295 (0xFFFFFFFF). 6/13/2009 11:31:52 PM, error: Service Control Manager [7023] - The Automatic Updates service terminated with the following error: %%2147952506 6/13/2009 11:17:39 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect. 6/13/2009 11:14:49 PM, error: Service Control Manager [7034] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). 6/13/2009 10:38:39 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file beep.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.0. 6/12/2009 11:07:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811} 6/12/2009 10:44:37 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 6/12/2009 10:44:14 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec magicpvt MRxSmb NetBIOS NetBT PenClass RasAcd Rdbss Tcpip wpsdrvnt WS2IFSL 6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning. 6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning. 6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 6/12/2009 10:43:56 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 6/12/2009 10:39:45 PM, error: SCardSvr [610] - Smart Card Reader 'SCM Microsystems Inc. SCR35xx USB Smart Card Reader 0' rejected IOCTL GET_ATTRIBUTE: The request is not supported. 6/12/2009 10:36:55 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PenClass 6/12/2009 10:36:55 PM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting. 6/12/2009 10:36:19 PM, error: Service Control Manager [7000] - The Norton AntiVirus Auto Protect Service service failed to start due to the following error: The system cannot find the path specified. 6/12/2009 10:12:04 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SHIRA that believes that it is the master browser for the domain on transport NetBT_Tcpip_{80E6BA5C-44B2-4E8E-8D5. The master browser is stopping or an election is being forced. ==== End Of File ===========================
Post #20
Hi,

Didi you run the JAVARA program from my previous post yet…as you still have some old Java programs listed.

Time to do some housekeeping as your log is clean:

Please do the following:

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • For Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #21
Thank you for all your help and consideration. I really thought I was f@#&ed on Saturday when I discovered the virus/malware, and I will certainly take you advise in the future. Regards Peter
Post #23
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI