Spyware / Malware / Virus Removal

[Closed] Virus? Cannot load Facebook, now Firefox unresponsive, s

13 min read

Looking for the outcome? Ask AI

orun11 Topic Starter

Post #1July 13, 2009, 2:59 AM UTC

Thank you for your time! I always have AVG running and suddenly ran into website popups
proclaiming I had a virus. I kept closing these windows (eventually closing firefox to do so)
not thinking anything of it. Eventually I was unable to load certain websites like the front
page of Facebook. I tried cleaning with AVG and Ad-Aware. Eventually I tried uninstalling
and reinstalling Firefox, now I can't even load the program. (Ad-Aware had a tough time
loading when I first downloaded it also). Then I tried a restore point change, and that took
at least three tries before the dialog would even come up (after several restarts). I'm
clueless now. Explorer acts slow and buggy, Firefox doesnt start, and I'm concerned.

Thanks!!

=========================================

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:45:36 PM, on 7/12/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.myspace.com/gameshell/games/c…ader_v10_en.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 8549 bytes

Tomk

Post #2July 16, 2009, 4:13 PM UTC

Hi orun11,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

orun11

Post #3July 17, 2009, 11:22 AM UTC

Thank you for your help!

Below are the two logs I have after running TFT, Malwarebytes, and another Hijackthis run.

Firefox still does not load, winamp errors without loading, and although it
works and may be just be my perceptions from not using it as often, but IE
seems a little weird- gmail didnt want to load normally during this time.

Thanks again for your help! I hope you can see any problems i have.

============
MBAM LOG
===========
Malwarebytes' Anti-Malware 1.39
Database version: 2450
Windows 6.0.6002 Service Pack 2

7/17/2009 6:05:33 AM
mbam-log-2009-07-17 (06-05-33).txt

Scan type: Quick Scan
Objects scanned: 81301
Time elapsed: 7 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

———————————-
SECOND HIJACKTHIS LOG:
———————
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:15:25 AM, on 7/17/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.myspace.com/gameshell/games/c…ader_v10_en.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 8269 bytes

Tomk

Post #4July 17, 2009, 5:06 PM UTC

orun11,

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
  O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://games.myspace.com/gameshell/games/c…ader_v10_en.cab
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Download Rooter.exe to your desktop

Then doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

orun11

Post #5July 19, 2009, 2:26 PM UTC

Much thanks again! Here are the two logs… =========== Rooter log ============ Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully … . Windows Vista Home Edition (6.0.6002) Service Pack 2 [32_bits] - x86 Family 15 Model 75 Stepping 2, AuthenticAMD . [wscsvc] (Security Center) RUNNING (state:4) [MpsSvc] RUNNING (state:4) Windows Firewall -> Enabled Windows Defender -> Enabled User Account Control (UAC) -> Enabled . Internet Explorer 8.0.6001.18783 Mozilla Firefox 3.0.11 (en-US) . C:\ [Fixed-NTFS] .. ( Total:226 Go - Free:3 Go ) D:\ [Fixed-NTFS] .. ( Total:6 Go - Free:0 Go ) E:\ [CD_Rom] F:\ [Removable] G:\ [Removable] H:\ [Removable] I:\ [Removable] J:\ [CD_Rom] L:\ [Fixed-FAT32] .. ( Total:465 Go - Free:190 Go ) . Scan : 08:41.52 Path : C:\Users\QUIZZY\Desktop\Rooter.exe User : QUIZZY ( Administrator -> YES ) . ———————-\\ Processes . Locked [System Process] (0) Locked System (4) ______ \SystemRoot\System32\smss.exe (492) ______ C:\Windows\system32\csrss.exe (648) ______ C:\Windows\system32\wininit.exe (700) ______ C:\Windows\system32\csrss.exe (712) ______ C:\Windows\system32\winlogon.exe (812) ______ C:\Windows\system32\services.exe (852) ______ C:\Windows\system32\lsass.exe (864) ______ C:\Windows\system32\lsm.exe (880) ______ C:\Windows\system32\svchost.exe (1316) ______ C:\Windows\system32\nvvsvc.exe (1360) ______ C:\Windows\system32\svchost.exe (1392) ______ C:\Windows\System32\svchost.exe (1432) ______ C:\Windows\System32\svchost.exe (1528) ______ C:\Windows\System32\svchost.exe (1552) ______ C:\Windows\system32\svchost.exe (1584) Locked audiodg.exe (1664) ______ C:\Windows\system32\svchost.exe (1680) ______ C:\Windows\system32\SLsvc.exe (1700) ______ C:\Windows\system32\svchost.exe (1804) ______ C:\Windows\system32\svchost.exe (1932) ______ C:\Windows\system32\rundll32.exe (420) ______ C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (524) ______ C:\Windows\System32\spoolsv.exe (484) ______ C:\Windows\system32\svchost.exe (1004) ______ C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (1648) ______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (1812) ______ C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (1860) ______ C:\Program Files\Bonjour\mDNSResponder.exe (1884) ______ C:\Windows\system32\svchost.exe (652) ______ C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (1028) ______ C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (2060) ______ C:\Windows\system32\svchost.exe (2072) ______ C:\Windows\System32\svchost.exe (2104) ______ C:\Windows\system32\SearchIndexer.exe (2144) ______ C:\PROGRA~1\AVG\AVG8\avgrsx.exe (2248) ______ C:\PROGRA~1\AVG\AVG8\avgnsx.exe (2256) ______ C:\Windows\system32\DRIVERS\xaudio.exe (2316) ______ C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (2388) ______ C:\PROGRA~1\AVG\AVG8\avgemc.exe (2476) ______ C:\Program Files\AVG\AVG8\avgcsrvx.exe (2584) ______ C:\Windows\system32\Dwm.exe (3036) ______ C:\Windows\system32\taskeng.exe (3044) ______ C:\Windows\Explorer.EXE (3108) ______ C:\Program Files\Windows Defender\MSASCui.exe (3464) ______ C:\hp\support\hpsysdrv.exe (3476) ______ C:\Windows\RtHDVCpl.exe (3628) ______ C:\Program Files\Java\jre6\bin\jusched.exe (3728) ______ C:\Program Files\AVG\AVG8\avgtray.exe (3752) ______ C:\Windows\ehome\ehtray.exe (3788) ______ C:\Program Files\Registry Mechanic\RMTray.exe (3904) ______ C:\Windows\system32\wbem\unsecapp.exe (3956) ______ C:\Windows\system32\wbem\wmiprvse.exe (3988) ______ C:\Windows\ehome\ehmsas.exe (4092) ______ C:\Windows\system32\taskeng.exe (2828) ______ C:\Program Files\Windows Media Player\wmpnetwk.exe (724) ______ C:\Windows\system32\SearchProtocolHost.exe (3348) ______ C:\Windows\system32\SearchFilterHost.exe (780) ______ C:\Windows\system32\SearchProtocolHost.exe (1624) ______ C:\Users\QUIZZY\Desktop\Rooter.exe (2644) . ———————-\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:32256 | Length:243336651264) \Device\Harddisk0\Partition2 (Start_Offset:243336683520 | Length:6719569920) . ———————-\\ Scheduled Tasks . C:\Windows\Tasks\HPCeeScheduleForQUIZZY.job C:\Windows\Tasks\SA.DAT C:\Windows\Tasks\SCHEDLGU.TXT C:\Windows\Tasks\User_Feed_Synchronization-{CAFAE5D6-F71B-4BCF-B9B7-6BE1D7A8BBFD}.job . ———————-\\ Registry . . ———————-\\ Files & Folders . . ———————-\\ Scan completed at 08:42.56 . C:\Rooter$\Rooter_1.txt - (18/07/2009 | 08:42.56).c ================= Kasperksy log ================ ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Sunday, July 19, 2009 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Saturday, July 18, 2009 16:01:13 Records in database: 2488957 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ L:\ Scan statistics: Files scanned: 326388 Threat name: 2 Infected objects: 2 Suspicious objects: 0 Duration of the scan: 13:15:18 File name / Threat name / Threats count C:\Users\QUIZZY\Desktop\FIlters\Plugins\Plugins.v1.exe Infected: Trojan.Win32.Genome.pzn 1 C:\Users\QUIZZY\Desktop\freeripmp3.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.br 1 The selected area was scanned.

Tomk

Post #6July 20, 2009, 3:05 AM UTC

Please download the OTM by OldTimer.

Save it to your desktop.
Please double-click OTM.exe to run it.
(Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Files
C:\Users\QUIZZY\Desktop\FIlters\Plugins\Plugins.v1.exe
C:\Users\QUIZZY\Desktop\freeripmp3.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Let me know if you notice any difference.

orun11

Post #7July 23, 2009, 5:04 PM UTC

Winamp crashes upon starting, firefox still does not load. Small price to pay for saving my system though!

Here is the log… thank you so much for your time and sorry it took me a couple days to get back here! ————————————– All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== FILES ========== C:\Users\QUIZZY\Desktop\FIlters\Plugins\Plugins.v1.exe moved successfully. C:\Users\QUIZZY\Desktop\freeripmp3.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Incomplete User: no User: Public User: QUIZZY File delete failed. C:\Users\QUIZZY\AppData\Local\Temp\[Torrentsworld.net] - Captain America 600 (2009) (both covers) (Minutemen TipsyGirl DCP)[h33t][.torrent scheduled to be deleted on reboot. ->Temp folder emptied: 74895651 bytes ->Temporary Internet Files folder emptied: 15806263 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 715282 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 914408 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 88.05 mb OTM by OldTimer - Version 3.0.0.5 log created on 07232009_114703 Files moved on Reboot… File C:\Users\QUIZZY\AppData\Local\Temp\[Torrentsworld.net] - Captain America 600 (2009) (both covers) (Minutemen TipsyGirl DCP)[h33t][.torrent not found! Registry entries deleted on Reboot…

Tomk

Post #8July 23, 2009, 5:13 PM UTC

orun11,

Nothing we've found so far would cause the problems your describing. Let's get some deeper scans.

Please download gmer.zip from Gmer and save it to your desktop.

Right click on gmer.zip and select Extract All….
Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
Click on the Browse button. Click on Desktop. Then click OK.
Click Next. It will start extracting.
Once done, check (tick) the Show extracted files box and click Finish.
Double click on gmer.exe to run it.
Select the Rootkit tab.
On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
Select all drives that are connected to your system to be scanned.
Click on the Scan button.
When the scan is finished, click Copy to save the scan log to the Windows clipboard.
Open Notepad or a similar text editor.
Paste the clipboard contents into the text editor.
Save the Gmer scan log and post it in your next reply.

Note: Do not run any programs while Gmer is running.

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

orun11

Post #9July 23, 2009, 8:54 PM UTC

Again, thanks for your help!!

New development: when closing window for Explorer, it 'crashes'.

GMER crashed & gave me blue screen/then resert
three times when I had all of my drives checked (C:, recovery D and external L)
but when I unchecked D it completed.

=====================
GMER log
===================

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-23 15:36:08
Windows 6.0.6002 Service Pack 2

—- Kernel code sections - GMER 1.0.15 —-

? C:\Windows\System32\Drivers\sptd.sys The process cannot access the file because it is being used by another process.
.text USBPORT.SYS!DllUnload 87B4641B 5 Bytes JMP 866B31B8
? System32\Drivers\allzd4l8.SYS The system cannot find the path specified. !

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8280A604] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [82809ABA] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8280A72E] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [82809B82] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [82809C00] \SystemRoot\System32\Drivers\sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8281CB9A] \SystemRoot\System32\Drivers\sptd.sys

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74937817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7498A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7493BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7492F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [749375E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7492E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74968395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7493DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7492FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7492FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [749271CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [749BCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7495C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7492D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74926853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7492687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1952] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74932AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396
ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 843911D8
Device \FileSystem\fastfat \FatCdrom 8FB15980
Device \Driver\netbt \Device\NetBT_Tcpip_{6892C214-623A-4497-B59C-EC6E0310EB08} 87794980
Device \FileSystem\fastfat \Fat 8FB15980

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -1246438598
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 -27071977
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x41 0xAE 0xF4 0x82 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0xA4 0x02 0xBD 0x72 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xFD 0x05 0x85 0x03 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x41 0xAE 0xF4 0x82 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0xA4 0x02 0xBD 0x72 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xFD 0x05 0x85 0x03 …

—- EOF - GMER 1.0.15 —-

=================
DDS text
=====================

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 15:45:13.42 on Thu 07/23/2009
Internet Explorer: 8.0.6001.18783 BrowserJavaVersion: 1.6.0_13
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.862 [GMT -5:00]

FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\QUIZZY\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mStart Page = hxxp://www.yahoo.com/
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - c:\progra~1\arcsoft\mediac~1\intern~1\ARCURL~1.DLL
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows; Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [RegistryMechanic] c:\program files\registry mechanic\RMTray.exe /H
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: []
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Yahoo;! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: Yahoo! &Dictionary; - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps; - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS; - file:///c:\program files\yahoo!\Common/ycsms.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
AppInit_DLLs: avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\quizzy\appdata\roaming\mozilla\firefox\profiles\2h5la224.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\users\quizzy\appdata\roaming\mozilla\firefox\profiles\2h5la224.default\extensions\[removed]\platform\winnt_x86-msvc\plugins\npmnqmp071303000004.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-3-30 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-3-30 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-6-26 907032]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-3-30 298776]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\system32\drivers\netr73.sys [2008-2-26 493568]
S3 MusCAudio;MusCAudio;c:\windows\system32\drivers\MusCAudio.sys [2009-7-7 23096]
S3 PID_0920;Logitech QuickCam Express(PID_0920);c:\windows\system32\drivers\LV532AV.SYS [2005-1-31 163328]

=============== Created Last 30 ================

2009-07-23 12:34 222,018,895 a——- c:\windows\MEMORY.DMP
2009-07-23 11:47 –d—– C:\_OTM
2009-07-18 08:42 –d—– C:\Rooter$
2009-07-17 05:56 –d—– c:\users\quizzy\appdata\roaming\Malwarebytes
2009-07-17 05:56 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-17 05:56 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-07-17 05:56 –d—– c:\programdata\Malwarebytes
2009-07-17 05:56 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-07-17 05:56 –d—– c:\progra~2\Malwarebytes
2009-07-17 03:28 156,672 a——- c:\windows\system32\t2embed.dll
2009-07-17 03:28 72,704 a——- c:\windows\system32\fontsub.dll
2009-07-17 03:28 289,792 a——- c:\windows\system32\atmfd.dll
2009-07-17 03:28 23,552 a——- c:\windows\system32\lpk.dll
2009-07-17 03:28 10,240 a——- c:\windows\system32\dciman32.dll
2009-07-12 21:45 –d—– c:\program files\Trend Micro
2009-07-12 14:24 –d—– c:\program files\Lavasoft(12)
2009-07-12 14:13 -cd-h— c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-12 14:13 -cd-h— c:\progra~2\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-07 09:31 –d—– C:\Converted
2009-07-07 09:29 23,096 a——- c:\windows\system32\drivers\MusCAudio.sys
2009-07-07 09:22 –d—– c:\programdata\FreeRIP
2009-07-07 09:22 –d—– c:\progra~2\FreeRIP

==================== Find3M ====================

2009-07-07 09:29 143,360 a——- c:\windows\inf\infstrng.dat
2009-07-07 09:29 51,200 a——- c:\windows\inf\infpub.dat
2009-07-07 09:29 86,016 a——- c:\windows\inf\infstor.dat
2009-07-05 18:32 335,752 a——- c:\windows\system32\drivers\avgldx86.sys
2009-06-26 13:43 11,952 a——- c:\windows\system32\avgrsstx.dll
2009-06-20 09:53 665,600 a——- c:\windows\inf\drvindex.dat
2009-06-20 09:52 0 a—h— c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-05-09 00:50 915,456 a——- c:\windows\system32\wininet.dll
2009-05-09 00:34 71,680 a——- c:\windows\system32\iesetup.dll
2008-06-14 16:31 174 a–sh— c:\program files\desktop.ini
2007-09-10 02:49 262,144 a——- c:\progra~2\NTUSER.dat
2007-04-08 18:05 0 a——- c:\users\quizzy\appdata\roaming\wklnhst.dat
2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2002-09-24 09:24 61,440 a——- c:\windows\inf\i386\onetUSD.dll
2002-07-09 09:23 36,864 a——- c:\windows\inf\i386\Vizmicro.dll
2002-05-20 09:20 172,032 a——- c:\windows\inf\i386\viceo.dll
2002-05-20 09:02 225,280 a——- c:\windows\inf\i386\rtscan.dll
2001-08-03 19:29 13,824 a——- c:\windows\inf\i386\Usbscan.sys
1999-07-06 19:00 6 —shr– c:\windows\@@desktop.dat
2007-04-17 19:39 8 a–shr– c:\windows\system32\672AA862D4.sys
2007-04-17 19:52 5,014 a–sh— c:\windows\system32\KGyGaAvL.sys

============= FINISH: 15:45:30.10 ===============

Attachments:

📎Attach.txt

Tomk

Post #10July 23, 2009, 9:25 PM UTC

orun11,

Limewire and Azureus
You have Limewire and Azureus, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm

I would recommend that you uninstall Limewire and Azureus, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

JavaRa …by: Paul McLain and Fred de Vries

Please download JavaRa (Copyright © 2008 RaProducts.org) and unzip it to your desktop.
***Please close any instances of Internet Explorer before continuing!***
Print these instructions…you won't have Internet access during this particular phase!

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English or the appropriate language…and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.
Copy and paste the contents of the JavaRa log, in your next reply.

Please download Dr.Web CureIt . Save it to your desktop:

Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan.
This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, select Complete scan.
Click the green arrow [external image: Posted Image] at the right, and the scan will start.
Click Yes to all if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click File and choose Save report list
Save the report to your desktop. The report will be called DrWeb.csv
Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum.
Please post the Dr.Web.txt report in your next reply
Close Dr.Web Cureit.
Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.

orun11

Post #11July 29, 2009, 1:24 AM UTC last edited July 29, 2009, 1:25 AM UTC

Thank you for all your help!! I've downloaded the last 2 programs and tried to run them sucessfully, however I could never get JavaRa to give me a log file, and I do not know if Drweb is completely running the scan or at some point crashes and reboots my computer or what. I watch it run for a long time, then I have to leave or sleep.. when I return the computer has fully rebooted and no logfile is available. Andy advice?

Tomk

Post #12July 29, 2009, 1:37 AM UTC

orun11,

Let's do this:

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

orun11

Post #13August 3, 2009, 7:13 AM UTC

I hope it is all right to copy and paste… thanks for all your help!
I am sorry I had to take so long getting this done!
———————————————–

ComboFix 09-08-02.03 - QUIZZY 08/03/2009 1:57.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1033 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2960149092-1897844939-3060466077-500
L:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-07-03 to 2009-08-03 )))))))))))))))))))))))))))))))
.

2009-07-28 06:01 . 2009-07-28 06:01 ——– d—–w- c:\users\QUIZZY\DoctorWeb
2009-07-28 05:40 . 2009-07-28 05:40 713992 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-07-23 16:47 . 2009-07-23 16:47 ——– d—–w- C:\_OTM
2009-07-18 13:42 . 2009-07-19 06:32 ——– d—–w- C:\Rooter$
2009-07-17 10:56 . 2009-07-17 10:56 ——– d—–w- c:\users\QUIZZY\AppData\Roaming\Malwarebytes
2009-07-17 10:56 . 2009-07-13 18:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-17 10:56 . 2009-07-17 10:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 10:56 . 2009-07-17 10:56 ——– d—–w- c:\programdata\Malwarebytes
2009-07-17 10:56 . 2009-07-13 18:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-17 08:28 . 2009-06-15 14:53 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-07-17 08:28 . 2009-06-15 14:52 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-07-17 08:28 . 2009-06-15 14:52 23552 —-a-w- c:\windows\system32\lpk.dll
2009-07-17 08:28 . 2009-06-15 14:51 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-07-17 08:28 . 2009-06-15 12:42 289792 —-a-w- c:\windows\system32\atmfd.dll
2009-07-13 02:45 . 2009-07-13 02:45 ——– d—–w- c:\program files\Trend Micro
2009-07-12 19:24 . 2009-07-12 19:24 ——– d—–w- c:\program files\Lavasoft(12)
2009-07-12 19:13 . 2009-07-12 19:25 ——– dc-h–w- c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-07 14:31 . 2009-07-07 14:31 ——– d—–w- C:\Converted
2009-07-07 14:29 . 2009-06-26 18:45 23096 —-a-w- c:\windows\system32\drivers\MusCAudio.sys
2009-07-07 14:22 . 2009-07-07 14:22 ——– d—–w- c:\programdata\FreeRIP
2009-07-05 23:33 . 2009-07-05 23:32 2054424 —-a-w- c:\programdata\avg8\update\backup\avgcorex.dll
2009-07-05 23:33 . 2009-07-05 23:32 2167576 —-a-w- c:\programdata\avg8\update\backup\avgresf.dll
2009-07-05 23:33 . 2009-07-05 23:32 3403032 —-a-w- c:\programdata\avg8\update\backup\avgui.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-23 16:49 . 2008-06-14 21:38 ——– d—–w- c:\program files\Microsoft Silverlight
2009-07-21 21:52 . 2009-07-29 00:23 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 00:23 109056 —-a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 00:23 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 00:23 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2009-07-18 13:17 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-07-12 19:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Defender
2009-07-12 19:56 . 2007-04-07 07:47 ——– d—–w- c:\users\QUIZZY\AppData\Roaming\Azureus
2009-07-12 19:56 . 2007-03-10 01:09 ——– d—–w- c:\users\QUIZZY\AppData\Roaming\Winamp
2009-07-12 19:56 . 2007-03-10 01:09 ——– d—–w- c:\program files\Winamp
2009-07-12 19:56 . 2007-10-18 07:40 ——– d—–w- c:\program files\Common Files\PX Storage Engine
2009-07-12 19:56 . 2007-08-15 13:06 ——– d—–w- c:\program files\Lavasoft
2009-07-12 19:56 . 2007-08-15 13:05 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-12 19:25 . 2007-08-15 13:06 ——– d—–w- c:\programdata\Lavasoft
2009-07-08 01:35 . 2007-01-16 17:38 ——– d—–w- c:\program files\Yahoo!
2009-07-05 23:32 . 2009-03-30 21:02 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-26 18:43 . 2009-03-30 21:02 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-26 18:43 . 2009-03-30 21:02 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-20 14:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Calendar
2009-06-20 14:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Sidebar
2009-06-20 14:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Journal
2009-06-20 14:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Collaboration
2009-06-20 14:56 . 2006-11-02 12:37 ——– d—–w- c:\program files\Windows Photo Gallery
2009-06-20 14:53 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2009-06-20 14:52 . 2009-06-20 14:52 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-06-20 14:48 . 2006-11-02 12:37 37665 —-a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-06-12 10:06 . 2007-03-13 04:26 ——– d—–w- c:\programdata\yahoo!
2009-06-11 21:18 . 2007-01-16 17:31 ——– d—–w- c:\program files\Microsoft Works
2009-06-09 08:14 . 2008-03-09 17:31 ——– d—–w- c:\program files\Windows Live
2009-06-09 08:14 . 2007-06-02 09:01 ——– d—–w- c:\program files\Windows Live Toolbar
2009-06-09 08:14 . 2009-06-09 08:14 ——– d—–w- c:\program files\Microsoft Sync Framework
2009-06-09 08:08 . 2009-06-09 08:08 ——– d—–w- c:\program files\Microsoft
2009-06-09 08:07 . 2009-06-09 08:07 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-06-09 07:18 . 2009-06-09 07:18 ——– d—–w- c:\program files\Common Files\Windows Live
2009-06-06 11:43 . 2009-06-04 08:17 ——– d—–w- c:\users\QUIZZY\AppData\Roaming\ArcSoft
2009-06-05 09:19 . 2009-06-05 09:19 ——– d—–w- c:\program files\VDOWNLOADER
2009-06-04 09:00 . 2009-06-04 08:20 ——– d—–w- c:\program files\Rhapsody
2009-06-04 08:54 . 2009-06-04 08:16 ——– d–h–w- c:\programdata\ArcSoft
2009-06-04 08:18 . 2007-01-16 17:23 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-04 08:18 . 2009-06-04 08:17 5068262 —-a-w- c:\programdata\ArcSoft\Global Deploy\CheckUpdate\ArcConnect.exe
2009-06-04 08:16 . 2009-06-04 08:16 ——– d—–w- c:\program files\Common Files\ArcSoft
2009-06-04 08:16 . 2008-03-03 00:22 ——– d—–w- c:\program files\ArcSoft
2009-05-27 00:50 . 2009-06-12 10:05 607472 —-a-w- c:\programdata\yahoo!\YUpdater\yupdater.exe
2009-05-15 20:19 . 2009-05-15 20:19 416128 —-a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2009-06-29 09:30 . 2008-09-02 19:11 134648 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
1999-07-07 00:00 . 1999-07-07 00:00 6 –sh–r- c:\windows\@@desktop.dat
2007-04-18 00:39 . 2007-04-18 00:39 8 –sha-r- c:\windows\System32\672AA862D4.sys
2007-04-18 00:52 . 2007-03-09 20:25 5014 –sha-w- c:\windows\System32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Connections.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Connections.lnk
backup=c:\windows\pss\HP Connections.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiSpywareOverride"=dword:00000001
"VistaSp2"=hex(

:c4,53,87,45,b8,f1,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AA3B99C9-A9E5-4B02-A5CA-7A7B13A91733}"= c:\program files\HP Connections\6811507\Program\HP Connections:HP Connections
"{F8D062A2-8CDC-466D-BC72-0916C2523E33}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{50797013-C42B-4AC2-8564-745DB32A3DB6}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{E8ACC132-D7CA-4B10-B281-0F5DB03FD760}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D80E4E4C-917C-41FB-8AAB-91ECE4220E25}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D8150920-B129-4113-A299-4F52CAE5155F}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{9F318AA0-34A8-4106-B470-547D27C68C47}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{357AF9B0-96B3-4FC0-953D-22AD0814C996}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"TCP Query User{2EEE0C91-1117-402B-9DDA-C6D94960FE4D}c:\\users\\quizzy\\desktop\\utorrent.exe"= UDP:c:\users\quizzy\desktop\utorrent.exe:utorrent.exe
"UDP Query User{E6FF6B60-0BEA-4477-852F-3D066CED77AB}c:\\users\\quizzy\\desktop\\utorrent.exe"= TCP:c:\users\quizzy\desktop\utorrent.exe:utorrent.exe
"{F81C9E5B-F314-4F04-9AFA-53F7D716670A}"= UDP:c:\program files\Grisoft\AVG7\avginet.exe:avginet.exe
"{6CE35886-DBA2-4521-A4C0-FD98D9FFA2F1}"= TCP:c:\program files\Grisoft\AVG7\avginet.exe:avginet.exe
"{725EB1A2-2633-4D17-8AB3-8575562A8686}"= UDP:c:\program files\Grisoft\AVG7\avgamsvr.exe:avgamsvr.exe
"{BD1A4E6B-3502-4C5B-A089-428023812E19}"= TCP:c:\program files\Grisoft\AVG7\avgamsvr.exe:avgamsvr.exe
"{E35D8834-F928-4960-AC07-3673FCDB6058}"= UDP:c:\program files\Grisoft\AVG7\avgcc.exe:avgcc.exe
"{19FE931D-A319-401C-A455-B113B636CAA7}"= TCP:c:\program files\Grisoft\AVG7\avgcc.exe:avgcc.exe
"{07AADD2E-D9D2-42B2-8763-88E50E677952}"= UDP:c:\program files\Grisoft\AVG7\avgemc.exe:avgemc.exe
"{BC4F6075-43A6-4D84-BD57-D22383E42C91}"= TCP:c:\program files\Grisoft\AVG7\avgemc.exe:avgemc.exe
"TCP Query User{69CC2E1A-F2F8-4BC0-A0B9-56841FFC79E9}c:\\stubinstaller.exe"= UDP:C:\stubinstaller.exe:LimeWire swarmed installer
"UDP Query User{230CE09A-575A-4E48-A8E3-3B7AA0D768E7}c:\\stubinstaller.exe"= TCP:C:\stubinstaller.exe:LimeWire swarmed installer
"{38D756F9-ABFC-4064-A7B5-2DE797970ECC}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{86216085-286B-47AA-A31F-532C7714D444}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{722CD0DC-CCE6-4806-837D-CACB5ADCFC01}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{AD9A5172-EDE6-4250-B7F4-3C90998554CE}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{42FC06DF-77F2-4837-AC0A-533512D78304}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{9079255D-4DE0-43DA-A5F9-EA78822F91B0}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{8033C863-6C96-4C34-AEF2-51350C0785B4}c:\\users\\quizzy\\desktop\\from old computer\\utorrent.exe"= UDP:c:\users\quizzy\desktop\from old computer\utorrent.exe:utorrent.exe
"UDP Query User{6A54A99D-CC81-4024-8270-DBFCA38B83E7}c:\\users\\quizzy\\desktop\\from old computer\\utorrent.exe"= TCP:c:\users\quizzy\desktop\from old computer\utorrent.exe:utorrent.exe
"TCP Query User{D535B4DA-145B-4CAF-9825-91F205D8A3EA}c:\\program files\\azureus\\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus
"UDP Query User{A5CE610C-F57C-46E6-9CAF-50837092F266}c:\\program files\\azureus\\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus
"{7A68743B-E32C-4044-837B-2AB053551DA5}"= UDP:c:\windows\System32\lxddcoms.exe:Lexmark Communications System
"{8FC50295-3DE1-4AB4-8D1A-23F092D114FD}"= TCP:c:\windows\System32\lxddcoms.exe:Lexmark Communications System
"{CA1EFD2A-5641-4F97-A7C0-3E5EA5A040CB}"= UDP:c:\program files\Lexmark 2500 Series\lxddmon.exe:Device Monitor
"{61CB4674-0998-4EBB-887F-13395E87B7F3}"= TCP:c:\program files\Lexmark 2500 Series\lxddmon.exe:Device Monitor
"{31666D59-192E-4FE4-94E2-139C343F9E99}"= UDP:c:\program files\Lexmark 2500 Series\lxddamon.exe:Lexmark Device Monitor
"{9F615975-973D-4B97-BB6D-7F6B514B0C1C}"= TCP:c:\program files\Lexmark 2500 Series\lxddamon.exe:Lexmark Device Monitor
"{2FADD577-145A-4BCE-B8FE-C2BCE50CD774}"= UDP:c:\program files\Lexmark 2500 Series\App4R.exe:Lexmark Imaging Studio
"{15124AE6-DA7B-49A0-A29C-F24A7ECFD305}"= TCP:c:\program files\Lexmark 2500 Series\App4R.exe:Lexmark Imaging Studio
"{2724CBA7-052C-4FF0-94C8-BF2DCD5853A6}"= UDP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager
"{FE94D0FA-40AE-4CAE-9EEE-32143F53BB40}"= TCP:c:\programdata\NexonUS\NGM\NGM.exe:Nexon Game Manager
"{B6B89E4C-C5FB-4AD0-8FA2-D47F87B0F861}"= UDP:c:\nexon\KartRider\NMService.exe:Nexon Messenger Core
"{2B78BED0-5E57-4937-9CE5-AE0E2102803E}"= TCP:c:\nexon\KartRider\NMService.exe:Nexon Messenger Core
"{61B060D6-D609-4240-8782-0EFBD65B195B}"= Disabled:UDP:c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{96ECD13F-1C7E-476B-BC1E-FEB747DCCC7F}"= Disabled:TCP:c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"TCP Query User{17BB9F9F-B8C3-44F1-8312-44826042D732}c:\\program files\\macromedia\\dreamweaver mx\\dreamweaver.exe"= UDP:c:\program files\macromedia\dreamweaver mx\dreamweaver.exe:Dreamweaver MX
"UDP Query User{98CB0725-67D8-44F4-9CB5-B4D3FB0FA125}c:\\program files\\macromedia\\dreamweaver mx\\dreamweaver.exe"= TCP:c:\program files\macromedia\dreamweaver mx\dreamweaver.exe:Dreamweaver MX
"TCP Query User{E0AF0EE3-9E5C-47DA-852F-78B19F7BB58B}l:\\world of warcraft\\backgrounddownloader.exe"= UDP:l:\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"UDP Query User{01F77E60-7DC4-48FE-903B-CA5C2C372784}l:\\world of warcraft\\backgrounddownloader.exe"= TCP:l:\world of warcraft\backgrounddownloader.exe:Blizzard Downloader
"{73696353-C179-4E34-9473-D48700978A99}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{78EB856E-8C56-4855-801A-285F460F4C74}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{D3184258-A095-4044-B220-3C7C0FBC412C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{F9D8007F-5FFB-4633-BD89-0E313A0D0FEB}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{8E8785C4-8CCB-40EF-A17D-749C9654F63D}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{8FB253F9-AB68-4490-A19B-978AF6AAACBC}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{FE2877CC-D075-4DE7-B5DA-9E21EF546193}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [3/30/2009 4:02 PM 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [3/30/2009 4:02 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [6/26/2009 1:43 PM 907032]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [3/30/2009 4:01 PM 298776]
R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\System32\drivers\netr73.sys [2/26/2008 9:17 AM 493568]
S3 MusCAudio;MusCAudio;c:\windows\System32\drivers\MusCAudio.sys [7/7/2009 9:29 AM 23096]
S3 PID_0920;Logitech QuickCam Express(PID_0920);c:\windows\System32\drivers\LV532AV.SYS [1/31/2005 11:13 AM 163328]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-06 c:\windows\Tasks\HPCeeScheduleForQUIZZY.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-01-16 23:04]

2009-08-03 c:\windows\Tasks\User_Feed_Synchronization-{CAFAE5D6-F71B-4BCF-B9B7-6BE1D7A8BBFD}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Yahoo;! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: Add to Windows &Live; Favorites - http://favorites.live.com/quickadd.aspx
IE: Yahoo! &Dictionary; - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps; - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS; - file:///c:\program files\Yahoo!\Common/ycsms.htm
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
FF - ProfilePath - c:\users\QUIZZY\AppData\Roaming\Mozilla\Firefox\Profiles\2h5la224.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\users\QUIZZY\AppData\Roaming\Mozilla\Firefox\Profiles\2h5la224.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-03 02:08
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-08-03 2:11
ComboFix-quarantined-files.txt 2009-08-03 07:11

Pre-Run: 2,409,136,128 bytes free
Post-Run: 2,257,088,512 bytes free

245 — E O F — 2009-08-03 06:53

Tomk

Post #14August 3, 2009, 5:06 PM UTC

orun11, How's it running now?

Tomk

Post #15August 9, 2009, 10:18 PM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Virus? Cannot load Facebook, now Firefox unresponsive, s

✨ Ask AI

Ask AI