What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] My HijackThis Logs

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:23:05 AM, on 7/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\windows\ld12.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\aniServ.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\sysguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe calc.ifo beforemain
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: BHO - {674DE1AA-FACF-47a5-A4CF-9EF05F9A1B2A} - C:\WINDOWS\system32\iehelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\PROGRA~1\softwin\BITDEF~1\bdswitch.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld12.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [LowRiskFileTypes] C:\WINDOWS\sysguard.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Airgo Networks NIC Service (ANISERVICE) - Airgo Networks, Inc. - C:\WINDOWS\System32\aniServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - FirebirdSQL Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

–
End of file - 7084 bytes




I know for a fact I have some virus's. Currently, there is the rouge Antivirus system running "Antivirus System Pro" Also, I keep getting an error report for "svchost.exe" On top of that, my Internet Explorer keeps randomly opening to www.viagra.com and other sites. I need this fixed! :S When I try to System Restore, it doesn't let me.
Post #2
Hi

Please do the following:

Please download OTM by OldTimer.
  • Save it to your desktop.
  • Please click OTM and then click >> run.
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{674DE1AA-FACF-47a5-A4CF-9EF05F9A1B2A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysldtray"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LowRiskFileTypes"=-

:Files
C:\WINDOWS\sysguard.exe
C:\WINDOWS\system32\iehelper.dll
C:\windows\ld12.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



NEXT

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3 last edited
OldTimer: All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{674DE1AA-FACF-47a5-A4CF-9EF05F9A1B2A}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{674DE1AA-FACF-47a5-A4CF-9EF05F9A1B2A}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sysldtray not found. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\LowRiskFileTypes not found. ========== FILES ========== File/Folder C:\WINDOWS\sysguard.exe not found. File/Folder C:\WINDOWS\system32\iehelper.dll not found. File/Folder C:\windows\ld12.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: Admin User: Administrator ->Temporary Internet Files folder emptied: 0 bytes User: Administrator.LAPTOP ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Dad ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 7453697 bytes ->FireFox cache emptied: 43625866 bytes User: Dad_2 User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: Michael ->Temp folder emptied: -1436368501 bytes ->Temporary Internet Files folder emptied: 2404508 bytes ->Java cache emptied: 438445 bytes ->FireFox cache emptied: 43957451 bytes User: Mike ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 10364067 bytes User: NetworkService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2142714 bytes %systemroot%\System32 .tmp files removed: 2577 bytes Windows Temp folder emptied: 37424 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = -1264.45 mb OTM by OldTimer - Version 3.0.0.4 log created on 07072009_154341 Files moved on Reboot… Registry entries deleted on Reboot.. DDS.txt DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 15:50:08.68 on Tue 07/07/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.591 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\KB905474\wgasetup.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\KB905474\wgasetup.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\QuickTime\QTTask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\WINDOWS\System32\aniServ.exe C:\WINDOWS\system32\svchost.exe -k drv C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe C:\WINDOWS\system32\svchost.exe -k HPService C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc svchost C:\WINDOWS\system32\wuauclt.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Michael\My Documents\Downloads\dds.pif ============== Pseudo HJT Report =============== mStart Page = about:blank BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll uRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [BDSwitchAgent] "c:\progra~1\softwin\bitdef~1\bdswitch.exe" mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe" mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE mRun: [LogitechVideo[inspector]] c:\program files\logitech\video\InstallHelper.exe /inspect mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t dRunOnce: [RunNarrator] Narrator.exe dRunOnce: [WUAppSetup] c:\program files\common files\logishrd\WUApp32.exe -v 0x046d -p 0x08c3 -f video -m logitech -d 11.0.0.1217 StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE uPolicies-system: EnableProfileQuota = 1 (0x1) IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL LSP: c:\windows\system32\lsp.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab Notify: AtiExtEvent - Ati2evxx.dll LSA: Authentication Packages = msv1_0 relog_ap ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\michael\applic~1\mozilla\firefox\profiles\mtw4y3mu.default\ FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=&query= FF - prefs.js: browser.search.selectedEngine - Winamp Search FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=&query= FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPAdbESD.dll FF - plugin: c:\program files\mozilla firefox\plugins\npitunes.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R?2 drv;drv;c:\windows\system32\svchost.exe -k drv [2004-8-12 14336] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-12 64160] R1 drvdrv;drvdrv;c:\program files\drv\drv.sys [2009-7-7 9344] R2 ANISERVICE;Airgo Networks NIC Service;c:\windows\system32\aniServ.exe [2004-9-30 143360] R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\firebird\firebird_2_1\bin\fbguard.exe -s defaultinstance –> c:\program files\firebird\firebird_2_1\bin\fbguard.exe -s DefaultInstance [?] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456] R2 srenum;srenum;c:\windows\system32\drivers\srenum.sys [2009-6-29 36480] R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_2_1\bin\fbserver.exe -s defaultinstance –> c:\program files\firebird\firebird_2_1\bin\fbserver.exe -s DefaultInstance [?] R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [2009-6-29 20480] S3 DXE201;Dynex DX-E201 CardBus PC Card;c:\windows\system32\drivers\DXE201.SYS [2007-4-26 25434] S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-1-1 24652] =============== Created Last 30 ================ 2009-07-07 15:49 –d-h— c:\windows\PIF 2009-07-07 15:43 –d—– C:\_OTM 2009-07-07 05:15 54,156 a—h— c:\windows\QTFont.qfn 2009-07-07 05:15 1,409 a——- c:\windows\QTFont.for 2009-07-07 03:09 2 a——- c:\windows\0101120101465752.dat 2009-07-07 02:40 –d—– c:\docume~1\michael\applic~1\Malwarebytes 2009-07-07 02:10 –d—– c:\program files\Trend Micro 2009-07-07 02:10 180,224 a——- c:\windows\system32\lsp.dll 2009-07-07 00:36 –d—– c:\program files\drv 2009-07-07 00:36 2 a——- c:\windows\0101120101464849.dat 2009-07-07 00:36 1 a——- c:\windows\934fdfg34fgjf23 2009-07-07 00:36 2 a——- c:\windows\010112010146118114.dat 2009-07-06 23:17 –d—– c:\windows\EasyBind 2009-07-05 01:13 –d—– c:\windows\system32\wbem\Repository 2009-07-04 18:44 –d—– c:\program files\ESET 2009-07-04 04:41 –d—– c:\docume~1\michael\applic~1\mIRC 2009-07-04 04:41 –d—– c:\program files\mIRC(2) 2009-07-03 23:19 –d—– c:\program files\common files\Insight Software Solutions 2009-07-03 23:18 –d—– c:\program files\ShortKeys2 2009-06-30 17:37 –d—– c:\windows\system32\XPSViewer 2009-06-30 17:36 14,048 ——– c:\windows\system32\spmsg2.dll 2009-06-29 15:42 36,480 a——- c:\windows\system32\drivers\srenum.sys 2009-06-29 15:41 20,480 a——- c:\windows\system32\drivers\ndisrd.sys 2009-06-29 13:38 –d—– c:\program files\SpacialAudio 2009-06-29 13:38 442,368 a——- c:\windows\system32\GDS32.DLL 2009-06-29 13:37 458,752 a——- c:\windows\system32\Firebird2Control.cpl 2009-06-29 13:37 548,864 a——- c:\windows\system32\msvcp80.dll 2009-06-29 13:37 626,688 a——- c:\windows\system32\msvcr80.dll 2009-06-29 13:37 –d—– c:\program files\Firebird 2009-06-29 01:44 –d—– c:\program files\common files\DVDVideoSoft 2009-06-29 01:44 –d—– c:\program files\DVDVideoSoft 2009-06-26 15:58 –d—– c:\docume~1\michael\applic~1\TeamViewer 2009-06-26 15:58 –d—– c:\program files\TeamViewer 2009-06-26 15:56 –d—– c:\documents and settings\michael\temp 2009-06-12 17:07 15,688 a——- c:\windows\system32\lsdelete.exe 2009-06-12 16:54 64,160 a——- c:\windows\system32\drivers\Lbd.sys 2009-06-12 16:51 -cd-h— c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-06-12 16:49 –d—– c:\program files\Lavasoft 2009-06-12 02:27 –d—– c:\program files\Microsoft CAPICOM 2.1.0.2 2009-06-12 00:05 268,648 a——- c:\windows\system32\mucltui.dll 2009-06-12 00:05 208,744 a——- c:\windows\system32\muweb.dll 2009-06-12 00:05 27,496 a——- c:\windows\system32\mucltui.dll.mui 2009-06-11 22:39 –d—– c:\windows\system32\Adobe 2009-06-11 21:05 –d—– c:\documents and settings\michael\Tracing 2009-06-11 21:03 –d—– c:\program files\Microsoft 2009-06-11 21:03 –d—– c:\program files\Windows Live SkyDrive 2009-06-11 20:59 –d—– c:\program files\common files\Windows Live ==================== Find3M ==================== 2009-07-06 22:52 81,984 ac—— c:\windows\system32\bdod.bin 2009-07-04 00:26 0 a——- c:\windows\system32\drivers\lvuvc.hs 2009-06-03 14:25 26,624 a–sh— c:\documents and settings\michael\protect(2).dll 2009-05-07 11:44 344,064 a——- c:\windows\system32\localspl.dll 2009-04-29 00:56 827,392 a——- c:\windows\system32\wininet.dll 2009-04-29 00:55 78,336 a——- c:\windows\system32\ieencode.dll 2009-04-17 05:58 1,846,656 a——- c:\windows\system32\win32k.sys 2009-04-16 11:03 131,413 a——- c:\windows\hpwins22.dat 2009-04-15 11:26 583,168 a——- c:\windows\system32\rpcrt4.dll 2009-02-27 19:48 34 a——- c:\documents and settings\michael\jagex_runescape_preferences.dat 2006-08-15 18:14 461 ac—— c:\program files\INSTALL.LOG ============= FINISH: 15:50:39.79 =============== Attach.txt UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 8/15/2006 1:07:21 PM System Uptime: 7/7/2009 3:44:58 PM (0 hours ago) Motherboard: Dell Inc. | | 0K5547 Processor: Intel® Pentium® M processor 1.86GHz | Microprocessor | 1862/133mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 20 GiB total, 4.023 GiB free. D: is FIXED (NTFS) - 36 GiB total, 32.069 GiB free. E: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {4D36E974-E325-11CE-BFC1-08002BE10318} Description: Ethernet Controller Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01881028&REV_02\4&2FA23535&0&00F0 Manufacturer: Name: Ethernet Controller PNP Device ID: PCI\VEN_14E4&DEV_170C&SUBSYS_01881028&REV_02\4&2FA23535&0&00F0 Service: Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Intel® PRO/Wireless 2200BG Network Connection Device ID: PCI\VEN_8086&DEV_4220&SUBSYS_27218086&REV_05\4&2FA23535&0&18F0 Manufacturer: Intel Corporation Name: Intel® PRO/Wireless 2200BG Network Connection PNP Device ID: PCI\VEN_8086&DEV_4220&SUBSYS_27218086&REV_05\4&2FA23535&0&18F0 Service: w29n51 Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F} Description: Officejet Pro 8500 A909a Device ID: ROOT\IMAGE\0000 Manufacturer: HP Name: 8500 A909a,192.168.19.96 PNP Device ID: ROOT\IMAGE\0000 Service: StillCam Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318} Description: Officejet Pro 8500 A909a Device ID: ROOT\MULTIFUNCTION\0000 Manufacturer: HP Name: Officejet Pro 8500 A909a PNP Device ID: ROOT\MULTIFUNCTION\0000 Service: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318} Description: Officejet Pro 8500 A909a Device ID: ROOT\PRINTER\0000 Manufacturer: HP Name: Officejet Pro 8500 A909a PNP Device ID: ROOT\PRINTER\0000 Service: ==== System Restore Points =================== RP943: 6/30/2009 5:36:54 PM - Installed %1 %2. RP944: 6/30/2009 5:37:04 PM - Printer Driver Microsoft XPS Document Writer Installed RP945: 7/2/2009 3:00:20 AM - Software Distribution Service 3.0 RP946: 7/2/2009 11:28:57 AM - Software Distribution Service 3.0 RP947: 7/3/2009 12:00:34 PM - System Checkpoint RP948: 7/3/2009 11:18:32 PM - ShortKeys 2 RP949: 7/3/2009 11:19:26 PM - ShortKeys 2 RP950: 7/3/2009 11:18:58 PM - ShortKeys 2 RP951: 7/4/2009 6:44:20 PM - Installed ESET NOD32 Antivirus RP952: 7/5/2009 1:06:07 AM - Restore Operation RP953: 7/5/2009 1:18:27 AM - Software Distribution Service 3.0 RP954: 7/6/2009 1:41:58 PM - Software Distribution Service 3.0 RP955: 7/6/2009 10:52:21 PM - Removed BitDefender 9 Standard RP956: 7/6/2009 11:02:41 PM - Removed Windows Defender RP957: 7/7/2009 12:21:17 AM - ShortKeys 2 RP958: 7/7/2009 12:21:29 AM - ShortKeys 2 RP959: 7/7/2009 12:49:16 AM - Installed ESET NOD32 Antivirus RP960: 7/7/2009 1:40:21 AM - Restore Operation RP961: 7/7/2009 1:48:27 AM - Restore Operation RP962: 7/7/2009 1:55:33 AM - Restore Operation RP963: 7/7/2009 3:37:27 AM - Software Distribution Service 3.0 RP964: 7/7/2009 3:48:08 AM - Restore Operation RP965: 7/7/2009 4:14:38 AM - Installed Windows XP KB927891. RP966: 7/7/2009 4:25:15 AM - Software Distribution Service 3.0 RP967: 7/7/2009 5:03:59 AM - Software Distribution Service 3.0 RP968: 7/7/2009 5:31:49 AM - Restore Operation RP969: 7/7/2009 5:58:58 AM - Removed ESET NOD32 Antivirus RP970: 7/7/2009 6:14:18 AM - Restore Operation ==== Installed Programs ====================== 32 Bit HP CIO Components Installer 8500A909_BasicWeb 8500A909_Help_BasicWeb Acronis True Image Home Ad-Aware Adobe Bridge 1.0 Adobe Common File Installer Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Help Center 1.0 Adobe Photoshop CS2 Adobe Reader 7.0.8 Adobe Shockwave Player 11.5 Adobe Stock Photos 1.0 Airgo Subsystem Software ALPS Touch Pad Driver Apple Software Update ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver AudioAdvantageMicro B44Inst Belkin Wireless Client Utility bpd_scan BPDSoftware_Ini Broadcom 440x Driver Installer C-Major Audio Choice Guard ClearType Tuning Control Panel Applet Critical Update for Windows Media Player 11 (KB959772) Firebird 2.1.0.16780 (Win32) Free YouTube to Mp3 Converter version 3.1 Google Earth HijackThis 2.0.2 Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB896344) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB952287) HP Officejet Pro 8500 A909 Series iTunes J2SE Runtime Environment 5.0 Update 6 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 1 Microsoft .NET Framework 3.5 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft IntelliPoint 6.1 Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2000 Premium Microsoft Office FrontPage 2003 Mozilla Firefox (3.5) MSVCRT MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 6 Service Pack 2 (KB954459) Network PowerDVD 5.3 QuickTime SAM Broadcaster (remove only) Scan Security Update for CAPICOM (KB931906) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913433) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB970238) Segoe UI SHOUTcast Source DSP 1.9.1 (remove only) TeamViewer 4 Toolbox Tweak UI Uninstall 1.0.0.1 Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB925720) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB932823-v3) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB955839) Update for Windows XP (KB961503) Update for Windows XP (KB967715) Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 WebFldrs XP WebReg Winamp (remove only) Windows Defender Signatures Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Messenger Windows Live OneCare safety scanner Windows Live Sign-in Assistant Windows Live Upload Tool Windows Media Connect Windows Media Format 11 runtime Windows Media Format SDK Hotfix - KB891122 Windows Media Player 11 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 WinRAR archiver XML Paper Specification Shared Components Pack 1.0 Yahoo! Toolbar ==== Event Viewer Messages From Past Week ======== 7/7/2009 5:17:29 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Firebird Server - DefaultInstance service to connect. 7/7/2009 5:17:29 AM, error: Service Control Manager [7000] - The Firebird Server - DefaultInstance service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 7/7/2009 5:07:39 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x800706be: Windows XP Service Pack 3 (KB936929). 7/7/2009 5:06:20 AM, error: Service Control Manager [7031] - The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine. 7/7/2009 5:06:12 AM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 5:06:12 AM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 5:06:12 AM, error: Service Control Manager [7031] - The Universal Plug and Play Device Host service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service. 7/7/2009 5:06:12 AM, error: Service Control Manager [7031] - The Remote Registry service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service. 7/7/2009 3:43:48 PM, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:43:48 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:43:48 PM, error: Service Control Manager [7034] - The Firebird Server - DefaultInstance service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:43:48 PM, error: Service Control Manager [7031] - The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. 7/7/2009 3:43:48 PM, error: Service Control Manager [7031] - The Lavasoft Ad-Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. 7/7/2009 3:43:47 PM, error: Service Control Manager [7034] - The Firebird Guardian - DefaultInstance service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:43:47 PM, error: Service Control Manager [7034] - The Airgo Networks NIC Service service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:43:47 PM, error: Service Control Manager [7034] - The Acronis Scheduler2 Service service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:43:41 PM, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:39:14 AM, error: Service Control Manager [7034] - The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:39:11 AM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:38:57 AM, error: Service Control Manager [7034] - The WebClient service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:38:47 AM, error: Service Control Manager [7034] - The HTTP SSL service terminated unexpectedly. It has done this 1 time(s). 7/7/2009 3:31:38 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde 7/7/2009 12:51:16 AM, error: Service Control Manager [7031] - The drv service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 7/7/2009 1:48:51 AM, error: HTTP [15005] - Unable to bind to the underlying transport for 0.0.0.0:2869. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number. 7/7/2009 1:40:04 AM, error: Service Control Manager [7022] - The drv service hung on starting. 7/7/2009 1:38:38 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service. 7/6/2009 3:57:01 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code. 7/6/2009 12:56:32 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error message: The referenced assembly is not installed on your system. . 7/6/2009 12:56:32 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_decbdf0c\MFC80.DLL. Reference error message: The operation completed successfully. . 7/6/2009 12:56:32 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error was The referenced assembly is not installed on your system. 7/5/2009 1:14:45 AM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The authentication service is unknown. 7/5/2009 1:14:45 AM, error: Service Control Manager [7002] - The Routing and Remote Access service depends on the NetBIOSGroup group and no member of this group started. 7/5/2009 1:14:35 AM, error: WinDefend [2004] - 7/4/2009 7:17:53 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 7/4/2009 7:17:46 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect. 7/4/2009 10:56:59 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the VSSERV service. 7/4/2009 1:32:51 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 7/4/2009 1:32:48 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect. 7/3/2009 4:40:29 PM, error: PSched [14103] - QoS [Adapter {CDA663CB-82E0-4EE6-B6B7-0FE8BCEDADE8}]: The netcard driver failed the query for OID_GEN_LINK_SPEED. ==== End Of File =========================== Gmer.txt is attached to post

Attachments:

Post #4
Hi,

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #5 last edited
ComboFix:

ComboFix 09-07-07.A2 - Michael 07/07/2009 17:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.544 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\recycler\S-1-5-21-1177238915-583907252-839522115-1009
c:\windows\010112010146118114.dat
c:\windows\0101120101464849.dat
c:\windows\0101120101465752.dat
c:\windows\Installer\1fc622d.msi
c:\windows\Installer\1fc622e.msp
c:\windows\Installer\1fc622f.msp
c:\windows\Installer\1fc6230.msp
c:\windows\Installer\1fc6231.msp
c:\windows\Installer\1fc6232.msp
c:\windows\Installer\1fc6233.msp
c:\windows\Installer\1fc6234.msp
c:\windows\Installer\1fc6235.msp
c:\windows\Installer\1fc6236.msp
c:\windows\Installer\4b6c55.msp
c:\windows\Installer\4b6c56.msp
c:\windows\Installer\4b6c57.msp
c:\windows\Installer\4b6c58.msp
c:\windows\Installer\4b6c59.msp
c:\windows\Installer\4b6c5a.msp
c:\windows\Installer\4b6c5b.msp
c:\windows\Installer\4b6c5c.msp
c:\windows\Installer\4b6c5d.msp
c:\windows\system32\lsp.dll
c:\windows\system32\wbem\proquota.exe

c:\windows\system32\proquota.exe was missing
Restored copy from - c:\system volume information\_restore{5DB85C2D-2FB7-441F-A96D-F8BFD51D2988}\RP958\A0166329.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_DRV
——-\Service_drv


((((((((((((((((((((((((( Files Created from 2009-06-07 to 2009-07-07 )))))))))))))))))))))))))))))))
.

2009-07-07 21:21 . 2004-08-12 13:26 50176 -c–a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-07 21:21 . 2004-08-12 13:26 50176 —-a-w- c:\windows\system32\proquota.exe
2009-07-07 19:49 . 2009-07-07 19:49 ——– d–h–w- c:\windows\PIF
2009-07-07 19:43 . 2009-07-07 19:43 ——– d—–w- C:\_OTM
2009-07-07 06:40 . 2009-07-07 06:40 ——– d—–w- c:\documents and settings\Michael\Application Data\Malwarebytes
2009-07-07 06:10 . 2009-07-07 06:10 ——– d—–w- c:\program files\Trend Micro
2009-07-07 04:36 . 2009-07-07 04:36 ——– d—–w- c:\program files\drv
2009-07-07 03:59 . 2009-07-07 03:59 ——– d—–w- c:\documents and settings\Michael\Application Data\AdobeUM
2009-07-07 03:28 . 2009-07-07 03:29 ——– d—–w- c:\program files\Windows Live Safety Center
2009-07-07 03:17 . 2008-01-27 04:35 ——– d—–w- c:\windows\EasyBind
2009-07-05 05:13 . 2009-07-05 05:13 ——– d—–w- c:\windows\system32\wbem\Repository
2009-07-05 00:49 . 2009-07-05 00:49 ——– d—–w- c:\documents and settings\Michael\Local Settings\Application Data\ESET
2009-07-04 22:44 . 2009-07-04 22:44 ——– d—–w- c:\program files\ESET
2009-07-04 22:44 . 2009-07-04 22:44 ——– d—–w- c:\documents and settings\All Users\Application Data\ESET
2009-07-04 08:41 . 2009-07-05 05:12 ——– d—–w- c:\documents and settings\Michael\Application Data\mIRC
2009-07-04 08:41 . 2009-07-05 05:12 ——– d—–w- c:\program files\mIRC(2)
2009-07-04 03:19 . 2009-07-05 05:12 ——– d—–w- c:\program files\Common Files\Insight Software Solutions
2009-07-04 03:18 . 2009-07-05 05:12 ——– d—–w- c:\program files\ShortKeys2
2009-06-30 21:39 . 2009-06-30 21:39 77968 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-30 21:37 . 2009-06-30 21:37 ——– d—–w- c:\program files\MSBuild
2009-06-30 21:37 . 2009-06-30 21:37 ——– d—–w- c:\windows\system32\XPSViewer
2009-06-30 21:37 . 2009-06-30 21:37 ——– d—–w- c:\program files\Reference Assemblies
2009-06-30 21:36 . 2006-06-29 17:07 14048 ——w- c:\windows\system32\spmsg2.dll
2009-06-29 19:42 . 2009-06-30 18:27 36480 —-a-w- c:\windows\system32\drivers\srenum.sys
2009-06-29 19:41 . 2009-06-29 19:41 20480 —-a-w- c:\windows\system32\drivers\ndisrd.sys
2009-06-29 17:38 . 2009-06-29 17:55 ——– d—–w- c:\program files\SpacialAudio
2009-06-29 17:38 . 2007-10-16 14:07 442368 —-a-w- c:\windows\system32\GDS32.DLL
2009-06-29 17:37 . 2005-09-23 04:05 548864 —-a-w- c:\windows\system32\msvcp80.dll
2009-06-29 17:37 . 2005-09-23 04:05 626688 —-a-w- c:\windows\system32\msvcr80.dll
2009-06-29 17:37 . 2009-06-29 17:37 ——– d—–w- c:\program files\Firebird
2009-06-29 05:44 . 2009-06-29 05:44 ——– d—–w- c:\program files\Common Files\DVDVideoSoft
2009-06-29 05:44 . 2009-06-29 05:44 ——– d—–w- c:\program files\DVDVideoSoft
2009-06-26 19:58 . 2009-06-29 17:29 ——– d—–w- c:\documents and settings\Michael\Application Data\TeamViewer
2009-06-26 19:58 . 2009-06-26 19:58 ——– d—–w- c:\program files\TeamViewer
2009-06-26 19:56 . 2009-06-26 19:56 ——– d—–w- c:\documents and settings\Michael\temp
2009-06-23 04:51 . 2009-06-23 04:51 ——– d—–w- c:\program files\Common Files\logishrd
2009-06-12 21:07 . 2009-06-12 20:53 15688 —-a-w- c:\windows\system32\lsdelete.exe
2009-06-12 20:54 . 2009-06-12 20:53 64160 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-12 20:53 . 2009-06-12 20:53 15688 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-06-12 20:53 . 2009-06-29 20:54 84832 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-06-12 20:53 . 2009-06-29 20:54 246128 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-06-12 20:53 . 2009-06-29 20:54 40288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-06-12 20:53 . 2009-06-12 20:53 64160 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-06-12 20:51 . 2009-06-12 20:51 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-12 20:51 . 2009-03-12 08:17 2902048 -c–a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-06-12 20:49 . 2009-06-12 20:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-06-12 20:49 . 2009-06-12 20:49 ——– d—–w- c:\program files\Lavasoft
2009-06-12 06:27 . 2009-06-12 06:27 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-06-12 04:05 . 2008-10-16 18:06 268648 —-a-w- c:\windows\system32\mucltui.dll
2009-06-12 04:05 . 2008-10-16 18:06 208744 —-a-w- c:\windows\system32\muweb.dll
2009-06-12 02:39 . 2009-06-12 20:45 ——– d—–w- c:\windows\system32\Adobe
2009-06-12 01:05 . 2009-07-07 21:23 ——– d—–w- c:\documents and settings\Michael\Tracing
2009-06-12 01:03 . 2009-06-12 01:03 ——– d—–w- c:\program files\Microsoft
2009-06-12 01:03 . 2009-06-12 01:03 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-06-12 01:02 . 2009-06-12 01:03 ——– d—–w- c:\program files\Windows Live
2009-06-12 00:59 . 2009-06-12 00:59 ——– d—–w- c:\program files\Common Files\Windows Live
2009-06-11 23:22 . 2009-06-11 23:22 ——– d—–w- c:\documents and settings\Michael\Local Settings\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-07 02:52 . 2006-08-15 22:04 ——– d—–w- c:\program files\Common Files\Softwin
2009-07-07 02:52 . 2006-08-15 22:17 81984 -c–a-w- c:\windows\system32\bdod.bin
2009-07-04 04:26 . 2006-12-29 15:37 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2009-07-01 15:16 . 2008-07-30 19:27 20240 —-a-w- c:\documents and settings\Michael\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 05:53 . 2007-06-28 23:15 ——– d—–w- c:\program files\Winamp
2009-06-14 06:12 . 2006-09-18 02:12 ——– d—–w- c:\program files\Microsoft Works
2009-06-03 18:25 . 2009-06-03 18:25 26624 –sha-w- c:\documents and settings\Michael\protect(2).dll
2009-06-03 01:40 . 2009-06-03 01:40 ——– d—–w- c:\documents and settings\Mike\Application Data\Malwarebytes
2009-06-03 01:40 . 2009-06-03 01:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 01:24 . 2009-06-03 01:24 19656 —-a-w- c:\documents and settings\Mike\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 22:17 . 2009-02-21 21:45 ——– d—–w- c:\documents and settings\Michael\Application Data\Apple Computer
2009-05-07 15:44 . 2004-08-12 13:21 344064 —-a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-12 13:33 827392 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-12 13:19 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-17 09:58 . 2004-08-12 13:33 1846656 —-a-w- c:\windows\system32\win32k.sys
2009-04-16 15:03 . 2009-04-16 14:55 131413 —-a-w- c:\windows\hpwins22.dat
2009-04-15 15:26 . 2004-08-12 13:27 583168 —-a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-12 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-11-22 842584]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2006-06-30 1106386]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2006-06-29 1848150]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-06-29 126976]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-31 271672]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-29 520024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-05-11 441120]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2006-10-04 53760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"MDM"=2 (0x2)
"Zetera"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"usnjsvc"=3 (0x3)
"seclogon"=2 (0x2)
"SCardSvr"=3 (0x3)
"lanmanserver"=2 (0x2)
"Brother XP spl Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\SpacialAudio\\SAMBC\\SAMBC.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"= 8085:TCP:drv

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/12/2009 4:54 PM 64160]
R1 drvdrv;drvdrv;c:\program files\drv\drv.sys [7/7/2009 12:36 AM 9344]
R2 ANISERVICE;Airgo Networks NIC Service;c:\windows\system32\aniServ.exe [9/30/2004 1:16 PM 143360]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe -s DefaultInstance –> c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe -s DefaultInstance [?]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1029456]
R2 srenum;srenum;c:\windows\system32\drivers\srenum.sys [6/29/2009 3:42 PM 36480]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe -s DefaultInstance –> c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe -s DefaultInstance [?]
R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [6/29/2009 3:41 PM 20480]
S3 DXE201;Dynex DX-E201 CardBus PC Card;c:\windows\system32\drivers\DXE201.SYS [4/26/2007 10:45 PM 25434]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/1/2008 6:49 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
drv REG_MULTI_SZ drv
.
Contents of the 'Scheduled Tasks' folder

2009-07-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 20:54]

2009-07-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-07-25 17:15]

2009-07-07 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 02:18]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-BDSwitchAgent - c:\progra~1\softwin\BITDEF~1\bdswitch.exe
HKLM-Run-LVCOMSX - c:\windows\system32\LVCOMSX.EXE
HKLM-Run-LogitechVideo[inspector] - c:\program files\Logitech\Video\InstallHelper.exe


.
——- Supplementary Scan ——-
.
mStart Page = about:blank
FF - ProfilePath - c:\documents and settings\Michael\Application Data\Mozilla\Firefox\Profiles\mtw4y3mu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=&query=
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-07 17:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1177238915-583907252-839522115-1008\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4A79485E-6BD4-DE11-993D-7AEAE33BEC4B}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iajmidpoekpgffjeij"=hex:6a,61,6e,66,65,66,6e,6c,65,65,67,6d,68,67,64,6a,6b,6e,
6e,65,00,00
"hahmcgnhlhdfkoco"=hex:69,61,6a,66,66,68,70,70,68,65,6a,6f,63,64,62,6a,6f,6a,
00,00
"ianlpgnbganjokmbbo"=hex:63,61,70,66,68,67,00,7c
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1004)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1064)
c:\windows\system32\relog_ap.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Firebird\Firebird_2_1\bin\fbguard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Firebird\Firebird_2_1\bin\fbserver.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\Apoint\hidfind.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-07-07 17:26 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-07 21:26

Pre-Run: 4,199,333,888 bytes free
Post-Run: 5,656,444,928 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

327
Post #6
Hi,

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/My_HijackThis_Logs_t104879.html&view=findpost&p=575652#entry575652

Collect::
c:\documents and settings\Michael\protect(2).dll
c:\program files\drv\drv.sys

KillAll::

File::
c:\windows\system32\drivers\lvuvc.hs

Folder::
c:\program files\drv

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
"drv"=-

Driver::
drvdrv

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.


NEXT

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\system32\drivers\srenum.sys

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.



Note: Please don't put your logs in quote boxes - thanks B)
Post #7
Do you still need help with your machine? Are the instructions unclear or are you experiencing other issues, please advise.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI