What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] help- analyze HijackThis log

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hello,

recently my computer started freezing and beeping' sometimes it happens when windows start and sometimes during games.

please help me analyze the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:31:45, on 13/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21045)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager4\IDMan.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Download Manager4\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.colman.ac.il/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager4\IDMIECC.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - F:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {715D8720-A2ED-49A7-ABDF-695F65E91709} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\Program Files\Microsoft OfficeXP\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - F:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager4\IDMan.exe /onboot
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &ייצוא אל Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager4\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager4\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager4\IEExt.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: שלח אל OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: ש&לח אל OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - F:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\Program Files\Microsoft OfficeXP\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

–
End of file - 7844 bytes
Post #2
Hi chorba, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Next

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post

Please post back with
  • MBAM log
  • both DDS logs

Thanks
Post #3
thank you for your help. mbam: Malwarebytes' Anti-Malware 1.39 Database version: 2451 Windows 5.1.2600 Service Pack 3 17/07/2009 17:16:56 mbam-log-2009-07-17 (17-16-56).txt Scan type: Quick Scan Objects scanned: 122317 Time elapsed: 4 minute(s), 9 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\homeview (Trojan.DNSChanger) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) dds: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 17:25:00.84 on Fri 07/17/2009 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_05 Microsoft Windows XP Professional 5.1.2600.3.1255.972.1033.18.3582.2885 [GMT 3:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Logitech\Gaming Software\LWEMon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Download Manager4\IDMan.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE svchost.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Download Manager4\IEMonitor.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\idan\My Documents\Downloads\dds(2).scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.colman.ac.il/ BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager4\IDMIECC.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - f:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: {715D8720-A2ED-49A7-ABDF-695F65E91709} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - f:\program files\microsoft officexp\office12\GrooveShellExtensions.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - f:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [IDMan] c:\program files\internet download manager4\IDMan.exe /onboot mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Start WingMan Profiler] c:\program files\logitech\gaming software\LWEMon.exe /noui mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe IE: &ייצוא אל Microsoft Excel - f:\progra~1\micros~1\office12\EXCEL.EXE/3000 IE: Download all links with IDM - c:\program files\internet download manager4\IEGetAll.htm IE: Download FLV video content with IDM - c:\program files\internet download manager4\IEGetVL.htm IE: Download with IDM - c:\program files\internet download manager4\IEExt.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - f:\progra~1\micros~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - f:\progra~1\micros~1\office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - f:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll LSP: c:\windows\system32\idmmbc.dll DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - f:\program files\microsoft officexp\office12\GrooveSystemServices.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: avgrsstarter - avgrsstx.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll Notify: LMIinit - LMIinit.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - f:\program files\microsoft officexp\office12\GrooveShellExtensions.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\idan\applic~1\mozilla\firefox\profiles\n1yp9azt.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\documents and settings\idan\application data\idm\idmmzcc2\components\idmmzcc.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: general.useragent.extra.zencast - c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-7 335752] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-12-7 27784] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-12-7 298776] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-5-8 47640] R3 DRVofSonorEC;DRVofSonorEC;c:\windows\system32\drivers\DRVofSonorEC.sys [2009-1-5 20480] S3 cpuz130;cpuz130;\??\c:\docume~1\idan\locals~1\temp\cpuz130\cpuz_x32.sys –> c:\docume~1\idan\locals~1\temp\cpuz130\cpuz_x32.sys [?] S3 GEST Service;GEST Service for program management.;c:\program files\gigabyte\gest\gsvr.exe [2008-5-31 55816] S3 MarkFun_NT;MarkFun_NT;c:\program files\gigabyte\@bios\markfun.w32 [2009-3-27 17912] S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\documents and settings\idan\desktop\realtemp\WinRing0.sys [2009-3-27 14416] S4 LMIRfsClientNP;LMIRfsClientNP; [x] =============== Created Last 30 ================ 2009-07-17 17:08 –d—– c:\docume~1\idan\applic~1\Malwarebytes 2009-07-17 17:08 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-17 17:08 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-07-17 17:08 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-07-17 17:08 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-07-17 10:14 54,156 a—h— c:\windows\QTFont.qfn 2009-07-17 10:14 1,409 a——- c:\windows\QTFont.for 2009-07-15 20:50 119,808 -c—— c:\windows\system32\dllcache\t2embed.dll 2009-07-15 20:50 81,920 -c—— c:\windows\system32\dllcache\fontsub.dll 2009-07-13 21:43 –d—– c:\program files\EasyTVRadio 2009-07-08 20:54 1,846,632 a——- c:\windows\system32\D3DCompiler_41.dll 2009-07-08 20:54 453,456 a——- c:\windows\system32\d3dx10_41.dll 2009-07-08 20:54 4,178,264 a——- c:\windows\system32\D3DX9_41.dll 2009-07-08 20:54 517,448 a——- c:\windows\system32\XAudio2_4.dll 2009-07-08 20:54 69,448 a——- c:\windows\system32\XAPOFX1_3.dll 2009-07-08 20:54 235,352 a——- c:\windows\system32\xactengine3_4.dll 2009-07-08 20:54 22,360 a——- c:\windows\system32\X3DAudio1_6.dll 2009-07-07 14:28 –d—– c:\documents and settings\idan\Interwise 2009-07-07 14:18 –d—– c:\docume~1\idan\applic~1\FUEL 2009-07-06 14:38 –d—– C:\Interwise 2009-07-06 14:34 –d—– c:\program files\WMV9_VCM 2009-06-29 15:23 –d—– c:\program files\common files\DirectX ==================== Find3M ==================== 2009-07-13 10:24 335,752 a——- c:\windows\system32\drivers\avgldx86.sys 2009-06-16 17:36 119,808 a——- c:\windows\system32\t2embed.dll 2009-06-16 17:36 81,920 a——- c:\windows\system32\fontsub.dll 2009-06-06 12:00 85,504 a——- c:\windows\system32\ff_vfw.dll 2009-06-06 12:00 60,273 a——- c:\windows\system32\pthreadGC2.dll 2009-06-03 22:09 1,291,264 a——- c:\windows\system32\quartz.dll 2009-05-07 18:32 345,600 a——- c:\windows\system32\localspl.dll 2009-05-07 10:43 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-04-29 07:49 828,928 a——- c:\windows\system32\wininet.dll 2009-04-29 07:49 78,336 a——- c:\windows\system32\ieencode.dll 2009-04-27 18:06 16,608 a——- c:\windows\gdrv.sys 2009-04-22 00:20 14,311,680 a——- c:\windows\system32\xlive.dll 2009-04-22 00:20 13,642,496 a——- c:\windows\system32\xlivefnt.dll 2008-05-30 17:22 22,328 a——- c:\docume~1\idan\applic~1\PnkBstrK.sys 2008-12-07 21:37 16,384 a–sh— c:\windows\system32\config\systemprofile\cookies\index.dat 2008-12-07 21:37 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat 2008-04-15 22:37 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008041520080416\index.dat 2008-12-07 21:37 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat ============= FINISH: 17:25:12.89 ===============

Attachments:

Post #4
Hi chorba,

There is some evidence of an possible infection. Let's look deeper.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.
If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.
  • Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop

Please post back with the GMER log.

Thanks
Post #6
Hi chorba,

We have found rootkit activity on your computer. This may allow remote access to your computer.

I strongly suggest you do the following immediately:
  • From a know clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.
  • Do not use this computer for changing the passwords, if it is sending/recieving information to a remote site, the new passwords may be compromised.

Please read through these instructions to familliarize yourself with what to expext when the tool runs.

It is vitally important that combofix is renamed before it is even started to download


Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
    -Tools->Options->Main tab
    -Set to "Always ask me where to Save the files".
  • During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]

[external image: Posted Image]

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

  • Double click on ComboFix.exe & follow the prompts. Close all other browsers/windows first.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Please post back with
  • combofix log
How is the computer now?

Thanks
Post #7
well, i have done what you told me to do, but windows still freeze when it loads for the first time. it's strange because after i restart the computer windows loads with out a problem. is there anything else i can do?

Attachments:

Post #10
Hi chorba,

Any other problems besides the freeze on first boot?

Let's see if anything that is not supposed be living in the Master Boot Record.



Please download MBR.exe and save it to your desktop

Double click on the MBR.exe file to run it.

A log will be produced, MBR.log.
Please open this log in Notepad and post its contents in your next reply.

It would appear you also ran combofx one additional time.

Open windows explorer (right click the Start button and click Explore)

  • Navigate to this folder
    C:\Qoobox
  • In the right hand panel, locate this file combofix2.txt
  • Open it with notepad and post it's contents in your next reply.

Thanks
Post #11
mbr log:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK


combofix log:

ComboFix 09-07-20.05 - idan 07/21/2009 23:15.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1255.972.1033.18.3582.2796 [GMT 3:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-17 14:08 . 2009-07-17 14:08 ——– d—–w- c:\documents and settings\idan\Application Data\Malwarebytes
2009-07-17 14:08 . 2009-07-17 14:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-17 14:08 . 2009-07-13 10:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-17 14:08 . 2009-07-17 14:08 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 14:08 . 2009-07-13 10:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-15 17:50 . 2009-06-16 14:36 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2009-07-15 17:50 . 2009-06-16 14:36 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll
2009-07-13 20:45 . 2009-07-13 20:45 5589408 —-a-w- c:\documents and settings\idan\Application Data\TVU Networks\TVU AutoUpgrade\TVUPlayer2.4.5.3.exe
2009-07-13 18:43 . 2009-07-13 18:44 ——– d—–w- c:\documents and settings\idan\Local Settings\Application Data\EasyTVRadio
2009-07-13 18:43 . 2009-07-13 18:43 ——– d—–w- c:\program files\EasyTVRadio
2009-07-08 18:19 . 2009-07-20 14:16 ——– d—–w- c:\documents and settings\idan\Local Settings\Application Data\VirtuaTennis2009
2009-07-08 17:54 . 2009-03-09 12:27 453456 —-a-w- c:\windows\system32\d3dx10_41.dll
2009-07-08 17:54 . 2009-03-09 12:27 1846632 —-a-w- c:\windows\system32\D3DCompiler_41.dll
2009-07-08 17:54 . 2009-03-16 11:18 69448 —-a-w- c:\windows\system32\XAPOFX1_3.dll
2009-07-08 17:54 . 2009-03-16 11:18 517448 —-a-w- c:\windows\system32\XAudio2_4.dll
2009-07-08 17:54 . 2009-03-09 12:27 4178264 —-a-w- c:\windows\system32\D3DX9_41.dll
2009-07-08 17:54 . 2009-03-16 11:18 235352 —-a-w- c:\windows\system32\xactengine3_4.dll
2009-07-08 17:54 . 2009-03-16 11:18 22360 —-a-w- c:\windows\system32\X3DAudio1_6.dll
2009-07-07 11:28 . 2009-07-07 11:28 ——– d—–w- c:\documents and settings\idan\Interwise
2009-07-07 11:18 . 2009-07-07 11:18 ——– d—–w- c:\documents and settings\idan\Application Data\FUEL
2009-07-06 11:38 . 2009-07-07 11:28 ——– d—–w- C:\Interwise
2009-07-06 11:34 . 2009-07-06 11:34 ——– d—–w- c:\program files\WMV9_VCM
2009-06-29 12:23 . 2009-06-29 12:23 ——– d—–w- c:\program files\Common Files\DirectX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 20:18 . 2008-04-16 17:31 ——– d—–w- c:\documents and settings\idan\Application Data\DMCache
2009-07-21 11:43 . 2008-10-04 15:36 ——– d—–w- c:\documents and settings\idan\Application Data\HPAppData
2009-07-15 23:23 . 2008-04-17 20:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-13 18:47 . 2008-05-03 15:51 8 —-a-w- c:\windows\system32\nvModes.dat
2009-07-13 18:43 . 2008-07-10 15:37 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-07-13 07:24 . 2008-12-07 18:56 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-11 08:00 . 2008-11-30 17:34 ——– d—–w- c:\documents and settings\idan\Application Data\Skype
2009-07-11 07:46 . 2008-11-30 17:36 ——– d—–w- c:\documents and settings\idan\Application Data\skypePM
2009-07-08 17:49 . 2008-04-16 16:53 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-23 08:03 . 2008-12-07 18:56 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-16 14:36 . 2007-09-20 04:48 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2007-09-20 04:34 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-13 16:56 . 2008-04-15 12:11 ——– d—–w- c:\program files\ffdshow
2009-06-06 09:00 . 2008-04-15 12:11 85504 —-a-w- c:\windows\system32\ff_vfw.dll
2009-06-06 09:00 . 2008-04-15 12:11 60273 —-a-w- c:\windows\system32\pthreadGC2.dll
2009-06-03 19:09 . 2007-09-20 04:34 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-06-01 15:05 . 2009-06-01 15:05 ——– d—–w- c:\program files\Crystal Player2
2009-06-01 15:04 . 2008-04-16 18:32 ——– d—–w- c:\program files\Crystal Player
2009-06-01 10:40 . 2008-04-17 21:37 ——– d—–w- c:\program files\Common Files\Adobe
2009-05-25 14:53 . 2009-04-13 12:58 ——– d—–w- c:\program files\POMQMV3
2009-05-23 23:44 . 2008-10-31 10:51 1435496 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-23 13:34 . 2008-09-05 09:28 ——– d—–w- c:\documents and settings\idan\Application Data\PC Suite
2009-05-07 15:32 . 2004-08-03 23:56 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-07 07:43 . 2008-12-07 18:56 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-04-29 04:49 . 2007-09-20 04:59 828928 —-a-w- c:\windows\system32\wininet.dll
2009-04-29 04:49 . 2007-09-20 04:58 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-04-27 15:06 . 2008-05-26 01:24 16608 —-a-w- c:\windows\gdrv.sys
2009-07-17 14:22 . 2008-06-18 19:46 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-19_19.17.27 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager4\IDMan.exe" [2008-07-30 932272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-11-12 1630208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-7-21 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-01 23:42 72208 —-a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-07 07:43 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-16 18:35 87352 —-a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^idan^Start Menu^Programs^Startup^גוזר מסך של OneNote 2007 ו- Launcher.lnk]
path=c:\documents and settings\idan\Start Menu\Programs\Startup\גוזר מסך של OneNote 2007 ו- Launcher.lnk
backup=c:\windows\pss\גוזר מסך של OneNote 2007 ו- Launcher.lnkStartup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"f:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"f:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"f:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"f:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"f:\\Program Files\\Microsoft OfficeXP\\Office12\\GROOVE.EXE"=
"f:\\Program Files\\Microsoft OfficeXP\\Office12\\ONENOTE.EXE"=
"f:\\Program Files\\Microsoft OfficeXP\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
"f:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Civilization IV Colonization\\Colonization.exe"=
"f:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Program Files\\Xilisoft\\Sound Recorder\\sonorec.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"f:\\Program Files\\Ubisoft\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\GIGABYTE\\@BIOS\\gwflash.exe"=
"f:\\Program Files\\Activision\\Prototype\\prototypef.exe"=
"f:\\Program Files\\Codemasters\\FUEL\\FUEL.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [07/12/2008 21:56 335752]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/12/2008 21:56 298776]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [24/07/2008 19:46 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [08/05/2008 23:44 47640]
R3 DRVofSonorEC;DRVofSonorEC;c:\windows\system32\drivers\DRVofSonorEC.sys [05/01/2009 00:19 20480]
S3 cpuz130;cpuz130;\??\c:\docume~1\idan\LOCALS~1\Temp\cpuz130\cpuz_x32.sys –> c:\docume~1\idan\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [07/02/2009 02:45 26224]
S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\gsvr.exe [31/05/2008 03:00 55816]
S3 MarkFun_NT;MarkFun_NT;c:\program files\GIGABYTE\@BIOS\markfun.w32 [27/03/2009 17:30 17912]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\documents and settings\idan\Desktop\realtemp\WinRing0.sys [27/03/2009 19:01 14416]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

— Other Services/Drivers In Memory —

*Deregistered* - Ndisprot.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.colman.ac.il/
IE: &ייצוא אל Microsoft Excel - f:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Download all links with IDM - c:\program files\Internet Download Manager4\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager4\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager4\IEExt.htm
LSP: c:\windows\system32\idmmbc.dll
FF - ProfilePath - c:\documents and settings\idan\Application Data\Mozilla\Firefox\Profiles\n1yp9azt.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - component: c:\documents and settings\idan\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll

—- FIREFOX POLICIES —-
FF - user.js: general.useragent.extra.zencast - c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-21 23:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MarkFun_NT]
"ImagePath"="\??\c:\program files\Gigabyte\@BIOS\markfun.w32"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1292428093-1390067357-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:43,7e,a8,9f,7b,3a,85,f8,c4,18,b0,91,58,b1,7f,f6,bc,f8,b6,cc,22,59,38,
39,a9,fe,31,61,27,e2,50,47,d0,6f,f0,f3,6c,3f,e4,10,a6,0a,d7,f6,92,92,07,0d,\
"??"=hex:20,6c,02,7f,3d,95,46,b7,c4,ae,31,91,a8,ec,f9,f9

[HKEY_USERS\S-1-5-21-1292428093-1390067357-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:e3,88,83,65,31,83,c6,64,4a,be,ac,66,c6,e2,e7,f9,82,e2,0d,90,b5,
f4,36,ea,3e,b1,ec,0d,3d,22,7c,95,a3,d7,7b,e1,64,87,40,27,1f,ba,0f,fc,71,8a,\
"rkeysecu"=hex:95,8f,5f,24,e9,4a,4b,4d,e7,27,6c,00,ca,c8,ee,88

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):24,c1,34,fe,8a,27,78,f1,db,1b,e5,31,79,d5,b0,43,48,41,55,60,e4,
b2,1d,cc,10,fa,9d,26,d3,48,8b,0d,a8,6b,07,06,43,fa,ca,da,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{a44af87b-f71a-4162-92b0-0710bbd521e5}]
@Denied: (Full) (Everyone)
"Model"=dword:000000ac
"Therad"=dword:0000000a
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,4e,a9,ce,ea,da,41,36,fe,50,fc,7b,bf,11,95,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="D1E087E81D2D08DBF6E11D9970482DED79D931F7543177B7009A7B54EA4FC84E011997E7E6E
C218702A9D7D60F9FF8DE6D042DF5DF72AEA572A01EEDB26B090DF8DE4CA5755744F6A4798AFB7C6F
2C1BE55707D556C2D17D1C1FFAFB387F46AD4B1EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127
BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980
AC79338EDD5E5BE2F6E6675D575E7D6A3B98082FBF015F203214AEC4954E28CAEB5CFAC9C056EC834
67AF924602342003E0995FDE6A29FA1E7BA79F5718E1D302A0A08E7726F08ABDC840847319D412622
8FB6FD16626B3BA659986945226F031B40A55C8D8E4C2911D941BA23FCB2881B078299ACBAFE59C39
14DFA9F766F704F66BA92ED3DBB8C524D4F9A0005F13615C6873E83C4292EC966AD0A862201EB8E49
027AE529F0A9441533098699EB063190AB5DE43F4D3275BEA278715B9BADD3190985B92319983EC84
1A968C623104204286B118DE11C39666BAD4BFE4D30CB6A34AEA19F76364CE72125CA392E32D22988
E4393674EBB90C9892758C3532DBB53BEE4B375CA22D51CDA84943370D1E692F448564A1E4CFC3901
8C22887B6975726C6D8A7B5C0D4CC17E3EF5AFC0695944E8E90E61E8B0A850D2FFC990D074B8F543B
DD527F39EA03218C4398D1475D5CF0C6E9B0312AAA2B9B4E5E4C212BF4047A5164B9CA78C901E3D93
7BB9A3C4D56737614D936CEA5749D7197503575C6BA1D97E788BCAF83B62B8AB626D39773FC062D07
9A1B4C258649174CD94EF628A1191B5B8B0E52D87C175D9FDC89CC0F30AEFBABD364390766A841954
18286B2899B7123340D96438A9A18C40B5F9694B1C37763882AEDDC8199F6FE817EC0B5A528319716
1B7B6D7DFC83E97D0AF0AC28743A80DD168AEA25CD4388BA0484B38F94F5856BACBFB7D85B6B4BA7D
69D359C4061C821676FAC07CAB22532E6F362438DDFAF10CB6733FE2521171D21A13D7EFC0F7840F2
444E3DE9DABE4D0E772D9F10134984153C2A3B9D78EC195CC689205268BE4C1E72B14259D0B09A773
932EB6FB57C6FBA47183A5C4B657A0F9993373D183E7F6528ECF71BAFC94732A8434ED275E619805C
2B0F4FF40AC1D3EA0760104B8E325858482085954FA962F9E854B47F176DBF0CC6AC3357D694D7D0C
4176DB2396499B7426240A5F9B742A25BED630A94FDE732826E9DD6403E5D236040CE853FB8E0C08B
4A4C06F38F1C5E0BEE834AD600F8E7AB10F5DB2BAB3B80A32002FB117678B38AC678E15E6FD0AC191
189FD4CCB870EBFB477D272ED5CC80B63A5541987400FD82CEB67CCBB55515D6F4164D35EBDC9F2E0
B32C63BCBD22C5963150AFFBAB1DC3B1A0C9C8FB31D1608CC94044D8D803ACFC0C5CBFF1F2F5B92D6
BB52585C2E4CBF1E2404CDC017A62"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(748)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\windows\system32\LMIinit.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'lsass.exe'(804)
c:\windows\system32\idmmbc.dll

- - - - - - - > 'explorer.exe'(2596)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-21 23:19
ComboFix-quarantined-files.txt 2009-07-21 20:19
ComboFix2.txt 2009-07-19 19:20
ComboFix3.txt 2008-12-13 12:00

Pre-Run: 9,996,054,528 bytes free
Post-Run: 9,976,504,320 bytes free

284 — E O F — 2009-07-21 20:12
Post #12
Hi chorba,

Thanks.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield
  • Do not copy the word CODE , please note the script starts with the :
    :reg
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndisprot

:file
%System%\drivers\ndisprot.sys
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI