What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Computer Going Online By Itself

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer, with Office XP, keeps going online by itself (I'm on dial-up), when its sitting idle, not on "standby". I have seen no common denominator, such as time of day or time its been sitting idle. I sometimes discover its been online for a couple hours when I've been away. Obviously, this is tieing up my phone line so I am unable to receive any phone calls. If anyone can help me with this, it would be greatly appreciated.
Post #2
Hi,

This may not be malware related, it may just be a setting in your connection, but we better check to make sure.

Please do the following:

STEP #1

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Link 1 gave me a message from my Avira anti-virus that a dangerous or unwanted file was found. I ran Link 2, but it just gave a box telling me about the program, with no way to proceed further.
Post #4 last edited
Just close Avira while downloading DDS…it's just picking up on the heuristics of the program…

If it still will not download, try this program

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #5
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 18:53:34.37 on Thu 07/16/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.115 [GMT -6:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: avast! antivirus 4.8.1335 [VPS 090716-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\program files\avira\antivir desktop\avcenter.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\702U6I0F\dds[1].pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.wrh.noaa.gov/forecast/MapClick.php?site=tfx&smap=1&textField1=47.02611&textField2=-108.80389
uSearch Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: StumbleUpon Launcher: {145b29f4-a56b-4b90-bbac-45784ebebbb7} - c:\program files\stumbleupon\StumbleUponIEBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: StumbleUpon Toolbar: {5093eb4c-3e93-40ab-9266-b607ba87bdc8} - c:\program files\stumbleupon\StumbleUponIEBar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [SmcService] c:\progra~1\sygate\spf\smc.exe -startgui
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\11\config\ereg\Ereg.ini"
mRun: [BrMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN
mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bbstar~1.lnk - c:\program files\brainbullet!\BBStartup.exe
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\BigFix.lnk.disabled
IE: Add to EverNote - c:\program files\evernote\evernote\enbar.dll/2000
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - {2151DA8C-C5B6-4B4F-86AB-BDA449BF8747} - c:\program files\evernote\evernote\enbar.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: microsoft.com\www.update
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
TCP: {094696E5-492F-41A3-BBB7-C1C2D614E956} = 216.228.34.51 206.74.254.2
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~1\goec62~1.dll,c:\progra~1\google\google~1\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\pb61cq7v.default\
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-1-27 28544]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-4-3 114768]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-3-18 11608]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-3-18 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-3-18 185089]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-4-3 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2007-11-9 138680]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-3-18 55640]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
S2 gupdate1c9945cb04356b8;Google Update Service (gupdate1c9945cb04356b8);c:\program files\google\update\GoogleUpdate.exe [2009-2-21 133104]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2007-11-9 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2007-11-9 352920]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [2006-6-30 69692]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-8-9 29744]
S3 StumbleUponUpdateService;StumbleUponUpdateService;c:\program files\stumbleupon\StumbleUponUpdateService.exe [2009-6-3 120168]
S4 vsdatant;vsdatant; [x]

=============== Created Last 30 ================

2009-07-14 20:49 54,156 a—h— c:\windows\QTFont.qfn
2009-07-14 20:49 1,409 a——- c:\windows\QTFont.for
2009-07-14 20:41 –d—– c:\docume~1\owner\applic~1\Skinux
2009-07-14 20:31 –d—– c:\program files\Kodak
2009-07-14 20:28 –d—– c:\docume~1\alluse~1\applic~1\Kodak
2009-07-14 20:23 5,632 a——- c:\windows\system32\ptpusb.dll
2009-07-14 20:23 15,104 ac—— c:\windows\system32\dllcache\usbscan.sys
2009-07-14 20:23 15,104 a——- c:\windows\system32\drivers\usbscan.sys
2009-07-14 20:23 159,232 a——- c:\windows\system32\ptpusd.dll
2009-07-05 11:01 –d—– c:\windows\$regcmp$
2009-06-22 12:55 –d–r– c:\docume~1\owner\applic~1\Brother

==================== Find3M ====================

2009-07-05 10:14 2,908 a——- c:\docume~1\owner\applic~1\wklnhst.dat
2009-06-16 08:36 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 08:36 81,920 a——- c:\windows\system32\fontsub.dll
2009-06-03 13:09 1,291,264 a——- c:\windows\system32\quartz.dll
2009-05-21 11:33 410,984 a——- c:\windows\system32\deploytk.dll
2009-05-12 23:15 915,456 a——- c:\windows\system32\wininet.dll
2009-05-07 09:32 345,600 a——- c:\windows\system32\localspl.dll
2007-11-07 19:14 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
2008-07-17 10:42 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008071720080718\index.dat

============= FINISH: 18:54:22.03 ===============
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-16 20:08:18
Windows 5.1.2600 Service Pack 3


—- System - GMER 1.0.15 —-

SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwAllocateVirtualMemory [0xF8288B30]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAA0AB6B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xAA0AB574]
SSDT F8D7D1EC ZwCreateThread
SSDT F8D7D1FB ZwDeleteKey
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xAA0ABA52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAA0AB14C]
SSDT F8D7D20A ZwLoadKey
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwMapViewOfSection [0xF8288470]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xAA0AB64E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAA0AB08C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAA0AB0F0]
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwProtectVirtualMemory [0xF8288C50]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xAA0AB76E]
SSDT F8D7D214 ZwReplaceKey
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAA0AB72E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xAA0AB8AE]
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwShutdownSystem [0xF8288990]
SSDT F8D7D1E7 ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwWriteVirtualMemory [0xF8288D60]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

Device \Driver\aswTdi \Device\AswUdpFilter wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \Driver\Tcpip \Device\Tcp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

Device \Driver\aswTdi \Device\ASWTDI wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
Device \Driver\aswTdi \Device\AswTcpFilter wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \Driver\Tcpip \Device\Udp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 2
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 35
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset002\control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset002\Services\MRxDAV\EncryptedDirectories@

—- EOF - GMER 1.0.15 -

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 11/7/2007 6:09:01 PM
System Uptime: 7/16/2009 6:38:08 PM (0 hours ago)

Motherboard: ELITEGROUP | | 945GCT-M3
Processor: Intel Celeron processor | Socket 775 | 1599/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 70 GiB total, 52.393 GiB free.
D: is FIXED (NTFS) - 4 GiB total, 1.417 GiB free.
E: is CDROM ()
F: is FIXED (NTFS) - 19 GiB total, 18.804 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP515: 4/18/2009 1:05:06 PM - System Checkpoint
RP516: 4/19/2009 3:55:10 PM - System Checkpoint
RP517: 4/20/2009 7:53:36 PM - System Checkpoint
RP518: 4/22/2009 9:10:34 AM - System Checkpoint
RP519: 4/23/2009 11:45:33 AM - System Checkpoint
RP520: 4/23/2009 6:04:07 PM - Software Distribution Service 3.0
RP521: 4/24/2009 9:59:18 AM - Software Distribution Service 3.0
RP522: 4/25/2009 12:05:45 PM - System Checkpoint
RP523: 4/26/2009 1:11:34 PM - System Checkpoint
RP524: 4/27/2009 3:29:55 PM - System Checkpoint
RP525: 4/27/2009 5:20:17 PM - Software Distribution Service 3.0
RP526: 4/28/2009 4:52:43 PM - Software Distribution Service 3.0
RP527: 4/29/2009 7:07:49 PM - System Checkpoint
RP528: 5/1/2009 2:52:39 PM - System Checkpoint
RP529: 5/2/2009 4:34:10 PM - System Checkpoint
RP530: 5/3/2009 11:53:41 AM - Software Distribution Service 3.0
RP531: 5/3/2009 1:09:57 PM - Installed Windows Internet Explorer 8.
RP532: 5/3/2009 1:11:02 PM - Software Distribution Service 3.0
RP533: 5/4/2009 3:53:02 PM - System Checkpoint
RP534: 5/5/2009 12:59:42 PM - Software Distribution Service 3.0
RP535: 5/7/2009 12:22:30 PM - System Checkpoint
RP536: 5/8/2009 12:27:27 PM - System Checkpoint
RP537: 5/9/2009 2:19:01 PM - System Checkpoint
RP538: 5/10/2009 8:57:11 AM - Software Distribution Service 3.0
RP539: 5/11/2009 10:26:33 AM - System Checkpoint
RP540: 5/11/2009 2:47:53 PM - Software Distribution Service 3.0
RP541: 5/13/2009 10:00:04 AM - Software Distribution Service 3.0
RP542: 5/14/2009 12:48:02 PM - System Checkpoint
RP543: 5/15/2009 3:08:24 PM - System Checkpoint
RP544: 5/16/2009 3:34:50 PM - System Checkpoint
RP545: 5/17/2009 5:33:48 PM - System Checkpoint
RP546: 5/18/2009 8:33:34 PM - System Checkpoint
RP547: 5/19/2009 8:53:54 PM - Software Distribution Service 3.0
RP548: 5/20/2009 9:45:55 PM - System Checkpoint
RP549: 5/22/2009 12:45:51 PM - System Checkpoint
RP550: 5/23/2009 1:31:06 PM - System Checkpoint
RP551: 5/23/2009 5:16:25 PM - Software Distribution Service 3.0
RP552: 5/25/2009 11:35:28 AM - System Checkpoint
RP553: 5/25/2009 1:04:54 PM - Software Distribution Service 3.0
RP554: 5/25/2009 1:23:20 PM - Installed ScanSoft PaperPort 11
RP555: 5/25/2009 1:25:24 PM - Installed PaperPort Image Printer
RP556: 5/25/2009 1:25:41 PM - Printer Driver Nuance Image Printer Driver Installed
RP557: 5/25/2009 1:26:49 PM - Installed Brother MFL-Pro Suite
RP558: 5/25/2009 1:30:54 PM - Unsigned printer driver Brother PC-FAX v.2 installed.
RP559: 5/25/2009 2:03:46 PM - Installed FaceFilter Studio
RP560: 5/25/2009 3:25:19 PM - Installed BookScan&Whiteboard Suite
RP561: 5/26/2009 6:17:49 PM - System Checkpoint
RP562: 5/27/2009 9:07:49 PM - System Checkpoint
RP563: 5/29/2009 10:16:36 AM - System Checkpoint
RP564: 5/30/2009 12:05:34 PM - System Checkpoint
RP565: 5/30/2009 4:54:58 PM - Removed Java™ 6 Update 11
RP566: 5/30/2009 4:55:28 PM - Installed Java™ 6 Update 13
RP567: 5/30/2009 5:54:55 PM - Software Distribution Service 3.0
RP568: 6/1/2009 12:18:24 PM - System Checkpoint
RP569: 6/2/2009 7:43:36 AM - Software Distribution Service 3.0
RP570: 6/3/2009 10:50:40 AM - System Checkpoint
RP571: 6/4/2009 9:28:55 AM - Restore Operation
RP572: 6/4/2009 10:35:25 AM - Software Distribution Service 3.0
RP573: 6/5/2009 11:37:14 AM - System Checkpoint
RP574: 6/6/2009 11:42:23 AM - System Checkpoint
RP575: 6/7/2009 2:34:52 PM - System Checkpoint
RP576: 6/9/2009 1:02:27 PM - System Checkpoint
RP577: 6/10/2009 10:03:35 AM - Software Distribution Service 3.0
RP578: 6/10/2009 12:27:09 PM - Software Distribution Service 3.0
RP579: 6/10/2009 3:47:11 PM - Software Distribution Service 3.0
RP580: 6/11/2009 11:18:15 AM - Software Distribution Service 3.0
RP581: 6/11/2009 1:11:39 PM - Software Distribution Service 3.0
RP582: 6/13/2009 8:24:08 PM - System Checkpoint
RP583: 6/15/2009 12:04:19 PM - Software Distribution Service 3.0
RP584: 6/16/2009 3:24:08 PM - System Checkpoint
RP585: 6/18/2009 9:54:05 AM - Software Distribution Service 3.0
RP586: 6/19/2009 10:57:43 AM - System Checkpoint
RP587: 6/20/2009 12:42:50 PM - System Checkpoint
RP588: 6/21/2009 10:29:18 AM - Installed Java™ 6 Update 14
RP589: 6/22/2009 1:31:36 PM - System Checkpoint
RP590: 6/22/2009 10:48:14 PM - Software Distribution Service 3.0
RP591: 6/24/2009 10:56:26 AM - System Checkpoint
RP592: 6/25/2009 11:47:07 AM - System Checkpoint
RP593: 6/28/2009 6:47:37 PM - Software Distribution Service 3.0
RP594: 6/29/2009 7:05:05 PM - System Checkpoint
RP595: 6/30/2009 7:10:29 PM - Software Distribution Service 3.0
RP596: 7/1/2009 7:47:41 PM - System Checkpoint
RP597: 7/3/2009 8:37:01 AM - System Checkpoint
RP598: 7/4/2009 3:37:33 PM - System Checkpoint
RP599: 7/4/2009 7:04:24 PM - Software Distribution Service 3.0
RP600: 7/5/2009 8:05:54 PM - System Checkpoint
RP601: 7/6/2009 7:26:33 PM - Software Distribution Service 3.0
RP602: 7/8/2009 11:03:03 AM - System Checkpoint
RP603: 7/10/2009 9:19:23 AM - System Checkpoint
RP604: 7/11/2009 9:30:26 AM - Software Distribution Service 3.0
RP605: 7/12/2009 12:14:23 PM - System Checkpoint
RP606: 7/13/2009 5:55:50 PM - System Checkpoint
RP607: 7/14/2009 6:55:37 PM - System Checkpoint
RP608: 7/15/2009 11:52:55 AM - Installed QuickTime
RP609: 7/15/2009 2:18:25 PM - Software Distribution Service 3.0
RP610: 7/16/2009 11:55:24 AM - Removed Lexmark Photo Center

==== Installed Programs ======================

Ad-Aware
Adobe Dynamic Content Server
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe GoLive 6.0
Adobe Reader 8.1.6
Adobe SVG Viewer 3.0
Apple Software Update
AusLogics Disk Defrag
avast! Antivirus
Avira AntiVir Personal - Free Antivirus
BigFix
BookScan&Whiteboard Suite
BrainBullet! 2.0
Brother MFL-Pro Suite MFC-290C
Browser Address Error Redirector
CCleaner (remove only)
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
DVD Suite
ERUNT 1.1j
ESET Online Scanner
EverNote (Trial)
FaceFilter Studio Brother Edition
FOREXTrader
Free Registry Defrag
Google Desktop
Google Earth
Google Update Helper
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Intel® Graphics Media Accelerator Driver
InterActual Player
Java™ 6 Update 14
Java™ SE Runtime Environment 6 Update 1
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Basic Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Works
Microsoft WSE 2.0 SP3 Runtime
Mozilla Firefox (3.0.11)
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Outlook Express Backup V6.5
PaperPort Image Printer
Power2Go 5.0
PowerDVD
QuickTime
Realtek High Definition Audio Driver
Recovery Software Suite eMachines
ScanSoft PaperPort 11
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB973346)
Soft Data Fax Modem with SmartCP
Spybot - Search & Destroy
SpywareBlaster 4.2
StumbleUpon IE Toolbar
Sygate Personal Firewall
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
WebFldrs XP
Windows Backup Utility
Windows Defender
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

7/12/2009 6:57:29 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
7/12/2009 5:14:57 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.

==== End Of File ===========================
Post #6
Hi,

Please do the following:

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.

NEXT

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

Go here to run an online scanner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic.
Post #7
I will get the Eset scan later. The Malware scan show no malicious items. Malwarebytes' Anti-Malware 1.39 Database version: 2421 Windows 5.1.2600 Service Pack 3 7/16/2009 11:25:46 PM mbam-log-2009-07-16 (23-25-46).txt Scan type: Quick Scan Objects scanned: 82979 Time elapsed: 4 minute(s), 26 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected)
Post #9
CatByte, I have been unable to get Eset to run. However, the problem may have been fixed, the computer has not gone on by itself today. I have another situation that maybe you can help with. Frequently, while going to a website, I will get the message "IE cannot display the page". If I click on the "Diagnose Connection" box shown, the website will then come up. Have you seen anything in my logs that may cause this? I have a new cable from the phone connection to the computer, even though this has been happening even before I installed the new cable. Thanks for all your help. Ron
Post #10 last edited
Hi,

Your issues do not seem to be malware related.

I suggest you start a new topic in our Browsers and Internet forum. where our expert tech guru's will likely be able to resolve your problems.


Link back to this topic so they can see you are clean of malware.

There are a couple of things in your logs:

~~~~~~~~~~~~

avast! Antivirus
Avira AntiVir Personal - Free Antivirus

Having more than one antivirus can cause system instability, slowdowns and crashes, resulting in less protection, not more. Un-install one of them.

~~~~~~~~~~~

Adobe Reader 8.1.6

Your reader is out of date - Visit ADOBEand download the latest version of Acrobat Reader (version 9.1)
Having the latest updates ensures there are no security vulnerabilities in your system.

~~~~~~~~~~~

Go into your Control Panel > Add/Remove programs and remove the following program

Java™ SE Runtime Environment 6 Update 1

(leave Java™ version 6 update 14 in place as it is the latest version)
Post #11
Catbyte, I was a little hasty in my conclusion– my computer still goes online by itself. Also, I use Avast only for a weekly scan, the rest of the time it is off. I deactivate Avira when running the Avast scan. I uninstalled the Java program. I have been unable so far to get Adobe to run, their website caused my computer to slow to 20-30 bytes per minute. (Yes, bytes per minute! A browser problem, perhaps?) Ron
Post #13
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI