What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Infected with worm?

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
The computer told me I was infected with a worm so I ran my Panda antivirus then Malwarebytes antimalware and then Windows defender……but the computer is still running slow and keeps telling me that an error occurred with C:/Windows/msa.exe and other stuff too. Here are the logs.




Malwarebytes' Anti-Malware 1.31
Database version: 1508
Windows 6.0.6001 Service Pack 1

6/22/2009 1:49:27 PM
mbam-log-2009-06-22 (13-49-27).txt

Scan type: Quick Scan
Objects scanned: 43563
Time elapsed: 7 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


———————————————————————————————————-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:58:15 PM, on 6/22/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\s3trayp.exe
C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\PixArt\PAC7311\Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\PavBckPT.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qwest.live.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qwest.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qwest.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qwest.live.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Qwest
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe 1
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickCare2.2] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QuickCare2.2
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PAC7311_Monitor] C:\Windows\PixArt\PAC7311\Monitor.exe
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2009\Inicio.exe"
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ColdWare] C:\Windows\msa.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Qwest Live - {1C1C3E7E-904E-4CDE-976B-E44DEC8C5356} - http://qwest.live.com (file missing) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Internet Security 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Internet Security 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Internet Security 2009\pavsrvx86.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2009\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Internet Security 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Internet Security 2009\PskSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Internet Security 2009\TPSrv.exe

–
End of file - 8719 bytes
Post #3
[external image: Posted Image]

Hi ashlie, welcome to the WTT Forums. My username is Raktor, and I would be glad to take a look at your log.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I will be back to you shortly with instructions. :)
Post #4
Today something new began happening. I am hearing commercials for things like Veet while no one is on computer. It is just at the regular desktop and I start hearing a commercial coming through the speakers.
Post #5
[external image: Posted Image]

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to take a look at your log. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • If you don't know or understand something, please don't hesitate to say or ask! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Please do not use any tools such as Combofix, Vundofix, or HijackThis fixes without instruction to do so!
  • Finally, stay with this topic until I give you the final 'All clear' post! :thumbup:

As you are running Windows Vista, please run our diagnostic programs by right clicking on them and selecting 'Run As Administrator'

0.5) Disable Windows Defender
It appears you are running Windows Defender. This might interfere with fixes we are about to do, so we need to disable it. To disable your Windows Defender Real-time Protection.

  • Open Windows Defender
  • Click Tools
  • Click General Settings
  • Scroll down to Real Time Protection Options
  • Uncheck Turn on Real Time Protection (recommended)
  • Close Windows Defender

Note:Once your log is clean you can re-enable Windows Defender Real Time Protection.

1) OTM
Please download the OTM by OldTimer.
  • Save it to your desktop.
  • Please double-click OTM.exe to run it.
    (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
    explorer.exe
    msa.exe

    :Reg
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ColdWare"=-
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

    :Files
    C:\Windows\msa.exe

    :Commands
    [purity]
    [emptytemp]
    [Reboot]

  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

2) DDS
[external image: Posted Image]
Please download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop.

3) GMER
Please download gmer.zip from Gmer and save it to your desktop.

  • Right click on gmer.zip and select Extract All….
  • Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  • Click on the Browse button. Click on Desktop. Then click OK.
  • Click Next. It will start extracting.
  • Once done, check (tick) the Show extracted files box and click Finish.

Double click on gmer.exe to run it. It will start running a scan. If it detects rootkit activity, you will receive a prompt to run a full scan. Click Yes.

  • When done, you may receive another notice. Click OK.
  • Click on Save … to save a log.
  • Copy and paste in Gmer.txt and click Save.
  • Close Gmer.

If you receive no notice, click on the Scan button.

  • It will start scanning again.
  • When done, click on Save … to save a log.
  • Copy and paste in Gmer.txt and click Save.
  • Close Gmer.

4) What You Will Need To Post:
  • OTM Log
  • DDS Logs
  • GMER Log
  • How your computer is running now
Post #6
I don't know if I have a script blocker or how to disable one if I do. I ran the DDS thing and a window opened up but nothing is happening……….it didn't scan or anything. I am sorry but I need more detailed instructions or something.
Post #7
Here is the OTM log files. All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! No active process named msa.exe was found! ========== REGISTRY ========== Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ColdWare not found. Registry delete failed. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ scheduled to be deleted on reboot. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. ========== FILES ========== File/Folder C:\Windows\msa.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y05N9NSY\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KHDC8OAT\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5WPRA0LB\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4EQ52FH8\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: Default User File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y05N9NSY\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KHDC8OAT\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5WPRA0LB\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4EQ52FH8\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: Matthew File delete failed. C:\Users\Matthew\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 165530920 bytes ->Java cache emptied: 55732247 bytes ->FireFox cache emptied: 93203232 bytes User: Public %systemdrive% .tmp files removed: 0 bytes Folder delete failed. C:\Windows\msdownld.tmp scheduled to be deleted on reboot. %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes File delete failed. C:\Windows\temp\slu2d2c.tmp\cceraser.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\ecmsvr32.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\eeCtrl.sys scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\ERASER.sys scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\naveng.sys scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\naveng32.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\navex15.sys scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\navex32a.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\symaveng.inf scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\SymErase.inf scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\slu2d2c.tmp\virscan.inf scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\PSPPK1\HFSetup.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\PBKDIR\AUTORUN.INF scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\PBKDIR\Setup.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\zh-tw\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\zh-cn\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\tr\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\th\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\sv\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\ru\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\pt-br\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\pl\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\no\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\nl\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\ko\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\ja\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\it\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\HTML\ui.js scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\fr\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\fi\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\es\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\en-gb\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\en\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\el\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\de\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\da\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\cs\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\ci.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\cires.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\GoogleUpdaterAdminPrefs.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\GoogleUpdaterInstallMgr.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\GoogleUpdaterSetup.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\2.4.1536.6592\npCIDetect13.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\GoogleUpdater.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1d6adf22\GoogleUpdaterService.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\zh-tw\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\zh-cn\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\tr\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\th\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\sv\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\ru\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\pt-br\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\pl\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\no\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\nl\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\ko\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\ja\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\it\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\HTML\ui.js scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\fr\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\fi\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\es\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\en-gb\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\en\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\el\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\de\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\da\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\cs\cires.dll.mui scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\ci.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\cires.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\GoogleUpdaterAdminPrefs.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\GoogleUpdaterInstallMgr.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\GoogleUpdaterSetup.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\2.4.1368.5602\npCIDetect13.dll scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\GoogleUpdater.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\gis1207423c\GoogleUpdaterService.exe scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile00.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile01.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile02.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile03.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile04.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile05.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile06.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile07.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile08.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile09.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile10.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile11.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile12.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile13.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile14.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile15.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile16.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile17.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile18.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\fwtsqmfile19.sqm scheduled to be deleted on reboot. File delete failed. C:\Windows\temp\VistaSP1_InstallPerf_142855.sqm scheduled to be deleted on reboot. Windows Temp folder emptied: 98979468 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 394.36 mb OTM by OldTimer - Version 3.0.0.2 log created on 06282009_143926 ———————————————————————————————————————————————-
Post #8
dds logs.


DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 23:05:33.37 on Sun 06/28/2009
Internet Explorer: 8.0.6001.18783 BrowserJavaVersion: 1.6.0_13
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1033.18.446.63 [GMT -7:00]

AV: Panda Internet Security 2009 *On-access scanning enabled* (Updated) {4570FB70-5C9E-47E9-B16C-A3A6A06C4BF0}
SP: Panda Internet Security 2009 *enabled* (Updated) {FE6602D3-1E71-4EBB-B4E3-D1C9CBDAF0A1}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FW: Panda Personal Firewall 2009 *enabled* {7B090DC0-8905-4BAF-8040-FD98A41C8FB8}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Panda Security\Panda Internet Security 2009\PskSvc.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\TPSrv.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\PROGRAM FILES\PANDA SECURITY\PANDA INTERNET SECURITY 2009\WebProxy.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost -k Panda
C:\Program Files\Panda Security\Panda Internet Security 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\pavsrvx86.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\AVENGINE.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Panda Security\Panda Internet Security 2009\PsImSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
c:\program files\panda security\panda internet security 2009\firewall\PSHOST.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\s3trayp.exe
C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\PixArt\PAC7311\Monitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\ApVxdWin.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\SRVLOAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Panda Security\Panda Internet Security 2009\PavBckPT.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Matthew\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://qwest.live.com
uWindow Title = Windows Internet Explorer provided by Qwest
uDefault_Page_URL = hxxp://qwest.live.com
mStart Page = hxxp://qwest.live.com
mDefault_Page_URL = hxxp://qwest.live.com
uInternet Settings,ProxyOverride =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [S3Trayp] S3trayp.exe
mRun: [HDAudDeck] c:\program files\via\viaudioi\vistaadeck\HDAudioCPL.exe 1
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [QuickCare2.2] c:\program files\qwest\quickcare\bin\sprtcmd.exe /P QuickCare2.2
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [PAC7311_Monitor] c:\windows\pixart\pac7311\Monitor.exe
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [APVXDWIN] "c:\program files\panda security\panda internet security 2009\APVXDWIN.EXE" /s
mRun: [SCANINICIO] "c:\program files\panda security\panda internet security 2009\Inicio.exe"
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

================= FIREFOX ===================

FF - ProfilePath - c:\users\matthew\appdata\roaming\mozilla\firefox\profiles\hd78q6r9.default\
FF - prefs.js: browser.search.selectedEngine - eBay
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npclntax_ZangoSA.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\matthew\appdata\roaming\mozilla\firefox\profiles\hd78q6r9.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npOberonGameHost.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys [2009-5-14 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2009-5-14 73728]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2009-5-14 52992]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2009-5-14 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2009-5-14 193792]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2009-5-14 158848]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2009-5-14 41144]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2009-5-14 46720]
R2 AmFSM;AmFSM;c:\windows\system32\drivers\amm8660.sys [2009-5-14 49208]
R2 ComFiltr;Panda Anti-Dialer;c:\windows\system32\drivers\COMFiltr.sys [2009-5-14 13880]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2009-5-14 179640]
R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\system32\drivers\fetnd6v.sys [2008-12-4 43520]
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\drivers\neti1634.sys [2009-5-14 197888]
R3 PAC7311;PC VGA Camer@;c:\windows\system32\drivers\PA707UCM.SYS [2007-3-14 449024]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\VTGKModeDX32.sys [2007-3-24 842752]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-6-1 55280]

============== File Associations ===============

JSEFile=c:\progra~1\pandas~1\pandai~1\PAVSCRIP.EXE "%1" %*
VBEFile=c:\progra~1\pandas~1\pandai~1\PAVSCRIP.EXE "%1" %*
VBSFile=c:\progra~1\pandas~1\pandai~1\PAVSCRIP.EXE "%1" %*

=============== Created Last 30 ================

2009-06-28 14:39 –d—– C:\_OTM
2009-06-09 18:21 2,033,152 a——- c:\windows\system32\win32k.sys
2009-06-09 18:21 636,928 a——- c:\windows\system32\localspl.dll
2009-06-01 21:05 –d—– c:\program files\LSI SoftModem
2009-06-01 20:41 55,280 a——- c:\windows\system32\drivers\fssfltr.sys
2009-06-01 20:29 –d—– c:\program files\Windows Live SkyDrive
2009-06-01 20:06 –d—– c:\program files\common files\Windows Live
2009-06-01 19:46 97,800 a——- c:\windows\system32\infocardapi.dll
2009-06-01 19:46 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-01 19:46 622,080 a——- c:\windows\system32\icardagt.exe
2009-06-01 19:46 37,384 a——- c:\windows\system32\infocardcpl.cpl
2009-06-01 19:46 11,264 a——- c:\windows\system32\icardres.dll
2009-06-01 19:46 43,544 a——- c:\windows\system32\PresentationHostProxy.dll
2009-06-01 19:46 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll
2009-06-01 19:46 326,160 a——- c:\windows\system32\PresentationHost.exe
2009-06-01 19:27 96,760 a——- c:\windows\system32\dfshim.dll
2009-06-01 19:27 282,112 a——- c:\windows\system32\mscoree.dll
2009-06-01 19:27 41,984 a——- c:\windows\system32\netfxperf.dll
2009-06-01 19:26 158,720 a——- c:\windows\system32\mscorier.dll
2009-06-01 19:26 83,968 a——- c:\windows\system32\mscories.dll

==================== Find3M ====================

2009-06-28 21:36 217,548 a——- c:\windows\system32\drivers\APPFCONT.DAT.bck
2009-06-28 21:36 217,548 a——- c:\windows\system32\drivers\APPFCONT.DAT
2009-06-28 21:36 1,132 a——- c:\windows\system32\drivers\APPFLTR.CFG.bck
2009-06-28 21:36 1,132 a——- c:\windows\system32\drivers\APPFLTR.CFG
2009-06-01 21:05 51,200 a——- c:\windows\inf\infpub.dat
2009-06-01 21:05 86,016 a——- c:\windows\inf\infstrng.dat
2009-06-01 21:05 86,016 a——- c:\windows\inf\infstor.dat
2009-05-14 17:03 13,880 a——- c:\windows\system32\drivers\COMFiltr.sys
2009-05-08 22:50 915,456 a——- c:\windows\system32\wininet.dll
2009-05-08 22:34 71,680 a——- c:\windows\system32\iesetup.dll
2009-05-01 16:06 921,632 a——- C:\PA7311.DAT
2009-04-23 05:43 784,896 a——- c:\windows\system32\rpcrt4.dll
2008-08-04 08:38 174 a–sh— c:\program files\desktop.ini
2008-08-04 08:11 665,600 a——- c:\windows\inf\drvindex.dat
2006-11-02 05:39 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:39 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:39 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:39 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 23:13:16.61 ===============

Attachments:

Post #9
Please make sure you follow the instructions completely. I still need the GMER log.

Also, we'll do a few more things.

1) JavaRa
Your version of Java is outdated.

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

2) Kaspersky
Please do a scan with the Kaspersky Online Scanner

As you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan. The scan will not work if you do not do this. Please ensure you close your browser after completion.

  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition
    files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a long time, so be patient and let it run. (At times it may appear to stall)
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report

To obtain the report:
  • Click on Save Report As
  • In the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar
  • In Save as type, click the drop arrow and select Text file [*.txt]
  • Click Save

(Note for Internet Explorer users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75%. Once the license has been accepted, reset to 100%.)

3) What You Will Need To Post:
  • GMER log
  • Kaspersky log
Post #10
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-29 12:03:56
Windows 6.0.6001 Service Pack 1


—- Kernel code sections - GMER 1.0.15 —-

PAGE ntkrnlpa.exe!NtOpenProcess 81C54B06 7 Bytes [B8, B0, E7, 6A, 85, FF, E0] {MOV EAX, 0x856ae7b0; JMP EAX}
? C:\Windows\system32\PavTPK.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[620] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\VIA\VIAudioi\VistaADeck\HDAudioCPL.exe[1048] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[1280] ws2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1468] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\AUDIODG.EXE[1716] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2020] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\taskeng.exe[2124] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Windows\Explorer.EXE[2228] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2244] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[2276] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\SearchIndexer.exe[2508] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2696] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Windows\system32\taskeng.exe[2772] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe[3208] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe[3224] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!closesocket 77AD330C 6 Bytes JMP 5F220F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!recv 77AD343A 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!connect 77AD40D9 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!WSASend 77AD4496 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!send 77AD659B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!sendto 77AD67C5 6 Bytes JMP 5F100F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!WSARecv 77AD8400 6 Bytes JMP 5F160F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!recvfrom 77AD8E15 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!WSAConnect 77ADD7B0 6 Bytes JMP 5F130F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!WSARecvFrom 77AE8B38 6 Bytes JMP 5F190F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[3704] WS2_32.dll!WSASendTo 77AEA474 6 Bytes JMP 5F1F0F5A

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs ShlDrv51.sys (PandaShield driver/Panda Security, S.L.)
Device \Driver\Modem \Device\00000061 COMFiltr.sys

AttachedDevice \Driver\tdx \Device\Tcp NETFLTDI.SYS
AttachedDevice \Driver\tdx \Device\Udp NETFLTDI.SYS

—- EOF - GMER 1.0.15 —-
Post #15
It's looking like the PC is pretty clean now, ashlie, but there might be a bit more we can do to speed it up.

The following are optional removals - read my comment on them and decide whether you want to keep them or remove them. You can keep all or remove all - it's up to you.

1) HijackThis
  • Open up Hijack This
  • Click the Do a system scan only button
  • Tick the checkbox next to the items you wish to remove.
  • Ensure all other windows and browsers besides Hijack This are closed, then click Fix Checked

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
QuickTime player starting at startup and sitting in the system tray.

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
RealPlayer checking for updates on startup.

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe Reader loading in the background for 'quicker' launch times.

O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
Microsoft Search Enhancement Pack manager on startup

O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
MySpaceIM loading on startup

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
Windows Media Player loading into the background on startup

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
The Windows Sidebar

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
Windows Welcome Center

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
The Windows Sidebar

O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
MyspaceIM on startup

O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
MyspaceIM on startup

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
Remove this, old Norton remnants.

2) TFC
Please download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should reboot your machine, if not, manually reboot to ensure a complete clean

3) chkdsk
  • Go to Start and type in cmd
  • Right-click on the cmd icon above, and click Run As Administrator
  • Type in chkdsk /R to the command window that appears, and press enter
  • Agree to the prompt, then reboot your system

On reboot, the system will check out the hard drive for bad sectors, and attempt to fix them.

Reboot again after this, then let me know how the PC is going now. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI