What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Laptop still sluggish after Trojan.FakeAlert

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My laptop was crippled from a Trojan.FakeAlert. I had went to my yahoo mail and I got a notice from avast that one of the ads on that site was infected with js:pdfka-tw. It gave me all sorts of messages and even changed my desktop wallpaper. Malwarebytes got rid of a lot of things but the laptop is still acting sluggish so I wanted to make sure it's clean. I'm running Windows XP Media Center Edition 2005 with Service Pack 3. Here is the information that the sticky mentioned I should include:

I ran the ATF Cleaner (leaving firefox passwords)
I re-enabled system restore (I disabled it after the virus so I couldn't get it back from system restore) and made a restore point using the system restore program.
I ran ERUNT
Below are the MBAM, GMER, and DDS logs

MBAM:
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 6.0.2900.5512

1/27/2010 1:08:08 PM
mbam-log-2010-01-27 (13-08-08).txt

Scan type: Full Scan (C:\|)
Objects scanned: 183063
Time elapsed: 1 hour(s), 4 minute(s), 15 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 11
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
C:\WINDOWS\system32\smss32.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\winlogon32.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\helper32.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Winlogon32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\41.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

GMER
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 6.0.2900.5512

1/27/2010 1:08:08 PM
mbam-log-2010-01-27 (13-08-08).txt

Scan type: Full Scan (C:\|)
Objects scanned: 183063
Time elapsed: 1 hour(s), 4 minute(s), 15 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 11
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
C:\WINDOWS\system32\smss32.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\winlogon32.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\helper32.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Winlogon32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\41.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

DDS

DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 17:24:26.17 on Wed 01/27/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1279.705 [GMT -6:00]

AV: avast! antivirus 4.8.1368 [VPS 100127-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\The Skins Factory\Hyperdesk\Common\HdThemeEnabler.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\WinKey\WinKey.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\astsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe
C:\Program Files\Adobe\Acrobat 5.0\Acrobat\Acrobat.exe
C:\Program Files\Common Files\Adobe\Web\AOM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\pc cleaning stuff\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\acrobat\activex\AcroIEHelper.ocx
BHO: AhIeBho Class: {10384d0e-2bc1-48b6-844b-ad0e9e6d2511} - c:\program files\zoomtext 9.1\ahoi\ah_ie_bho.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
uRun: [cdloader] "c:\documents and settings\duh\application data\mjusbsp\cdloader2.exe" MAGICJACK
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet
mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [srmclean] c:\cpqs\scom\srmclean.exe
mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking10\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking10\Ereg.ini
mRun: [QuickTime Task] "c:\program files\quicktime alternative\qttask.exe" -atboottime
mRun: [Cm106Sound] RunDll32 CM106.cpl,CMICtrlWnd
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\gw micro\we711\weproxea.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winkey.lnk - c:\program files\winkey\WinKey.exe
IE: Download all by Net Transport - c:\program files\xi\nettransport 2\NTAddList.html
IE: Download by Net Transport - c:\program files\xi\nettransport 2\NTAddLink.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {0413D626-1428-4CA9-BA4C-257DE44FC15A} - hxxp://prod.p2wcentral.com/transformations/iedownload.CAB
DPF: {32DCBA0E-9D05-11D3-A8FB-444553540000} - hxxp://prod.p2wcentral.com/ads/2.0/ActiveX/imagxpress5.cab
DPF: {40289096-9F72-4A04-BCB3-E434ECDCEE33} - hxxp://download.howudodat.com/chatterbox/download/appdl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1250714276234
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257829535812
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: wineyes - welogon.dll
AppInit_DLLs: GWMHOOK.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\duh\applic~1\mozilla\firefox\profiles\phkoqimd.default\
FF - prefs.js: browser.search.selectedEngine - YouTube
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\duh\application data\move networks\plugins\npqmp071505000010.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300

============= SERVICES / DRIVERS ===============

R1 Ai2sXP;Ai2sXP;c:\windows\system32\drivers\Ai2sXP.sys [2009-10-31 7296]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-8-19 114768]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2003-3-31 14336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-3 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-8-19 138680]
R2 HdThemeEnabler;Hyperdesk Theme Enabler;c:\program files\the skins factory\hyperdesk\common\HdThemeEnabler.exe [2008-7-7 102400]
R2 multikey;Virtual USB MultiKey;c:\windows\system32\drivers\multikey.sys [2009-9-3 90112]
R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2003-3-31 5120]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-8-19 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-8-19 352920]
R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [2009-8-19 68480]
R3 NTProcDrv;Process creation detector for NT.;c:\windows\temp\drv1.tmp [2010-1-27 3584]
R3 SymSnapService;SymSnapService;c:\program files\norton ghost\shared\drivers\SymSnapService.exe [2007-12-20 1562096]
S3 CM1063264;C-Media CM106 Like Sound UDAX Interface;c:\windows\system32\drivers\CM106.sys [2009-10-14 1306112]
S3 JTVNCProxy_10.0;JTVNCProxy;c:\program files\freedom scientific\jaws\10.0\JTVNCProxy.exe [2008-10-22 17176]
S3 JTVNCProxy_11.0;JTVNCProxy_11.0;c:\program files\freedom scientific\jaws\11.0\JTVNCProxy.exe [2009-8-27 16152]
S3 PowerBrl;powerBraille System Driver;c:\windows\system32\drivers\powerbrl.sys [2009-8-27 14880]
S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM106.sys [2009-10-14 1306112]
S3 windoweyes;Window-Eyes;c:\program files\gw micro\we711\weserv.exe [2010-1-7 61440]

=============== Created Last 30 ================

2010-01-27 19:07:36 0 d—–w- C:\pc cleaning stuff
2010-01-27 19:00:42 0 —-a-w- c:\windows\system32\15724.exe
2010-01-27 17:13:27 0 —-a-w- c:\windows\system32\19169.exe
2010-01-27 16:53:27 0 —-a-w- c:\windows\system32\26500.exe
2010-01-27 03:22:39 0 —-a-w- c:\windows\system32\6334.exe
2010-01-27 03:02:39 0 —-a-w- c:\windows\system32\18467.exe
2010-01-27 02:47:47 0 d—–w- c:\docume~1\duh\applic~1\Malwarebytes
2010-01-27 02:47:36 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-27 02:47:34 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-27 02:47:34 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-27 02:47:33 0 d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-27 02:42:22 0 —-a-w- c:\windows\system32\IS15.exe
2010-01-27 02:41:35 2931 —-a-w- c:\windows\system32\warning.html
2010-01-27 02:37:33 1 —-a-w- C:\s
2010-01-21 19:52:48 0 d—–w- c:\program files\QuickMix2
2010-01-16 21:03:17 0 d—–w- c:\program files\3ivx
2010-01-16 21:02:52 0 d—–w- c:\program files\Pure Digital Technologies
2010-01-16 21:02:50 0 d—–w- c:\docume~1\alluse~1\applic~1\Pure Digital Technologies
2010-01-13 03:57:15 0 d—–w- c:\program files\Oberon Media
2010-01-11 17:18:42 0 d—–w- c:\program files\CCleaner
2010-01-10 22:11:28 0 d—–w- c:\docume~1\duh\applic~1\Dropbox
2010-01-09 19:47:19 0 d—–w- C:\WE Notes
2010-01-08 05:15:34 0 d—–w- c:\docume~1\duh\applic~1\GW Micro
2010-01-08 04:53:25 73 —-a-w- c:\windows\Setuptl.ini
2010-01-08 04:53:25 0 d—–w- c:\docume~1\alluse~1\applic~1\GW Micro
2010-01-08 04:53:15 73785 —-a-w- c:\windows\system32\welogon.dll
2010-01-08 04:53:15 53248 —-a-w- c:\windows\system32\gwmhook.dll
2010-01-08 04:53:15 43573 —-a-w- c:\windows\system32\gwmvid.dll
2010-01-08 04:53:15 43208 —-a-w- c:\windows\system32\gwmvidms.dll
2010-01-08 04:53:15 43208 —-a-w- c:\windows\system32\gwmvidcx.dll
2010-01-08 04:19:46 0 d—–w- c:\windows\system32\wbem\Repository
2010-01-08 04:03:41 0 d—–w- c:\program files\OfficeRecovery

==================== Find3M ====================

2010-01-27 02:43:51 2000000 —-atw- c:\windows\system32\HJSMEM.DAT
2010-01-11 17:59:45 516096 —-a-w- c:\windows\iwexec.exe
2009-12-12 02:41:37 1639 —-a-w- c:\docume~1\duh\applic~1\SAS7_000.DAT
2006-05-03 09:06:54 163328 –sh–r- c:\windows\system32\flvDX.dll
2007-02-21 10:47:16 31232 –sh–r- c:\windows\system32\msfDX.dll
2008-03-16 12:30:52 216064 –sh–r- c:\windows\system32\nbDX.dll

============= FINISH: 17:24:44.31 ===============


Thank you,
Brenda
Post #2
Hello christianirc and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instruction I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.
Post #5
Oops! You're right! Sorry about that.
GMER

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-27 17:21:02
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Duh\LOCALS~1\Temp\kxdirkob.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xB95B96B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xB95B9574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xB95B9A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xB95B914C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xB95B964E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xB95B908C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xB95B90F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xB95B976E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xB95B972E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xB95B98AE]


—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 symsnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

—- EOF - GMER 1.0.15 —-

DDS

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 8/19/2009 12:49:20 PM
System Uptime: 1/27/2010 1:52:59 PM (4 hours ago)

Motherboard: Hewlett-Packard | | 0880
Processor: Intel® Pentium® 4 CPU 3.06GHz | WMT478/NWD | 3059/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 38.908 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8139/810x Family Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_006A103C&REV_10\4&3A321F38&0&00F0
Manufacturer: Realtek
Name: Realtek RTL8139/810x Family Fast Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_006A103C&REV_10\4&3A321F38&0&00F0
Service: rtl8139

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\8000934E508B08
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\8000934E508B08
Service: NIC1394

==== System Restore Points ===================

RP192: 1/27/2010 1:29:48 PM - System Checkpoint
RP193: 1/27/2010 1:30:00 PM - Automatic Restore Point

==== Installed Programs ======================

3ivx MPEG-4 5.0.3 (remove only)
7-Zip 4.65
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
AI RoboForm (All Users)
Akamai NetSession Interface
Any Password 1.44
Apple Mobile Device Support
Apple Software Update
avast! Antivirus
BCL Jade5.0
BG Yahtzee 1.0
Bonjour
Broadcom 802.11
C-Media CM106 Like Sound Driver
C-Media USB 106 Sound
Camtasia Studio 6
CCleaner
Conexant 56K ACLink Modem
Conexant AC-Link Audio
CuteMAP
DeskPins (remove only)
Digsby
DQ Tycoon
Dragon NaturallySpeaking 10
Dropbox
EmailStripper 2.2
ERUNT 1.1j
FileZilla Client [removed]
FlipShare
Free Audio CD Burner version 1.2
Free YouTube to MP3 Converter version 3.2
Freedom Scientific Braille
Freedom Scientific Document Server
Freedom Scientific FSReader 2.0
Freedom Scientific JAWS 10.0
Freedom Scientific JAWS 11.0
Freedom Scientific JAWS 9.0
Freedom Scientific Synthesizer Eloquence
Freedom Scientific Talking Installer 10.0
Freedom Scientific Talking Installer 11.0
Freedom Scientific Talking Installer 9.0
Freedom Scientific Utilities
Freedom Scientific Video Intercept
Gadwin PrintScreen
GIMP 2.6.7
GoldWave v5.25
HoldEm
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
HotSpotClicker
HumanWare Companion
Hyperdesk - Sony Ericsson Onyx Series
InterVideo WinDVD
iTunes
Java™ 6 Update 16
Juice 2.2
LiveUpdate 3.2 (Symantec Corporation)
Malwarebytes' Anti-Malware
MediaInfo 0.7.22
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Office XP Professional with FrontPage
Microsoft Sapi 5.1
Microsoft Sapi5 voices for XP
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Move Media Player
Mozilla Firefox (3.0.17)
mp3 Joiner Version 2
MSN Messenger 7.0
Norton Ghost
NVIDIA Windows 2000/XP Display Drivers
Quick Launch Buttons 4.20 A4
QuickMix
QuickTime
QuickTime Alternative 2.9.0
RapidReader Version 6 Standard
Real Alternative 1.9.0
RealSpeak Solo 4.0 SAPI5 English/Spanish
RTLSetup for Realtek RTL8139/810x Family NIC 3.50 (OEM A)
RVL Hacker (1.00.097) (remove only)
Sentinel System Driver Installer 7.5.0
Skype web features
Skype™ 4.1
Spell Checker For OE 2.1
SUPER © Version 2009.bld.36 (June 10, 2009)
Synaptics Pointing Device Driver
TC Web Conferencing
TeamViewer 5
TuneUp Utilities 2008
TweetDeck
Uninstall 1.0.0.1
Visual C++ Runtime for Dragon NaturallySpeaking
VLC media player 1.0.1
Web Resizer 1.0.6
WebFldrs XP
Winamp
Window-Eyes 7.11
Windows 7 Upgrade Advisor
Windows Installer Clean Up
Windows Live installer
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3
WinKey
ZoomText 9.1
Zune Desktop Theme

==== Event Viewer Messages From Past Week ========

1/27/2010 11:22:20 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
1/27/2010 11:20:52 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
1/26/2010 9:26:05 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
1/26/2010 9:25:45 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
1/26/2010 9:25:06 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Aavmker4 AFD Ai2sXP aswSP aswTdi eabfiltr Fips intelppm IPSec MRxSmb NetBIOS NetBT NetworkX RasAcd Rdbss Tcpip
1/26/2010 9:25:06 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
1/26/2010 9:25:06 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/26/2010 9:25:06 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/26/2010 9:25:06 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
1/26/2010 9:25:06 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/26/2010 9:25:06 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

==== End Of File ===========================
Post #6
Brenda,

🖼Click to load external image (Posted Image) Please download OTM
  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Services
NTProcDrv

:Files
c:\windows\system32\15724.exe
c:\windows\system32\19169.exe
c:\windows\system32\26500.exe
c:\windows\system32\6334.exe
c:\windows\system32\18467.exe
c:\windows\system32\IS15.exe
c:\windows\system32\warning.html
C:\s
c:\windows\iwexec.exe

:Commands
[purity]
[emptytemp]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:
  • OTM log
  • MBAM log
  • Kaspersky log
  • Let me know how your computer is running
Post #7
I'm sorry, I'm unable to run the kapersky scan. My laptop overheats and shuts down when it try's to load the updates. I believe that has more to do with the age of the laptop then a virus related problem. It does still seem to be a bit sluggish. Here are the other scans:

OTM Log:
All processes killed
========== SERVICES/DRIVERS ==========
Service NTProcDrv stopped successfully!
Service NTProcDrv deleted successfully!
========== FILES ==========
c:\windows\system32\15724.exe moved successfully.
c:\windows\system32\19169.exe moved successfully.
c:\windows\system32\26500.exe moved successfully.
c:\windows\system32\6334.exe moved successfully.
c:\windows\system32\18467.exe moved successfully.
c:\windows\system32\IS15.exe moved successfully.
c:\windows\system32\warning.html moved successfully.
C:\s moved successfully.
c:\windows\iwexec.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Duh
->Temp folder emptied: 47305 bytes
->Temporary Internet Files folder emptied: 10358075 bytes
->Java cache emptied: 5339469 bytes
->FireFox cache emptied: 21527728 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 85504 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 59047 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 36.00 mb


OTM by OldTimer - Version 3.1.7.0 log created on 01282010_202008

Files moved on Reboot…
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_4d8.dat not found!
File move failed. C:\WINDOWS\temp\Perflib_Perfdata_6c8.dat scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_990.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_eb0.dat not found!

Registry entries deleted on Reboot…

MBAM Log
Malwarebytes' Anti-Malware 1.44
Database version: 3654
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

1/28/2010 8:33:26 PM
mbam-log-2010-01-28 (20-33-26).txt

Scan type: Quick Scan
Objects scanned: 113680
Time elapsed: 6 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Post #8
Brenda,

Try this one instead:

🖼Click to load external image (Posted Image) Please run Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Please include the following in your next post:
  • ESET log
Post #9
I didn't have a log file, but at the end it said 1 infected file found: C:\_OTM\MovedFiles\01282010_202008\c_windows\system32\warning.html Win32/TrojanDownloader.FakeAlert.AED virus
Post #11
DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 17:24:51.39 on Fri 01/29/2010 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_16 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1279.744 [GMT -6:00] AV: avast! antivirus 4.8.1368 [VPS 100129-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\The Skins Factory\Hyperdesk\Common\HdThemeEnabler.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe C:\Program Files\WinKey\WinKey.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe -k Akamai C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\astsrv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\crypserv.exe C:\WINDOWS\ehome\ehSched.exe C:\Program Files\Pure Digital Technologies\FlipShare\FlipShareService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Norton Ghost\Agent\VProSvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\dllhost.exe C:\Program Files\Digsby\lib\digsby-app.exe C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\pc cleaning stuff\dds.scr ============== Pseudo HJT Report =============== uInternet Settings,ProxyOverride = *.local BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\acrobat\activex\AcroIEHelper.ocx BHO: AhIeBho Class: {10384d0e-2bc1-48b6-844b-ad0e9e6d2511} - c:\program files\zoomtext 9.1\ahoi\ah_ie_bho.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe" uRun: [cdloader] "c:\documents and settings\duh\application data\mjusbsp\cdloader2.exe" MAGICJACK mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /installquiet mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [srmclean] c:\cpqs\scom\srmclean.exe mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking10\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking10\Ereg.ini mRun: [QuickTime Task] "c:\program files\quicktime alternative\qttask.exe" -atboottime mRun: [Cm106Sound] RunDll32 CM106.cpl,CMICtrlWnd mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup dRunOnce: [RunNarrator] Narrator.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\gw micro\we711\weproxea.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winkey.lnk - c:\program files\winkey\WinKey.exe IE: Download all by Net Transport - c:\program files\xi\nettransport 2\NTAddList.html IE: Download by Net Transport - c:\program files\xi\nettransport 2\NTAddLink.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {0413D626-1428-4CA9-BA4C-257DE44FC15A} - hxxp://prod.p2wcentral.com/transformations/iedownload.CAB DPF: {32DCBA0E-9D05-11D3-A8FB-444553540000} - hxxp://prod.p2wcentral.com/ads/2.0/ActiveX/imagxpress5.cab DPF: {40289096-9F72-4A04-BCB3-E434ECDCEE33} - hxxp://download.howudodat.com/chatterbox/download/appdl.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1250714276234 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257829535812 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: wineyes - welogon.dll AppInit_DLLs: GWMHOOK.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\duh\applic~1\mozilla\firefox\profiles\phkoqimd.default\ FF - prefs.js: browser.search.selectedEngine - YouTube FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll FF - plugin: c:\documents and settings\duh\application data\move networks\plugins\npqmp071505000010.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 200000 FF - user.js: content.notify.interval - 100000 FF - user.js: content.switch.threshold - 650000 FF - user.js: nglayout.initialpaint.delay - 300 c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R1 Ai2sXP;Ai2sXP;c:\windows\system32\drivers\Ai2sXP.sys [2009-10-31 7296] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-8-19 114768] R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2003-3-31 14336] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-3 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-8-19 138680] R2 HdThemeEnabler;Hyperdesk Theme Enabler;c:\program files\the skins factory\hyperdesk\common\HdThemeEnabler.exe [2008-7-7 102400] R2 multikey;Virtual USB MultiKey;c:\windows\system32\drivers\multikey.sys [2009-9-3 90112] R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2003-3-31 5120] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-8-19 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-8-19 352920] R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [2009-8-19 68480] R3 NTProcDrv;Process creation detector for NT.;c:\windows\temp\drv1.tmp [2010-1-29 3584] R3 SymSnapService;SymSnapService;c:\program files\norton ghost\shared\drivers\SymSnapService.exe [2007-12-20 1562096] S3 CM1063264;C-Media CM106 Like Sound UDAX Interface;c:\windows\system32\drivers\CM106.sys [2009-10-14 1306112] S3 JTVNCProxy_10.0;JTVNCProxy;c:\program files\freedom scientific\jaws\10.0\JTVNCProxy.exe [2008-10-22 17176] S3 JTVNCProxy_11.0;JTVNCProxy_11.0;c:\program files\freedom scientific\jaws\11.0\JTVNCProxy.exe [2009-8-27 16152] S3 PowerBrl;powerBraille System Driver;c:\windows\system32\drivers\powerbrl.sys [2009-8-27 14880] S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM106.sys [2009-10-14 1306112] S3 windoweyes;Window-Eyes;c:\program files\gw micro\we711\weserv.exe [2010-1-7 61440] =============== Created Last 30 ================ 2010-01-29 02:20:08 0 d—–w- C:\_OTM 2010-01-27 19:07:36 0 d—–w- C:\pc cleaning stuff 2010-01-27 02:47:47 0 d—–w- c:\docume~1\duh\applic~1\Malwarebytes 2010-01-27 02:47:36 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-27 02:47:34 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-01-27 02:47:34 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-01-27 02:47:33 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-01-21 19:52:48 0 d—–w- c:\program files\QuickMix2 2010-01-16 21:03:17 0 d—–w- c:\program files\3ivx 2010-01-16 21:02:52 0 d—–w- c:\program files\Pure Digital Technologies 2010-01-16 21:02:50 0 d—–w- c:\docume~1\alluse~1\applic~1\Pure Digital Technologies 2010-01-13 03:57:15 0 d—–w- c:\program files\Oberon Media 2010-01-11 17:18:42 0 d—–w- c:\program files\CCleaner 2010-01-10 22:11:28 0 d—–w- c:\docume~1\duh\applic~1\Dropbox 2010-01-09 19:47:19 0 d—–w- C:\WE Notes 2010-01-08 05:15:34 0 d—–w- c:\docume~1\duh\applic~1\GW Micro 2010-01-08 04:53:25 73 —-a-w- c:\windows\Setuptl.ini 2010-01-08 04:53:25 0 d—–w- c:\docume~1\alluse~1\applic~1\GW Micro 2010-01-08 04:53:15 73785 —-a-w- c:\windows\system32\welogon.dll 2010-01-08 04:53:15 53248 —-a-w- c:\windows\system32\gwmhook.dll 2010-01-08 04:53:15 43573 —-a-w- c:\windows\system32\gwmvid.dll 2010-01-08 04:53:15 43208 —-a-w- c:\windows\system32\gwmvidms.dll 2010-01-08 04:53:15 43208 —-a-w- c:\windows\system32\gwmvidcx.dll 2010-01-08 04:19:46 0 d—–w- c:\windows\system32\wbem\Repository 2010-01-08 04:03:41 0 d—–w- c:\program files\OfficeRecovery ==================== Find3M ==================== 2010-01-27 02:43:51 2000000 —-atw- c:\windows\system32\HJSMEM.DAT 2009-12-12 02:41:37 1639 —-a-w- c:\docume~1\duh\applic~1\SAS7_000.DAT 2006-05-03 09:06:54 163328 –sh–r- c:\windows\system32\flvDX.dll 2007-02-21 10:47:16 31232 –sh–r- c:\windows\system32\msfDX.dll 2008-03-16 12:30:52 216064 –sh–r- c:\windows\system32\nbDX.dll ============= FINISH: 17:25:17.71 ===============
Post #12
Brenda,

Good work! Your logs are clean. Now we have some important cleanup and housekeeping to do:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 18. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
        Applications and AppletsTrace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.
    Click to load external image (Posted Image) Now, let’s update your operating system:
    • Click Start -> All Programs -> Windows Update or go to This site
    • In the left pane, click on Check for Updates
    • Download and install all updates labeled Critical, Important or Recommended.
    • Repeat these steps until no more Critical, Important or Recommended updates appear.
    • In the left pane, click on Change Settings. Choose Install updates automatically and pick a time that works for you. Also check the box in the Recommended updates section.
    Click to load external image (Posted Image) Cleanup with OTM
    • Double-click OTM.exe to start the program.
    • Close all other programs apart from OTM as this step will require a reboot
    • On the OTM main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.
    Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
    • Restart any anti-malware programs that we disabled while we were cleaning your machine.
    • Manually delete any remaining logs or tools from our fixes.
    • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
    • Consider running in a limited user account. See this post for more information.
    • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
    If your computer still seems sluggish, try running StartUpLight. The program allows you to disable or remove unnecessary startup entries from your computer. You could also visit our Microsoft Windows Forum and start a new topic there.

    Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI