What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] BSoD started while using Facebook

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello! Before 2 days my PC displayed the BSoD while i was on facebook. It crashed (with bsod reboot) yesterday again while beeing on facebook. The third time it happened while browsing another site on the internet. Today I installed IE8 (wich I postponed for a long time, lazy me) hoping it would solve the problem. After the rebooting during the instalation it displayed the BSoD again and rebooted again. I have the free avast anti-virus. Yesterday before the third crash I used Malwarebytes anti-malware and it found one problem and fixed it. Thanks in advance. Here are my logs ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/09/03 13:54 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP2 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xBAD6F000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7E0D000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP2470 Image Path: \Driver\PCI_PNP2470 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB7AF3000 Size: 49152 File Visible: No Signed: - Status: - Name: spgz.sys Image Path: spgz.sys Address: 0xF7742000 Size: 1048576 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - SSDT ——————- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f6b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8fa52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f14c #: 071 Function Name: NtEnumerateKey Status: Hooked by "spgz.sys" at address 0xf7761ca2 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "spgz.sys" at address 0xf7762030 #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f64e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f08c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f0f0 #: 160 Function Name: NtQueryKey Status: Hooked by "spgz.sys" at address 0xf7762108 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f76e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f72e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xbad8f8ae ==EOF== DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 13:52:11.09 on Thu 09/03/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.560 [GMT -4:00] AV: avast! antivirus 4.8.1351 [VPS 090903-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NetAssistant\bin\mpbtn.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Marina\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uWindow Title = Microsoft Internet Explorer provided by Sympatico BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe" mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe mRun: [InCD] c:\program files\ahead\incd\InCD.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [Motive SmartBridge] c:\progra~1\netass~1\smartb~1\MotiveSB.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\documents and settings\marina\start menu\programs\startup\PowerReg Scheduler V3.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netass~1.lnk - c:\program files\netassistant\bin\matcli.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://msn.worldwinner.com/games/v47/shared/FunGamesLoader.cab DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab DPF: {555F1BBC-6EC2-474F-84AF-633EF097FF54} - hxxp://www.worldwinner.com/games/v52/wwhearts/wwhearts.cab DPF: {61900274-3323-4446-BDCD-91548D32AF1B} - hxxp://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://news.beograd.com/AxisCamControl.ocx DPF: {97438FE9-D361-4279-BA82-98CC0877A717} - hxxp://www.worldwinner.com/games/v57/cubis/cubis.cab DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} - hxxp://www.worldwinner.com/games/v41/hangman/hangman.cab DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} - hxxp://www.worldwinner.com/games/v46/monopoly/monopoly.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} - hxxp://www.worldwinner.com/games/v50/dinerdash/dinerdash.cab DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} - hxxp://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} - hxxp://www.worldwinner.com/games/v53/wwspades/wwspades.cab TCP: {C6060A71-B340-47DE-A18D-539B705E7082} = 67.69.236.1 207.164.234.193 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\marina\applic~1\mozilla\firefox\profiles\wwzvjfjf.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2008-8-10 9344] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-8-10 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-8-10 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-8-10 138680] R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2008-8-10 468480] R2 ithsgt;ithsgt;c:\windows\system32\drivers\ithsgt.sys [2008-12-4 162432] R2 lilsgt;lilsgt;c:\windows\system32\drivers\lilsgt.sys [2008-12-4 12032] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-8-10 254040] S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-8-10 352920] =============== Created Last 30 ================ 2009-09-03 10:56 –dsh— c:\documents and settings\marina\IECompatCache 2009-09-03 10:53 –dsh— c:\documents and settings\marina\PrivacIE 2009-09-03 10:43 –dsh— c:\documents and settings\marina\IETldCache 2009-09-03 10:35 100,352 -c—— c:\windows\system32\dllcache\iecompat.dll 2009-09-03 10:35 –d—– c:\windows\ie8updates 2009-09-03 10:34 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll 2009-09-03 10:34 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll 2009-09-03 10:32 -cd-h— c:\windows\ie8 2009-09-03 02:22 –d—– c:\docume~1\marina\applic~1\Malwarebytes 2009-09-03 02:22 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-03 02:22 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-09-03 02:22 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-09-03 02:22 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-09-01 00:31 –d—– c:\docume~1\alluse~1\applic~1\Kristanix Games 2009-08-29 14:13 90,624 ac—— c:\windows\system32\dllcache\kswdmcap.ax 2009-08-29 14:13 28,672 ac—— c:\windows\system32\dllcache\vidcap.ax 2009-08-29 14:13 90,624 a——- c:\windows\system32\kswdmcap.ax 2009-08-29 14:13 28,672 a——- c:\windows\system32\vidcap.ax 2009-08-29 14:13 61,952 ac—— c:\windows\system32\dllcache\kstvtune.ax 2009-08-29 14:13 53,760 ac—— c:\windows\system32\dllcache\vfwwdm32.dll 2009-08-29 14:13 61,952 a——- c:\windows\system32\kstvtune.ax 2009-08-29 14:13 53,760 a——- c:\windows\system32\vfwwdm32.dll 2009-08-29 14:13 43,008 ac—— c:\windows\system32\dllcache\ksxbar.ax 2009-08-29 14:13 43,008 a——- c:\windows\system32\ksxbar.ax 2009-08-29 14:13 30,921 a——- c:\windows\system32\drivers\SQCaptur.sys 2009-08-29 14:13 25,449 a——- c:\windows\system32\drivers\SQCamD.sys 2009-08-27 00:06 56 a—h— c:\windows\system32\ezsidmv.dat 2009-08-26 23:58 –d–r– c:\program files\Skype 2009-08-19 00:14 –d—– c:\docume~1\alluse~1\applic~1\SuperRanch 2009-08-19 00:07 –d—– c:\docume~1\alluse~1\applic~1\iWin Games 2009-08-18 02:07 –d—– c:\docume~1\marina\applic~1\GraveyardShift 2009-08-18 01:37 –d—– c:\windows\ServicePackFiles 2009-08-12 01:27 –d—– c:\program files\LeeGTs Games 2009-08-12 01:04 –d—– c:\docume~1\alluse~1\applic~1\FarmFrenzy3 2009-08-12 01:03 –d—– c:\windows\Farm Frenzy 3 2009-08-06 23:09 –d—– c:\program files\Edge 2009-08-06 02:32 –d—– c:\docume~1\alluse~1\applic~1\GoBit Games ==================== Find3M ==================== 2009-08-05 05:11 204,800 ——– c:\windows\system32\mswebdvd.dll 2009-07-17 14:55 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 02:18 233,472 ——– c:\windows\system32\wmpdxm.dll 2009-07-03 13:09 915,456 a——- c:\windows\system32\wininet.dll 2009-06-25 04:44 298,496 a——- c:\windows\system32\kerberos.dll 2009-06-25 04:44 168,448 a——- c:\windows\system32\schannel.dll 2009-06-25 04:44 133,632 a——- c:\windows\system32\msv1_0.dll 2009-06-25 04:44 59,392 a——- c:\windows\system32\wdigest.dll 2009-06-25 04:44 56,320 a——- c:\windows\system32\secur32.dll 2009-06-25 04:44 724,480 ——– c:\windows\system32\lsasrv.dll 2009-06-16 10:55 119,808 ——– c:\windows\system32\t2embed.dll 2009-06-16 10:55 82,432 ——– c:\windows\system32\fontsub.dll 2009-06-12 07:50 76,288 ——– c:\windows\system32\telnet.exe 2009-06-12 01:01 4,096 a——- c:\windows\d3dx.dat 2009-06-10 10:21 84,992 a——- c:\windows\system32\avifil32.dll 2009-06-10 02:32 132,096 ——– c:\windows\system32\wkssvc.dll ============= FINISH: 13:52:38.28 ===============

Attachments:

Post #2
Hello and welcome to WTT.

I apologize for the delay in response.

If you still require assistance post a new set of DDS Logs and a description of any remaining problems or symptoms you may still have please.

Download and run DDS

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results soon.
  • Follow the instructions that pop up for posting the results and then click Ok.
  • The black and message box window shall then disappear.
  • Please save both log files on your desktop and post the DDS.txt and zip up and attach Attach.txt as instructed.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

Then, please run RootRepeal:

Download and run RootRepeal CR

Please download RootRepeal to your desktop
Alternative Download Link 2
Alternative Download Link 3
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Unzip it to it's own folder
  • Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  • Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator…
  • Click the Report tab at the bottom.
  • Now click the Scan button in the Report Tab. [external image: Posted Image]
  • A box will pop up, check the boxes beside ALL Seven options/scan area
    🖼Click to load external image (Posted Image)
  • Now click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button. [external image: Posted Image]
  • Save it as RepealScan and save it to your desktop
  • Reconnect to the internet.
  • Post the contents of that log in your reply please.

For your next reply I would like to see:
-The DDS logs
—DDS.txt and Attach logs
-RootRepeal logs
-Description of any remaining problems you may still have.

Thanks again and we apologize for the delay.

With Regards,
Extremeboy
Post #3
Thank you for replying. DDS.txt log- DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 10:41:42.56 on Tue 09/08/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.599 [GMT -4:00] AV: avast! antivirus 4.8.1351 [VPS 090907-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NetAssistant\bin\mpbtn.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Marina\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uWindow Title = Microsoft Internet Explorer provided by Sympatico BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe" mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe mRun: [InCD] c:\program files\ahead\incd\InCD.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [Motive SmartBridge] c:\progra~1\netass~1\smartb~1\MotiveSB.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRunOnce: [Uninstall Adobe Download Manager] "c:\windows\system32\rundll32.exe" "c:\program files\nos\bin\getPlus_Helper.dll",Uninstall /Get1noarp dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\documents and settings\marina\start menu\programs\startup\PowerReg Scheduler V3.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netass~1.lnk - c:\program files\netassistant\bin\matcli.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://msn.worldwinner.com/games/v47/shared/FunGamesLoader.cab DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab DPF: {555F1BBC-6EC2-474F-84AF-633EF097FF54} - hxxp://www.worldwinner.com/games/v52/wwhearts/wwhearts.cab DPF: {61900274-3323-4446-BDCD-91548D32AF1B} - hxxp://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://news.beograd.com/AxisCamControl.ocx DPF: {97438FE9-D361-4279-BA82-98CC0877A717} - hxxp://www.worldwinner.com/games/v57/cubis/cubis.cab DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} - hxxp://www.worldwinner.com/games/v41/hangman/hangman.cab DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} - hxxp://www.worldwinner.com/games/v46/monopoly/monopoly.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} - hxxp://www.worldwinner.com/games/v50/dinerdash/dinerdash.cab DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} - hxxp://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} - hxxp://www.worldwinner.com/games/v53/wwspades/wwspades.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\marina\applic~1\mozilla\firefox\profiles\wwzvjfjf.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\documents and settings\marina\application data\mozilla\firefox\profiles\wwzvjfjf.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2008-8-10 9344] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-8-10 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-8-10 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-8-10 138680] R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2008-8-10 468480] R2 ithsgt;ithsgt;c:\windows\system32\drivers\ithsgt.sys [2008-12-4 162432] R2 lilsgt;lilsgt;c:\windows\system32\drivers\lilsgt.sys [2008-12-4 12032] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-8-10 352920] S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-8-10 254040] S3 getPlusHelper;getPlus® Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2004-8-4 14336] =============== Created Last 30 ================ 2009-09-05 14:21 1,409 a——- c:\windows\QTFont.for 2009-09-05 14:21 54,156 a—h— c:\windows\QTFont.qfn 2009-09-03 10:56 –dsh— c:\documents and settings\marina\IECompatCache 2009-09-03 10:53 –dsh— c:\documents and settings\marina\PrivacIE 2009-09-03 10:43 –dsh— c:\documents and settings\marina\IETldCache 2009-09-03 10:35 100,352 -c—— c:\windows\system32\dllcache\iecompat.dll 2009-09-03 10:35 –d—– c:\windows\ie8updates 2009-09-03 10:34 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll 2009-09-03 10:34 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll 2009-09-03 10:32 -cd-h— c:\windows\ie8 2009-09-03 02:22 –d—– c:\docume~1\marina\applic~1\Malwarebytes 2009-09-03 02:22 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-03 02:22 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-09-03 02:22 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-09-03 02:22 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-09-01 00:31 –d—– c:\docume~1\alluse~1\applic~1\Kristanix Games 2009-08-29 14:13 90,624 ac—— c:\windows\system32\dllcache\kswdmcap.ax 2009-08-29 14:13 28,672 ac—— c:\windows\system32\dllcache\vidcap.ax 2009-08-29 14:13 90,624 a——- c:\windows\system32\kswdmcap.ax 2009-08-29 14:13 28,672 a——- c:\windows\system32\vidcap.ax 2009-08-29 14:13 61,952 ac—— c:\windows\system32\dllcache\kstvtune.ax 2009-08-29 14:13 53,760 ac—— c:\windows\system32\dllcache\vfwwdm32.dll 2009-08-29 14:13 61,952 a——- c:\windows\system32\kstvtune.ax 2009-08-29 14:13 53,760 a——- c:\windows\system32\vfwwdm32.dll 2009-08-29 14:13 43,008 ac—— c:\windows\system32\dllcache\ksxbar.ax 2009-08-29 14:13 43,008 a——- c:\windows\system32\ksxbar.ax 2009-08-29 14:13 30,921 a——- c:\windows\system32\drivers\SQCaptur.sys 2009-08-29 14:13 25,449 a——- c:\windows\system32\drivers\SQCamD.sys 2009-08-27 00:06 56 a—h— c:\windows\system32\ezsidmv.dat 2009-08-26 23:58 –d–r– c:\program files\Skype 2009-08-19 00:14 –d—– c:\docume~1\alluse~1\applic~1\SuperRanch 2009-08-19 00:07 –d—– c:\docume~1\alluse~1\applic~1\iWin Games 2009-08-18 02:07 –d—– c:\docume~1\marina\applic~1\GraveyardShift 2009-08-18 01:37 –d—– c:\windows\ServicePackFiles 2009-08-12 01:27 –d—– c:\program files\LeeGTs Games 2009-08-12 01:04 –d—– c:\docume~1\alluse~1\applic~1\FarmFrenzy3 2009-08-12 01:03 –d—– c:\windows\Farm Frenzy 3 ==================== Find3M ==================== 2009-08-05 05:11 204,800 ——– c:\windows\system32\mswebdvd.dll 2009-07-17 14:55 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 02:18 233,472 ——– c:\windows\system32\wmpdxm.dll 2009-07-03 13:09 915,456 a——- c:\windows\system32\wininet.dll 2009-06-25 04:44 298,496 a——- c:\windows\system32\kerberos.dll 2009-06-25 04:44 168,448 a——- c:\windows\system32\schannel.dll 2009-06-25 04:44 133,632 a——- c:\windows\system32\msv1_0.dll 2009-06-25 04:44 59,392 a——- c:\windows\system32\wdigest.dll 2009-06-25 04:44 56,320 a——- c:\windows\system32\secur32.dll 2009-06-25 04:44 724,480 ——– c:\windows\system32\lsasrv.dll 2009-06-16 10:55 119,808 ——– c:\windows\system32\t2embed.dll 2009-06-16 10:55 82,432 ——– c:\windows\system32\fontsub.dll 2009-06-12 07:50 76,288 ——– c:\windows\system32\telnet.exe 2009-06-12 01:01 4,096 a——- c:\windows\d3dx.dat ============= FINISH: 10:42:13.85 =============== RepealScan.txt – ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/09/08 11:06 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP2 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xBA63F000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7DAD000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP2518 Image Path: \Driver\PCI_PNP2518 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB3AC2000 Size: 49152 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: spwj.sys Image Path: spwj.sys Address: 0xF7742000 Size: 1048576 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: C:\hiberfil.sys Status: Locked to the Windows API! SSDT ——————- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f6b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65fa52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f14c #: 071 Function Name: NtEnumerateKey Status: Hooked by "spwj.sys" at address 0xf7761ca2 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "spwj.sys" at address 0xf7762030 #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f64e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f08c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f0f0 #: 160 Function Name: NtQueryKey Status: Hooked by "spwj.sys" at address 0xf7762108 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f76e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f72e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba65f8ae Stealth Objects ——————- Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP] Process: System Address: 0x867671f8 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_CREATE] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_CLOSE] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_READ] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_WRITE] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_SET_INFORMATION] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_CLEANUP] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: UdfsЅఎ桇扡쪀櫀櫀, IRP_MJ_PNP] Process: System Address: 0x85f4f500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP] Process: System Address: 0x86462430 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE] Process: System Address: 0x867681f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE] Process: System Address: 0x867681f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x867681f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x867681f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_POWER] Process: System Address: 0x867681f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x867681f8 Size: 121 Object: Hidden Code [Driver: atapi, IRP_MJ_PNP] Process: System Address: 0x867681f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE] Process: System Address: 0x865ce1f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE] Process: System Address: 0x865ce1f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x865ce1f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x865ce1f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER] Process: System Address: 0x865ce1f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x865ce1f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP] Process: System Address: 0x865ce1f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP] Process: System Address: 0x867d91f8 Size: 121 Object: Hidden Code [Driver: aktsh4w3ȅ瑎獆ȁᰌ蓀虁έ@, IRP_MJ_CREATE] Process: System Address: 0x86444468 Size: 121 Object: Hidden Code [Driver: aktsh4w3ȅ瑎獆ȁᰌ蓀虁έ@, IRP_MJ_CLOSE] Process: System Address: 0x86444468 Size: 121 Object: Hidden Code [Driver: aktsh4w3ȅ瑎獆ȁᰌ蓀虁έ@, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x86444468 Size: 121 Object: Hidden Code [Driver: aktsh4w3ȅ瑎獆ȁᰌ蓀虁έ@, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x86444468 Size: 121 Object: Hidden Code [Driver: aktsh4w3ȅ瑎獆ȁᰌ蓀虁έ@, IRP_MJ_POWER] Process: System Address: 0x86444468 Size: 121 Object: Hidden Code [Driver: aktsh4w3ȅ瑎獆ȁᰌ蓀虁έ@, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x86444468 Size: 121 Object: Hidden Code [Driver: aktsh4w3ȅ瑎獆ȁᰌ蓀虁έ@, IRP_MJ_PNP] Process: System Address: 0x86444468 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE] Process: System Address: 0x85e66340 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE] Process: System Address: 0x85e66340 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x85e66340 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x85e66340 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP] Process: System Address: 0x85e66340 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP] Process: System Address: 0x85e66340 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE] Process: System Address: 0x8649d1f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE] Process: System Address: 0x8649d1f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8649d1f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8649d1f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER] Process: System Address: 0x8649d1f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8649d1f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP] Process: System Address: 0x8649d1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP] Process: System Address: 0x85ebf1f8 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_CREATE] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_CLOSE] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_READ] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_SET_INFORMATION] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_SHUTDOWN] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_CLEANUP] Process: System Address: 0x85f0a500 Size: 121 Object: Hidden Code [Driver: Cdfsࠅ䵃慖ࠁం扏楄䭰劀ࠂఆ剒敬, IRP_MJ_PNP] Process: System Address: 0x85f0a500 Size: 121 ==EOF== I didn't have any more appearances of the BSoD, but I used mostly Mozzila Firefox for browsing the net. Also I forgot to mention that I connected a web camera prior to my problems for using with skype. After all the episodes of the BSoD a disabled the camera in the Device Manager. Thank you again.

Attachments:

  • [attachment removed: Attach.zip]
Post #4
That's good to know.

Please update Java and run an online scan.

Update Java to Version 6 Update 16

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 16.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u16-windows-i586.exe to install the newest version.
– If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
– If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
– The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

Run Scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.


  • Open the Kaspersky WebScanner
    page.
  • Click on the 🖼Click to load external image (Posted Image) button on the main page.
  • The program will launch and fill in the Information section on the left.
  • Read the "Requirements and Limitations" then press the 🖼Click to load external image (Posted Image) button.
  • The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.
  • Once the files have been downloaded, click on the 🖼Click to load external image (Posted Image) …button.
    In the scan settings make sure the following are selected:
    • Detect malicious programs of the following categories:
      Viruses, Worms, Trojan Horses, Rootkits
      Spyware, Adware, Dialers and other potentially dangerous programs
    • Scan compound files (doesn't apply to the File scan area):
      Archives
      Mail databases
      By default the above items should already be checked.
    • Click the 🖼Click to load external image (Posted Image) button, if you made any changes.
  • Now under the Scan section on the left:

    Select My Computer
  • The program will now start and scan your system. This will run for a while, be patient and let it finish.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
You can refer to this animation by sundavis if needed.

Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply. Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.

Thanks.

With Regards,
Extremeboy
Post #5
I did the first half of what you asked me to do - Update Java to Version 6 Update 16 .. but when trying to do the other half (Scan with Kaspersky) I had problems. After the download it started the update and then I got a window with the next text: "Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program. You must be online to update the Kaspersky Online Scanner 7 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7. [ERROR: Key is expired]" Then when closing this one another window popped: "Starting Java applet has failed! Please go online to use this program." I have tried this for 5 times from the start (closing the internet browser and opening it again and even rebooting the pc) and always got the same errors. And I disabled my Avast AV program while doing the above. At the end I uninstalled Java Version 6 Update 16 and re-installed it again, but the problem with Kaspersky online scan remains. Waiting for your instructions. Thanks in advance.
Post #6
Hello.

Sorry about that. Kaspersky is having some issues lately. Run ESET instead…

Run ESET Online Scan

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
You can refer to this animation by neomage if needed.
Post #7
I have done the ESET Online Scan and it found no threats. " No threats found. Scanned files: 249 Infected files:0 Cleaned files:0 Total scan time: 00:01:05 Scan status: Finished " Before the scan I had the BSoD again today, while opening a web page from Skype Help Menu. These days while I had no BSoD happenings, Skype was turned off, and now when I think of it, these episodes with BSod always occured while Skype being on. Please advise. Thank you.
Post #8
Hello.

Can you tell me the BSOD error code and message? In fact, it may be best if you start a topic here regarding BSOD errors you receive and a Tech helper can help you out: http://forums.whatthetech.com/Microsoft_Windows_f119.html

You seem to be free of malware run the following and post the results so I can see if there's anything else as requested in my earlier reply please. Thanks.

Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply. Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.

Thanks.

With Regards,
Extremeboy

Post #9
DDS.txt DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 23:26:35.25 on Thu 09/10/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.617 [GMT -4:00] AV: avast! antivirus 4.8.1351 [VPS 090910-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NetAssistant\bin\mpbtn.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Documents and Settings\Marina\Desktop\Instalacije\Snippy.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Documents and Settings\Marina\Desktop\Whatthetech - Forum za repair computera\Post 1\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uWindow Title = Microsoft Internet Explorer provided by Sympatico BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe" mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe mRun: [InCD] c:\program files\ahead\incd\InCD.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [Motive SmartBridge] c:\progra~1\netass~1\smartb~1\MotiveSB.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\documents and settings\marina\start menu\programs\startup\PowerReg Scheduler V3.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netass~1.lnk - c:\program files\netassistant\bin\matcli.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://msn.worldwinner.com/games/v47/shared/FunGamesLoader.cab DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab DPF: {555F1BBC-6EC2-474F-84AF-633EF097FF54} - hxxp://www.worldwinner.com/games/v52/wwhearts/wwhearts.cab DPF: {61900274-3323-4446-BDCD-91548D32AF1B} - hxxp://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://news.beograd.com/AxisCamControl.ocx DPF: {97438FE9-D361-4279-BA82-98CC0877A717} - hxxp://www.worldwinner.com/games/v57/cubis/cubis.cab DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} - hxxp://www.worldwinner.com/games/v41/hangman/hangman.cab DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} - hxxp://www.worldwinner.com/games/v46/monopoly/monopoly.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} - hxxp://www.worldwinner.com/games/v50/dinerdash/dinerdash.cab DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} - hxxp://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} - hxxp://www.worldwinner.com/games/v53/wwspades/wwspades.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\marina\applic~1\mozilla\firefox\profiles\wwzvjfjf.default\ FF - prefs.js: browser.startup.homepage - www.google.com FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\veetle\player\npvlc.dll FF - plugin: c:\program files\veetle\plugins\npVeetle.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2008-8-10 9344] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-8-10 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-8-10 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-8-10 138680] R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2008-8-10 468480] R2 ithsgt;ithsgt;c:\windows\system32\drivers\ithsgt.sys [2008-12-4 162432] R2 lilsgt;lilsgt;c:\windows\system32\drivers\lilsgt.sys [2008-12-4 12032] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-8-10 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-8-10 352920] =============== Created Last 30 ================ 2009-09-10 20:01 –d—– c:\program files\Veetle 2009-09-09 16:59 –d—– c:\program files\ESET 2009-09-08 23:52 73,728 a——- c:\windows\system32\javacpl.cpl 2009-09-05 14:21 1,409 a——- c:\windows\QTFont.for 2009-09-05 14:21 54,156 a—h— c:\windows\QTFont.qfn 2009-09-03 10:56 –dsh— c:\documents and settings\marina\IECompatCache 2009-09-03 10:53 –dsh— c:\documents and settings\marina\PrivacIE 2009-09-03 10:43 –dsh— c:\documents and settings\marina\IETldCache 2009-09-03 10:35 100,352 -c—— c:\windows\system32\dllcache\iecompat.dll 2009-09-03 10:35 –d—– c:\windows\ie8updates 2009-09-03 10:34 246,272 -c—— c:\windows\system32\dllcache\ieproxy.dll 2009-09-03 10:34 12,800 -c—— c:\windows\system32\dllcache\xpshims.dll 2009-09-03 10:32 -cd-h— c:\windows\ie8 2009-09-03 02:22 –d—– c:\docume~1\marina\applic~1\Malwarebytes 2009-09-03 02:22 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-03 02:22 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-09-03 02:22 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-09-03 02:22 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-09-01 00:31 –d—– c:\docume~1\alluse~1\applic~1\Kristanix Games 2009-08-29 14:13 90,624 ac—— c:\windows\system32\dllcache\kswdmcap.ax 2009-08-29 14:13 28,672 ac—— c:\windows\system32\dllcache\vidcap.ax 2009-08-29 14:13 90,624 a——- c:\windows\system32\kswdmcap.ax 2009-08-29 14:13 28,672 a——- c:\windows\system32\vidcap.ax 2009-08-29 14:13 61,952 ac—— c:\windows\system32\dllcache\kstvtune.ax 2009-08-29 14:13 53,760 ac—— c:\windows\system32\dllcache\vfwwdm32.dll 2009-08-29 14:13 61,952 a——- c:\windows\system32\kstvtune.ax 2009-08-29 14:13 53,760 a——- c:\windows\system32\vfwwdm32.dll 2009-08-29 14:13 43,008 ac—— c:\windows\system32\dllcache\ksxbar.ax 2009-08-29 14:13 43,008 a——- c:\windows\system32\ksxbar.ax 2009-08-29 14:13 30,921 a——- c:\windows\system32\drivers\SQCaptur.sys 2009-08-29 14:13 25,449 a——- c:\windows\system32\drivers\SQCamD.sys 2009-08-27 00:06 56 a—h— c:\windows\system32\ezsidmv.dat 2009-08-26 23:58 –d–r– c:\program files\Skype 2009-08-19 00:14 –d—– c:\docume~1\alluse~1\applic~1\SuperRanch 2009-08-19 00:07 –d—– c:\docume~1\alluse~1\applic~1\iWin Games 2009-08-18 02:07 –d—– c:\docume~1\marina\applic~1\GraveyardShift 2009-08-18 01:37 –d—– c:\windows\ServicePackFiles 2009-08-12 01:27 –d—– c:\program files\LeeGTs Games 2009-08-12 01:04 –d—– c:\docume~1\alluse~1\applic~1\FarmFrenzy3 2009-08-12 01:03 –d—– c:\windows\Farm Frenzy 3 ==================== Find3M ==================== 2009-09-08 23:52 411,368 a——- c:\windows\system32\deploytk.dll 2009-08-05 05:11 204,800 ——– c:\windows\system32\mswebdvd.dll 2009-07-17 14:55 58,880 a——- c:\windows\system32\atl.dll 2009-07-13 02:18 233,472 ——– c:\windows\system32\wmpdxm.dll 2009-07-03 13:09 915,456 a——- c:\windows\system32\wininet.dll 2009-06-25 04:44 298,496 a——- c:\windows\system32\kerberos.dll 2009-06-25 04:44 168,448 a——- c:\windows\system32\schannel.dll 2009-06-25 04:44 133,632 a——- c:\windows\system32\msv1_0.dll 2009-06-25 04:44 59,392 a——- c:\windows\system32\wdigest.dll 2009-06-25 04:44 56,320 a——- c:\windows\system32\secur32.dll 2009-06-25 04:44 724,480 ——– c:\windows\system32\lsasrv.dll 2009-06-16 10:55 119,808 ——– c:\windows\system32\t2embed.dll 2009-06-16 10:55 82,432 ——– c:\windows\system32\fontsub.dll ============= FINISH: 23:27:10.28 ===============

Attachments:

  • [attachment removed: Attach.zip]
Post #10
Hello. Can you let me know how your computer is running and if you have any more problems, issues or symptoms left? The BSOD you can start a new topic in the Windows forums afterwards. The log looks okay. With Regards, Extremeboy
Post #12
Looks good. We can cleanup then.

Please follow/read the steps below to remove the tools we used, purge a system restore and for some more information. :)

Cleanup! with OTM

Let's remove all the tools we've used so far using OTM

  • Double click the [external image: Posted Image] icon on your desktop to run it. If you are using Vista, please right-click and choose run as administrator.
  • Now Click the [external image: Posted Image] at the top.
  • You will recieve a prompt saying "Being Cleanup Process?" Please press Yes
  • If required for a reboot click Yes
  • Delete OTM.exe if does not get automatically deleted upon reboot.

Create a New System Restore Point<- Very Important

Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok"
  • Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" Tab.
  • Click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

System A bit Slow? Try StartupLight

You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve preformance.

If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.

Congratulations! You now appear clean! :D

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.

Disable Autorun on Flash-Drive/Removable Drives

When is AUTORUN.INF really an AUTORUN.INF?

USB worms work by creating a file called AUTORUN.INF on the root of USB drives. These INF files then use Autorun or Autoplay (not the same thing!) to execute themselves either when the stick is inserted, or more commonly, when the user double-clicks on the USB drive icon from My Computer (Windows Explorer)…


Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. Read USB-Based Malware Attacks and Please disable Autorun asap!.

If using Windows Vista, please refer to:
"Disable AutoPlay in Windows Vista"
"Preventing AutoPlay with Local Group Policy Editor or AutoPlay options panel"

Note: When Autorun is disabled, double-clicking a drive which has autorun.inf in its root directory may still activate Autorun so be careful.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Update all programs regularly - Make sure you update all the programs you have installed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

If you have no more questions, comments or problems please tell us, so we can close off the topic.

Thanks :)

With Regards,
Extremeboy
Post #13
Hello! I haven't done those last steps yet (I will), but just to let you know that I've got another bsod yesterday and I should probably post this problem in the other section as you previously mentioned. The BSoD always reffers strangely to different Avast AV files and ntoskernel.exe. It might be the driver for the camera - it's an old one and there is no updates (I looked). Well my comp is old too so there it is. Thanks anyways, it's sure good to know that I'm malaware/virus free :D
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI