[Resolved] can't even Download SysRestorePoint

topfuelcoupe Topic Starter

Post #1February 18, 2010, 9:09 AM UTC last edited February 18, 2010, 9:34 AM UTC

I can't even get started. When I try to run sys restore an error box says something about "frame work" Can you help me get started Thank you in advance

CatByte

Post #2February 21, 2010, 4:23 AM UTC

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

topfuelcoupe

Post #3February 22, 2010, 8:49 AM UTC

Here are the 2 files you requested. Sorry I could not zip. Also I have run these in safe mode with networking I thank you for your help. DDS (Ver_09-12-01.01) - NTFSx86 NETWORK Run by [removed] at 23:31:19.46 on Sun 02/21/2010 Internet Explorer: 6.0.2900.2180 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.464 [GMT -8:00] AV: AVG Internet Security *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Desktop\dds.com ============== Pseudo HJT Report =============== uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spysub~1.lnk - c:\program files\intermute\spysubtract\sslaunch.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\309731\program\Updates from HP.exe IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0\bin\npjpi150.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll SEH: {FA010552-4A27-4cb1-A1BB-3E2D697F1639} - No File Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\apljbhu3.default\ FF - plugin: c:\program files\java\jre1.5.0\bin\NPJPI150.dll —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-2-16 25608] R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-2-16 161800] R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-16 360584] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-16 333192] S1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-16 28424] S2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-2-16 285392] S2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-2-16 5832712] S3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-2-16 122376] S3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-2-16 30216] S3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-2-16 25736] =============== Created Last 30 ================ 2010-08-16 06:45:04 0 d-sh–r- C:\cmdcons 2010-08-16 06:45:03 0 d—–w- c:\windows\setup.pss 2010-08-16 06:44:53 0 d—–w- c:\windows\setupupd 2010-08-16 06:14:28 1832 –sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF528_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.20_T050708_WXP2_L4 09_M895_J250_7AMD_8Athlon 64_92.19_#100108_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK 2010-08-16 06:14:17 90112 —-a-w- c:\windows\system32\ps2.EXE 2010-08-16 06:10:40 0 d—–w- c:\windows\system32\SoftwareDistribution 2010-08-16 06:04:07 243 —-a-w- c:\windows\system\hpsysdrv.dat 2010-08-16 06:02:55 0 d—–w- c:\windows\I386 2010-08-16 05:54:22 0 d—–r- c:\documents and settings\all users\Documents 2010-08-16 05:53:25 0 d—–r- c:\windows\Offline Web Pages 2010-08-16 05:52:47 0 d-sh–r- c:\windows\system32\dllcache 2010-02-21 09:50:42 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys 2010-02-21 09:50:42 0 d—–w- c:\program files\Belarc 2010-02-20 18:55:47 175 —-a-w- c:\windows\system32\spupdsvc.inf 2010-02-20 18:52:09 0 d—–w- c:\program files\MSXML 4.0 2010-02-18 09:57:21 0 d—–w- c:\windows\system32\CatRoot_bak 2010-02-18 09:36:37 0 d-s—w- c:\documents and settings\administrator\UserData 2010-02-18 07:27:57 0 d—–w- c:\program files\Trend Micro 2010-02-18 07:09:46 0 d—–w- c:\docume~1\admini~1\applic~1\Malwarebytes 2010-02-18 07:09:43 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-18 07:09:41 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-02-18 07:09:41 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-02-18 07:09:41 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-02-18 06:57:04 0 —-a-w- c:\windows\system32\MSVolumeAMP.dll 2010-02-18 05:44:44 157712 —-a-w- c:\windows\system32\drivers\tmcomm.sys 2010-02-16 10:26:01 0 d—–w- c:\program files\Spybot - Search & Destroy 2010-02-16 10:26:01 0 d—–w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2010-02-16 09:45:48 0 d—–w- c:\program files\Yahoo! 2010-02-16 09:40:38 0 d—–w- c:\windows\system32\appmgmt 2010-02-16 09:25:19 0 d–h–w- C:\$AVG 2010-02-16 09:25:09 12464 —-a-w- c:\windows\system32\avgrsstx.dll 2010-02-16 09:25:08 25608 —-a-w- c:\windows\system32\drivers\AVGIDSxx.sys 2010-02-16 09:25:08 161800 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-02-16 09:25:05 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-02-16 09:24:58 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-02-16 09:24:56 0 d—–w- c:\windows\system32\drivers\Avg 2010-02-16 09:24:53 0 d—–w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar 2010-02-16 09:24:43 0 d—–w- c:\program files\AVG 2010-02-16 09:24:40 0 d—–w- c:\docume~1\alluse~1\applic~1\avg9 2010-02-16 09:13:19 0 d—–w- c:\windows\system32\PreInstall 2010-02-16 09:07:41 0 d—–w- c:\windows\system32\wbem\Repository 2010-02-16 08:51:44 0 d—–w- c:\windows\system32\scripting 2010-02-16 08:51:44 0 d—–w- c:\windows\l2schemas 2010-02-16 08:50:28 0 d—–w- c:\windows\ServicePackFiles 2010-02-16 08:48:55 0 d—–w- c:\windows\network diagnostic 2010-02-16 08:39:50 67866 ——w- c:\windows\system32\drivers\netwlan5.img 2010-02-16 08:38:56 64352 ——w- c:\windows\system32\drivers\ativmc20.cod 2010-02-16 08:37:29 2136064 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe 2010-02-16 08:37:28 2180352 ——w- c:\windows\system32\dllcache\ntoskrnl.exe 2010-02-16 08:37:28 2057728 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe 2010-02-16 08:37:28 2015744 ——w- c:\windows\system32\dllcache\ntkrpamp.exe ==================== Find3M ==================== 2009-12-16 12:58:04 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-16 12:58:04 343040 —-a-w- c:\windows\system32\dllcache\mspaint.exe 2009-11-27 16:37:27 8704 —-a-w- c:\windows\system32\tsbyuv.dll 2009-11-27 16:37:27 8704 ——w- c:\windows\system32\dllcache\tsbyuv.dll 2009-11-27 16:37:27 84992 —-a-w- c:\windows\system32\dllcache\avifil32.dll 2009-11-27 16:37:27 84992 —-a-w- c:\windows\system32\avifil32.dll 2009-11-27 16:37:27 48128 —-a-w- c:\windows\system32\iyuv_32.dll 2009-11-27 16:37:27 48128 ——w- c:\windows\system32\dllcache\iyuv_32.dll 2009-11-27 16:37:27 28672 —-a-w- c:\windows\system32\msvidc32.dll 2009-11-27 16:37:27 28672 —-a-w- c:\windows\system32\dllcache\msvidc32.dll 2009-11-27 16:37:27 11264 —-a-w- c:\windows\system32\msrle32.dll 2009-11-27 16:37:27 11264 —-a-w- c:\windows\system32\dllcache\msrle32.dll ============= FINISH: 23:31:48.50 =============== DDS (Ver_09-12-01.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 8/15/2010 11:12:38 PM System Uptime: 2/20/2010 10:57:06 AM (37 hours ago) Motherboard: MSI | | ALBACORE Processor: AMD Athlon™ 64 Processor 3500+ | Socket 939 | 2188/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 225 GiB total, 211.639 GiB free. D: is FIXED (FAT32) - 8 GiB total, 1.395 GiB free. E: is CDROM () F: is CDROM () G: is Removable H: is Removable I: is Removable J: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1: 2/16/2010 12:25:12 AM - Software Distribution Service 3.0 RP2: 2/16/2010 12:41:28 AM - Software Distribution Service 3.0 RP3: 2/16/2010 1:04:42 AM - Restore Operation RP4: 2/16/2010 1:12:47 AM - Software Distribution Service 3.0 RP5: 2/16/2010 1:24:39 AM - Installed AVG 9.0 RP6: 2/16/2010 1:40:16 AM - Removed Norton Security Center RP7: 2/16/2010 1:41:15 AM - Avg8 Update RP8: 2/17/2010 2:38:11 AM - System Checkpoint RP9: 2/20/2010 10:50:41 AM - Software Distribution Service 3.0 ==== Installed Programs ====================== Adobe Acrobat - Reader 6.0.2 Update Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 6.0.1 Agere Systems PCI Soft Modem AiO_Scan AiOSoftware AntiMalware Pro 2.1 ATI Control Panel ATI Display Driver AVG 9.0 Belarc Advisor 8.1 Blackhawk Striker 2 from HP Media Center (remove only) Blasterball 2 from HP Media Center (remove only) Blasterball 2 Holidays from HP Media Center (remove only) Blasterball 2 Remix from HP Media Center (remove only) Bounce Symphony from HP Media Center (remove only) BufferChm CameraDrivers Copy CP_AtenaShokunin1Config cp_dwSharkTaleAlbums1 cp_dwSharkTaleCards1 cp_dwShrek2Albums1 cp_dwShrek2Cards1 CP_PLSBusinessFlyers CreativeProjects CreativeProjectsTemplates Crystal Maze from HP Media Center (remove only) CueTour Destinations Director DocProc DocumentViewer Easy Internet Sign-up Fax Final Drive Nitro from HP Media Center (remove only) GemMaster Mystic Google Toolbar for Internet Explorer Help and Support Additions HijackThis 2.0.2 HP Boot Optimizer HP Deskjet Printer Preload HP Help and Support 4.0 HP Image Zone 4.8.6 HP Image Zone for Media Center PC HP Image Zone Plus 4.8.6 HP Photosmart Cameras 4.5 HP Product Assistant HP PSC & OfficeJet 4.7 HP Software Update HP Tunes HPIZplus450 HpSdpAppCoreApp HPSystemDiagnostics InstantShare IntelliMover Data Transfer Demo InterVideo WinDVD Player iTunes J2SE Runtime Environment 5.0 KBD Lexibox Deluxe from HP Media Center (remove only) LS_HSI Malwarebytes' Anti-Malware Microsoft .NET Framework 1.0 Hotfix (KB953295) Microsoft .NET Framework 1.1 Microsoft Office Standard Edition 2003 Microsoft Plus! Dancer LE Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works Mozilla Firefox (3.6) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) muvee autoProducer 4.0 muvee autoProducer unPlugged - HPD Otto Overball from HP Media Center (remove only) PanoStandAlone PC-Doctor for Windows Phoenix Assault from HP Media Center (remove only) PhotoGallery Photosmart 320,370,7400,8100,8400 Series Polar Bowler from HP Media Center (remove only) Polar Golfer from HP Media Center (remove only) PrintScreen PS2 PSPrinters06 Python 2.2 pywin32 extensions (build 203) Python 2.2.3 QFolder QuickProjects QuickTime Readme RealPlayer Remove Microsoft Money 2005 installer Remove Quicken New User Edition installer Scan ScannerCopy Security Update for Windows XP (KB923561) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971032) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978706) Shooting Stars Pool from HP Media Center (remove only) SkinsHP1 Slyder from HP Media Center (remove only) Sonic Encoders Sonic Express Labeler Sonic MyDVD Plus Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager Spybot - Search & Destroy SpySubtract Super Granny from HP Media Center (remove only) Tradewinds from HP Media Center (remove only) TrayApp Unload Update for Windows XP (KB898461) Update for Windows XP (KB968389) Update for Windows XP (KB973815) Update Rollup 1 for Windows XP Media Center Edition 2005 with HDTV Support (KB873369) Updates from HP WebFldrs XP WebReg Windows Installer 3.1 (KB893803) Windows Media Player 10 Hotfix [See KB889858 for more information] Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885354 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB891220 Windows XP Hotfix - KB891781 Windows XP Media Center Edition 2005 KB888316 Windows XP Media Center Edition 2005 KB890629 Windows XP Media Center Edition 2005 KB895678 Windows XP Media Center Edition 2005 KB973768 Yahoo! Messenger Yahoo! Software Update ==== Event Viewer Messages From Past Week ======== 2/18/2010 12:56:39 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 2/18/2010 1:36:36 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 2/17/2010 9:41:39 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 AvgLdx86 AvgMfx86 Fips 2/17/2010 11:19:31 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: fasttx2k 2/16/2010 1:04:44 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 2/16/2010 1:04:38 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 Fips ==== End Of File ===========================

topfuelcoupe

Post #4February 22, 2010, 8:50 AM UTC

Here are the 2 files you requested. Sorry I could not zip. Also I have run these in safe mode with networking I thank you for your help. DDS (Ver_09-12-01.01) - NTFSx86 NETWORK Run by [removed] at 23:31:19.46 on Sun 02/21/2010 Internet Explorer: 6.0.2900.2180 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.464 [GMT -8:00] AV: AVG Internet Security *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Desktop\dds.com ============== Pseudo HJT Report =============== uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spysub~1.lnk - c:\program files\intermute\spysubtract\sslaunch.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\309731\program\Updates from HP.exe IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0\bin\npjpi150.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll SEH: {FA010552-4A27-4cb1-A1BB-3E2D697F1639} - No File Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\apljbhu3.default\ FF - plugin: c:\program files\java\jre1.5.0\bin\NPJPI150.dll —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-2-16 25608] R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-2-16 161800] R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-16 360584] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-16 333192] S1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-16 28424] S2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-2-16 285392] S2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-2-16 5832712] S3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-2-16 122376] S3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-2-16 30216] S3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-2-16 25736] =============== Created Last 30 ================ 2010-08-16 06:45:04 0 d-sh–r- C:\cmdcons 2010-08-16 06:45:03 0 d—–w- c:\windows\setup.pss 2010-08-16 06:44:53 0 d—–w- c:\windows\setupupd 2010-08-16 06:14:28 1832 –sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF528_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.20_T050708_WXP2_L4 09_M895_J250_7AMD_8Athlon 64_92.19_#100108_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK 2010-08-16 06:14:17 90112 —-a-w- c:\windows\system32\ps2.EXE 2010-08-16 06:10:40 0 d—–w- c:\windows\system32\SoftwareDistribution 2010-08-16 06:04:07 243 —-a-w- c:\windows\system\hpsysdrv.dat 2010-08-16 06:02:55 0 d—–w- c:\windows\I386 2010-08-16 05:54:22 0 d—–r- c:\documents and settings\all users\Documents 2010-08-16 05:53:25 0 d—–r- c:\windows\Offline Web Pages 2010-08-16 05:52:47 0 d-sh–r- c:\windows\system32\dllcache 2010-02-21 09:50:42 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys 2010-02-21 09:50:42 0 d—–w- c:\program files\Belarc 2010-02-20 18:55:47 175 —-a-w- c:\windows\system32\spupdsvc.inf 2010-02-20 18:52:09 0 d—–w- c:\program files\MSXML 4.0 2010-02-18 09:57:21 0 d—–w- c:\windows\system32\CatRoot_bak 2010-02-18 09:36:37 0 d-s—w- c:\documents and settings\administrator\UserData 2010-02-18 07:27:57 0 d—–w- c:\program files\Trend Micro 2010-02-18 07:09:46 0 d—–w- c:\docume~1\admini~1\applic~1\Malwarebytes 2010-02-18 07:09:43 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-18 07:09:41 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-02-18 07:09:41 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-02-18 07:09:41 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-02-18 06:57:04 0 —-a-w- c:\windows\system32\MSVolumeAMP.dll 2010-02-18 05:44:44 157712 —-a-w- c:\windows\system32\drivers\tmcomm.sys 2010-02-16 10:26:01 0 d—–w- c:\program files\Spybot - Search & Destroy 2010-02-16 10:26:01 0 d—–w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2010-02-16 09:45:48 0 d—–w- c:\program files\Yahoo! 2010-02-16 09:40:38 0 d—–w- c:\windows\system32\appmgmt 2010-02-16 09:25:19 0 d–h–w- C:\$AVG 2010-02-16 09:25:09 12464 —-a-w- c:\windows\system32\avgrsstx.dll 2010-02-16 09:25:08 25608 —-a-w- c:\windows\system32\drivers\AVGIDSxx.sys 2010-02-16 09:25:08 161800 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-02-16 09:25:05 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-02-16 09:24:58 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-02-16 09:24:56 0 d—–w- c:\windows\system32\drivers\Avg 2010-02-16 09:24:53 0 d—–w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar 2010-02-16 09:24:43 0 d—–w- c:\program files\AVG 2010-02-16 09:24:40 0 d—–w- c:\docume~1\alluse~1\applic~1\avg9 2010-02-16 09:13:19 0 d—–w- c:\windows\system32\PreInstall 2010-02-16 09:07:41 0 d—–w- c:\windows\system32\wbem\Repository 2010-02-16 08:51:44 0 d—–w- c:\windows\system32\scripting 2010-02-16 08:51:44 0 d—–w- c:\windows\l2schemas 2010-02-16 08:50:28 0 d—–w- c:\windows\ServicePackFiles 2010-02-16 08:48:55 0 d—–w- c:\windows\network diagnostic 2010-02-16 08:39:50 67866 ——w- c:\windows\system32\drivers\netwlan5.img 2010-02-16 08:38:56 64352 ——w- c:\windows\system32\drivers\ativmc20.cod 2010-02-16 08:37:29 2136064 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe 2010-02-16 08:37:28 2180352 ——w- c:\windows\system32\dllcache\ntoskrnl.exe 2010-02-16 08:37:28 2057728 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe 2010-02-16 08:37:28 2015744 ——w- c:\windows\system32\dllcache\ntkrpamp.exe ==================== Find3M ==================== 2009-12-16 12:58:04 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-16 12:58:04 343040 —-a-w- c:\windows\system32\dllcache\mspaint.exe 2009-11-27 16:37:27 8704 —-a-w- c:\windows\system32\tsbyuv.dll 2009-11-27 16:37:27 8704 ——w- c:\windows\system32\dllcache\tsbyuv.dll 2009-11-27 16:37:27 84992 —-a-w- c:\windows\system32\dllcache\avifil32.dll 2009-11-27 16:37:27 84992 —-a-w- c:\windows\system32\avifil32.dll 2009-11-27 16:37:27 48128 —-a-w- c:\windows\system32\iyuv_32.dll 2009-11-27 16:37:27 48128 ——w- c:\windows\system32\dllcache\iyuv_32.dll 2009-11-27 16:37:27 28672 —-a-w- c:\windows\system32\msvidc32.dll 2009-11-27 16:37:27 28672 —-a-w- c:\windows\system32\dllcache\msvidc32.dll 2009-11-27 16:37:27 11264 —-a-w- c:\windows\system32\msrle32.dll 2009-11-27 16:37:27 11264 —-a-w- c:\windows\system32\dllcache\msrle32.dll ============= FINISH: 23:31:48.50 =============== DDS (Ver_09-12-01.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 8/15/2010 11:12:38 PM System Uptime: 2/20/2010 10:57:06 AM (37 hours ago) Motherboard: MSI | | ALBACORE Processor: AMD Athlon™ 64 Processor 3500+ | Socket 939 | 2188/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 225 GiB total, 211.639 GiB free. D: is FIXED (FAT32) - 8 GiB total, 1.395 GiB free. E: is CDROM () F: is CDROM () G: is Removable H: is Removable I: is Removable J: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1: 2/16/2010 12:25:12 AM - Software Distribution Service 3.0 RP2: 2/16/2010 12:41:28 AM - Software Distribution Service 3.0 RP3: 2/16/2010 1:04:42 AM - Restore Operation RP4: 2/16/2010 1:12:47 AM - Software Distribution Service 3.0 RP5: 2/16/2010 1:24:39 AM - Installed AVG 9.0 RP6: 2/16/2010 1:40:16 AM - Removed Norton Security Center RP7: 2/16/2010 1:41:15 AM - Avg8 Update RP8: 2/17/2010 2:38:11 AM - System Checkpoint RP9: 2/20/2010 10:50:41 AM - Software Distribution Service 3.0 ==== Installed Programs ====================== Adobe Acrobat - Reader 6.0.2 Update Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 6.0.1 Agere Systems PCI Soft Modem AiO_Scan AiOSoftware AntiMalware Pro 2.1 ATI Control Panel ATI Display Driver AVG 9.0 Belarc Advisor 8.1 Blackhawk Striker 2 from HP Media Center (remove only) Blasterball 2 from HP Media Center (remove only) Blasterball 2 Holidays from HP Media Center (remove only) Blasterball 2 Remix from HP Media Center (remove only) Bounce Symphony from HP Media Center (remove only) BufferChm CameraDrivers Copy CP_AtenaShokunin1Config cp_dwSharkTaleAlbums1 cp_dwSharkTaleCards1 cp_dwShrek2Albums1 cp_dwShrek2Cards1 CP_PLSBusinessFlyers CreativeProjects CreativeProjectsTemplates Crystal Maze from HP Media Center (remove only) CueTour Destinations Director DocProc DocumentViewer Easy Internet Sign-up Fax Final Drive Nitro from HP Media Center (remove only) GemMaster Mystic Google Toolbar for Internet Explorer Help and Support Additions HijackThis 2.0.2 HP Boot Optimizer HP Deskjet Printer Preload HP Help and Support 4.0 HP Image Zone 4.8.6 HP Image Zone for Media Center PC HP Image Zone Plus 4.8.6 HP Photosmart Cameras 4.5 HP Product Assistant HP PSC & OfficeJet 4.7 HP Software Update HP Tunes HPIZplus450 HpSdpAppCoreApp HPSystemDiagnostics InstantShare IntelliMover Data Transfer Demo InterVideo WinDVD Player iTunes J2SE Runtime Environment 5.0 KBD Lexibox Deluxe from HP Media Center (remove only) LS_HSI Malwarebytes' Anti-Malware Microsoft .NET Framework 1.0 Hotfix (KB953295) Microsoft .NET Framework 1.1 Microsoft Office Standard Edition 2003 Microsoft Plus! Dancer LE Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works Mozilla Firefox (3.6) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) muvee autoProducer 4.0 muvee autoProducer unPlugged - HPD Otto Overball from HP Media Center (remove only) PanoStandAlone PC-Doctor for Windows Phoenix Assault from HP Media Center (remove only) PhotoGallery Photosmart 320,370,7400,8100,8400 Series Polar Bowler from HP Media Center (remove only) Polar Golfer from HP Media Center (remove only) PrintScreen PS2 PSPrinters06 Python 2.2 pywin32 extensions (build 203) Python 2.2.3 QFolder QuickProjects QuickTime Readme RealPlayer Remove Microsoft Money 2005 installer Remove Quicken New User Edition installer Scan ScannerCopy Security Update for Windows XP (KB923561) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971032) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978706) Shooting Stars Pool from HP Media Center (remove only) SkinsHP1 Slyder from HP Media Center (remove only) Sonic Encoders Sonic Express Labeler Sonic MyDVD Plus Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager Spybot - Search & Destroy SpySubtract Super Granny from HP Media Center (remove only) Tradewinds from HP Media Center (remove only) TrayApp Unload Update for Windows XP (KB898461) Update for Windows XP (KB968389) Update for Windows XP (KB973815) Update Rollup 1 for Windows XP Media Center Edition 2005 with HDTV Support (KB873369) Updates from HP WebFldrs XP WebReg Windows Installer 3.1 (KB893803) Windows Media Player 10 Hotfix [See KB889858 for more information] Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885354 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB891220 Windows XP Hotfix - KB891781 Windows XP Media Center Edition 2005 KB888316 Windows XP Media Center Edition 2005 KB890629 Windows XP Media Center Edition 2005 KB895678 Windows XP Media Center Edition 2005 KB973768 Yahoo! Messenger Yahoo! Software Update ==== Event Viewer Messages From Past Week ======== 2/18/2010 12:56:39 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 2/18/2010 1:36:36 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 2/17/2010 9:41:39 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 AvgLdx86 AvgMfx86 Fips 2/17/2010 11:19:31 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: fasttx2k 2/16/2010 1:04:44 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 2/16/2010 1:04:38 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 Fips ==== End Of File ===========================

Attachments:

📎Attach.txt

topfuelcoupe

Post #5February 22, 2010, 10:01 AM UTC

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-22 00:57:06
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uxldypob.sys

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

—- EOF - GMER 1.0.15 —-

CatByte

Post #6February 22, 2010, 12:35 PM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

topfuelcoupe

Post #7February 24, 2010, 7:45 AM UTC

Hello CatByte OK this is crazy!!! I think. I have been following your instuctions while in "safe mode with networking" I booted back to normal and the virus appears to be GONE. Originaly it High Jacked the browser and would not let me open any types of scans S&D maleware Bytes etc. Is there something that I can run and have you check to make sure all is good? Thank you so much Ron

CatByte

Post #8February 24, 2010, 1:14 PM UTC

how about posting the ComboFix log

topfuelcoupe

Post #9February 25, 2010, 10:07 AM UTC

Here is the comboFix log. I had to run it with AVG 9.0 running!! I fell os dumb but I can't figure out how to disable it. Here is the Combo Log

ComboFix 10-02-24.03 - HP_Administrator 02/25/2010 1:34.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.460 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll
c:\windows\system32\linkinfo(2).dll
c:\windows\system32\MSVolumeAMP.dll
c:\windows\system32\ps2.bat
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-01-25 to 2010-02-25 )))))))))))))))))))))))))))))))
.

2010-08-16 07:07 . 2010-08-16 07:07 49600 —-a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-16 06:18 . 2010-08-16 06:18 ——– d-s—w- c:\documents and settings\HP_Administrator\UserData
2010-08-16 06:14 . 2004-10-25 21:17 90112 —-a-w- c:\windows\system32\ps2.EXE
2010-08-16 06:12 . 2005-05-26 17:59 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Symantec
2010-08-16 06:12 . 2005-05-26 17:56 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\InterMute
2010-08-16 06:12 . 2005-05-26 17:51 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\SampleView
2010-08-16 06:12 . 2005-05-26 17:37 ——– d—–w- c:\windows\system32\config\systemprofile\WINDOWS
2010-08-16 06:12 . 2005-05-26 17:37 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Apple Computer
2010-08-16 06:12 . 2010-08-16 06:12 ——– d—a-w- c:\program files\Common Files\LightScribe
2010-08-16 06:11 . 2005-05-26 17:37 ——– d—–w- c:\documents and settings\Default User\WINDOWS
2010-08-16 06:04 . 2010-02-25 09:41 243 —-a-w- c:\windows\system\hpsysdrv.dat
2010-08-16 06:02 . 2010-08-16 06:44 ——– d—–w- c:\windows\I386
2010-08-16 05:52 . 2010-02-24 11:01 ——– d-sh–r- c:\windows\system32\dllcache
2010-02-25 09:05 . 2010-02-25 09:05 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-02-25 09:05 . 2010-02-25 09:05 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2010-02-23 11:09 . 2010-02-23 11:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-23 11:04 . 2010-02-23 11:04 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-02-23 11:00 . 2010-02-23 11:00 ——– d-sh–w- c:\documents and settings\HP_Administrator\PrivacIE
2010-02-23 10:57 . 2010-02-23 10:57 ——– d-sh–w- c:\documents and settings\HP_Administrator\IETldCache
2010-02-23 10:57 . 2010-02-23 10:57 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-02-23 10:42 . 2009-12-11 08:38 69120 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-02-23 10:42 . 2010-02-23 10:43 ——– d—–w- c:\windows\ie8updates
2010-02-23 10:42 . 2009-12-21 19:14 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2010-02-23 10:42 . 2009-12-21 19:14 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-23 10:42 . 2009-12-21 19:14 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-02-23 10:42 . 2009-12-21 19:14 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-23 10:42 . 2009-12-21 19:14 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2010-02-23 10:42 . 2009-12-21 19:14 11070464 ——w- c:\windows\system32\dllcache\ieframe.dll
2010-02-23 10:40 . 2010-02-23 10:42 ——– dc-h–w- c:\windows\ie8
2010-02-23 07:38 . 2010-02-23 07:38 49600 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 16:27 . 2010-02-22 16:27 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2010-02-22 09:10 . 2010-02-22 09:19 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-02-21 09:50 . 2010-02-21 09:50 ——– d—–w- c:\program files\Belarc
2010-02-21 09:50 . 2008-02-27 20:49 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys
2010-02-20 18:52 . 2010-02-20 18:52 ——– d—–w- c:\program files\MSXML 4.0
2010-02-18 12:38 . 2010-02-18 12:38 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2010-02-18 12:37 . 2010-02-18 12:37 ——– d—–w- c:\documents and settings\Administrator\Application Data\Yahoo!
2010-02-18 09:57 . 2010-02-18 09:57 ——– d—–w- c:\windows\system32\CatRoot_bak
2010-02-18 09:36 . 2010-02-18 09:36 ——– d-s—w- c:\documents and settings\Administrator\UserData
2010-02-18 07:57 . 2010-02-18 07:57 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2010-02-18 07:57 . 2010-02-18 07:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\AdobeUM
2010-02-18 07:56 . 2010-02-18 07:56 ——– d—–w- c:\program files\Common Files\Adobe
2010-02-18 07:27 . 2010-02-18 07:27 ——– d—–w- c:\program files\Trend Micro
2010-02-18 07:20 . 2010-02-18 07:20 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2010-02-18 07:09 . 2010-02-18 07:09 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-18 07:09 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-18 07:09 . 2010-02-18 07:09 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-18 07:09 . 2010-02-18 07:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-18 07:09 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-18 05:41 . 2010-02-18 05:41 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-02-18 02:14 . 2010-02-23 09:01 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\gwbqbu
2010-02-17 18:17 . 2010-02-17 18:17 0 —-a-w- c:\windows\nsreg.dat
2010-02-17 18:17 . 2010-02-17 18:17 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Mozilla
2010-02-16 10:26 . 2010-02-16 10:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-16 10:26 . 2010-02-16 10:27 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-02-16 10:09 . 2010-02-16 10:19 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-16 09:51 . 2010-02-16 15:48 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Yahoo
2010-02-16 09:47 . 2010-02-16 15:47 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Yahoo!
2010-02-16 09:46 . 2010-02-16 09:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-02-16 09:46 . 2009-11-10 22:39 607472 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2010-02-16 09:45 . 2010-02-18 05:39 ——– d—–w- c:\program files\Yahoo!
2010-02-16 09:41 . 2010-02-16 09:24 1260800 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-02-16 09:41 . 2010-02-16 09:24 3777280 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-02-16 09:35 . 2010-02-16 09:35 ——– d-s—w- c:\documents and settings\LocalService\UserData
2010-02-16 09:35 . 2009-11-25 21:02 1230080 —-a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2010-02-16 09:25 . 2010-02-17 20:51 ——– d—–w- C:\$AVG
2010-02-16 09:25 . 2010-02-16 09:25 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-02-16 09:25 . 2010-02-16 09:25 25608 —-a-w- c:\windows\system32\drivers\AVGIDSxx.sys
2010-02-16 09:25 . 2010-02-16 09:25 161800 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-02-16 09:25 . 2010-02-16 09:25 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-02-16 09:24 . 2010-02-16 09:24 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-16 09:24 . 2010-02-16 09:24 28424 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-02-16 09:24 . 2010-02-25 09:14 ——– d—–w- c:\windows\system32\drivers\Avg
2010-02-16 09:24 . 2010-02-18 02:08 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-02-16 09:24 . 2010-02-16 09:24 ——– d—–w- c:\program files\AVG
2010-02-16 09:24 . 2010-02-16 09:24 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-02-16 09:07 . 2010-02-16 09:07 ——– d—–w- c:\windows\system32\wbem\Repository
2010-02-16 08:51 . 2010-02-16 08:51 ——– d—–w- c:\windows\system32\scripting
2010-02-16 08:51 . 2010-02-16 08:51 ——– d—–w- c:\windows\l2schemas
2010-02-16 08:50 . 2010-02-16 08:50 ——– d—–w- c:\windows\ServicePackFiles
2010-02-16 08:43 . 2008-06-13 13:10 272128 ——w- c:\windows\system32\drivers\bthport.sys
2010-02-16 08:43 . 2008-06-13 13:10 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2010-02-16 08:38 . 2009-12-04 14:41 453760 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-16 08:37 . 2009-08-04 13:58 2136064 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-16 08:37 . 2009-08-04 14:00 2180352 ——w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-16 08:37 . 2009-08-04 13:13 2015744 ——w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-16 08:37 . 2009-08-04 13:13 2057728 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 07:17 . 2005-05-26 17:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-08-16 06:35 . 2010-08-16 06:13 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Symantec
2010-08-16 06:16 . 2005-05-26 17:46 ——– d—–w- c:\program files\Easy Internet signup
2010-08-16 06:14 . 2010-08-16 06:14 1832 –sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF528_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.20_T050708_WXP2_L4
09_M895_J250_7AMD_8Athlon 64_92.19_#100108_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK
2010-02-23 11:04 . 2005-05-26 17:49 ——– d—–w- c:\program files\Google
2010-02-18 05:39 . 2005-05-26 17:58 ——– d—–w- c:\program files\Symantec
2010-02-16 08:54 . 2005-01-28 09:40 93511 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-16 08:54 . 2010-02-16 08:54 45056 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2010-02-16 08:54 . 2010-02-16 08:54 44032 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2009-12-31 16:14 . 2004-08-10 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-10 11:00 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-16 12:58 . 2004-08-10 12:00 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2004-08-10 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 14:41 . 2004-08-10 11:00 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:04 . 2004-08-10 11:00 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:04 . 2004-08-10 18:00 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:37 . 2004-08-10 18:00 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:37 . 2004-08-10 18:00 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:37 . 2004-08-10 12:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:37 . 2004-08-10 12:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:37 . 2004-08-10 12:00 11264 —-a-w- c:\windows\system32\msrle32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5244216]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-23 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-05-26 180269]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-5 258048]
SpySubtract.lnk - c:\program files\InterMute\SpySubtract\sslaunch.exe [2005-5-26 73728]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-5-26 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-02-16 09:25 12464 —-a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2/16/2010 1:25 AM 25608]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2/16/2010 1:25 AM 161800]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/16/2010 1:24 AM 333192]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/16/2010 1:25 AM 360584]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2/16/2010 1:24 AM 285392]
R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2/16/2010 1:24 AM 5832712]
R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [2/16/2010 1:24 AM 122376]
R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [2/16/2010 1:24 AM 30216]
R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [2/16/2010 1:24 AM 25736]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/23/2010 3:04 AM 135664]
.
Contents of the 'Scheduled Tasks' folder

2010-08-16 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-03-04 01:04]

2010-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 11:04]

2010-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 11:04]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride =
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\v45qo4sv.default\
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-smpevxfa - c:\documents and settings\HP_Administrator\Local Settings\Application Data\gwbqbu\goorsftav.exe
ShellExecuteHooks-{FA010552-4A27-4cb1-A1BB-3E2D697F1639} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-25 01:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(596)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(344)
c:\windows\system32\WININET.dll
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\eHome\ehmsas.exe
c:\program files\InterMute\SpySubtract\SpySub.exe
c:\hp\KBD\KBD.EXE
.
**************************************************************************
.
Completion time: 2010-02-25 01:51:02 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-25 09:50

Pre-Run: 224,579,395,584 bytes free
Post-Run: 226,004,312,064 bytes free

- - End Of File - - 31103189BD66BB8AD71B64F74CA7A6CD

CatByte

Post #10February 25, 2010, 12:43 PM UTC last edited February 25, 2010, 12:44 PM UTC

Hi,

Please do the following:

Please open the AVG Control Center, by right clicking on the AVG icon on the task bar.

Click on Tools.
Select Advanced Settings.
In the left hand pane, scroll down to "Resident Shield".
In the main pane, deselect the option to "Enable Resident Shield."
To re-enable AVG , please select "Enable Resident Shield" again.

NEXT

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Folder::
c:\documents and settings\HP_Administrator\Local Settings\Application Data\gwbqbu

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5555

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

In your next reply please include

MBAM Log
Kaspersky report

topfuelcoupe

Post #11February 26, 2010, 6:05 AM UTC

ComboFix 10-02-24.03 - HP_Administrator 02/25/2010 21:33:24.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.413 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt
AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll

.
((((((((((((((((((((((((( Files Created from 2010-01-26 to 2010-02-26 )))))))))))))))))))))))))))))))
.

2010-08-16 07:07 . 2010-08-16 07:07 49600 —-a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-16 06:18 . 2010-08-16 06:18 ——– d-s—w- c:\documents and settings\HP_Administrator\UserData
2010-08-16 06:14 . 2004-10-25 21:17 90112 —-a-w- c:\windows\system32\ps2.EXE
2010-08-16 06:12 . 2005-05-26 17:59 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Symantec
2010-08-16 06:12 . 2005-05-26 17:56 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\InterMute
2010-08-16 06:12 . 2005-05-26 17:51 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\SampleView
2010-08-16 06:12 . 2005-05-26 17:37 ——– d—–w- c:\windows\system32\config\systemprofile\WINDOWS
2010-08-16 06:12 . 2005-05-26 17:37 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Apple Computer
2010-08-16 06:12 . 2010-08-16 06:12 ——– d—a-w- c:\program files\Common Files\LightScribe
2010-08-16 06:11 . 2005-05-26 17:37 ——– d—–w- c:\documents and settings\Default User\WINDOWS
2010-08-16 06:04 . 2010-02-26 05:39 243 —-a-w- c:\windows\system\hpsysdrv.dat
2010-08-16 06:02 . 2010-08-16 06:44 ——– d—–w- c:\windows\I386
2010-08-16 05:52 . 2010-02-24 11:01 ——– d-sh–r- c:\windows\system32\dllcache
2010-02-25 18:47 . 2010-02-25 18:47 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\AdobeUM
2010-02-25 18:47 . 2010-02-25 18:47 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Adobe
2010-02-25 13:09 . 2010-02-25 13:09 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Temp
2010-02-25 09:05 . 2010-02-25 09:05 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-02-25 09:05 . 2010-02-25 09:05 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2010-02-23 11:09 . 2010-02-23 11:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-23 11:04 . 2010-02-23 11:04 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-02-23 11:00 . 2010-02-23 11:00 ——– d-sh–w- c:\documents and settings\HP_Administrator\PrivacIE
2010-02-23 10:57 . 2010-02-23 10:57 ——– d-sh–w- c:\documents and settings\HP_Administrator\IETldCache
2010-02-23 10:57 . 2010-02-23 10:57 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-02-23 10:42 . 2009-12-11 08:38 69120 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-02-23 10:42 . 2010-02-23 10:43 ——– d—–w- c:\windows\ie8updates
2010-02-23 10:42 . 2009-12-21 19:14 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2010-02-23 10:42 . 2009-12-21 19:14 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll
2010-02-23 10:42 . 2009-12-21 19:14 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-02-23 10:42 . 2009-12-21 19:14 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll
2010-02-23 10:42 . 2009-12-21 19:14 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2010-02-23 10:42 . 2009-12-21 19:14 11070464 ——w- c:\windows\system32\dllcache\ieframe.dll
2010-02-23 10:40 . 2010-02-23 10:42 ——– dc-h–w- c:\windows\ie8
2010-02-23 07:38 . 2010-02-23 07:38 49600 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-22 16:27 . 2010-02-22 16:27 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2010-02-22 09:10 . 2010-02-22 09:19 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-02-21 09:50 . 2010-02-21 09:50 ——– d—–w- c:\program files\Belarc
2010-02-21 09:50 . 2008-02-27 20:49 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys
2010-02-20 18:52 . 2010-02-20 18:52 ——– d—–w- c:\program files\MSXML 4.0
2010-02-18 12:38 . 2010-02-18 12:38 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2010-02-18 12:37 . 2010-02-18 12:37 ——– d—–w- c:\documents and settings\Administrator\Application Data\Yahoo!
2010-02-18 09:57 . 2010-02-18 09:57 ——– d—–w- c:\windows\system32\CatRoot_bak
2010-02-18 09:36 . 2010-02-18 09:36 ——– d-s—w- c:\documents and settings\Administrator\UserData
2010-02-18 07:57 . 2010-02-18 07:57 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2010-02-18 07:57 . 2010-02-18 07:57 ——– d—–w- c:\documents and settings\Administrator\Application Data\AdobeUM
2010-02-18 07:56 . 2010-02-18 07:56 ——– d—–w- c:\program files\Common Files\Adobe
2010-02-18 07:27 . 2010-02-18 07:27 ——– d—–w- c:\program files\Trend Micro
2010-02-18 07:20 . 2010-02-18 07:20 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2010-02-18 07:09 . 2010-02-18 07:09 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-18 07:09 . 2010-01-08 00:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-18 07:09 . 2010-02-18 07:09 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-18 07:09 . 2010-02-18 07:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-18 07:09 . 2010-01-08 00:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-18 05:41 . 2010-02-18 05:41 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-02-18 02:14 . 2010-02-23 09:01 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\gwbqbu
2010-02-17 18:17 . 2010-02-17 18:17 0 —-a-w- c:\windows\nsreg.dat
2010-02-17 18:17 . 2010-02-17 18:17 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Mozilla
2010-02-16 10:26 . 2010-02-16 10:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-02-16 10:26 . 2010-02-16 10:27 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-02-16 10:09 . 2010-02-16 10:19 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-16 09:51 . 2010-02-16 15:48 ——– d—–w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Yahoo
2010-02-16 09:47 . 2010-02-16 15:47 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Yahoo!
2010-02-16 09:46 . 2010-02-16 09:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-02-16 09:45 . 2010-02-18 05:39 ——– d—–w- c:\program files\Yahoo!
2010-02-16 09:35 . 2010-02-16 09:35 ——– d-s—w- c:\documents and settings\LocalService\UserData
2010-02-16 09:25 . 2010-02-17 20:51 ——– d—–w- C:\$AVG
2010-02-16 09:25 . 2010-02-16 09:25 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-02-16 09:25 . 2010-02-16 09:25 25608 —-a-w- c:\windows\system32\drivers\AVGIDSxx.sys
2010-02-16 09:25 . 2010-02-16 09:25 161800 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-02-16 09:25 . 2010-02-16 09:25 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-02-16 09:24 . 2010-02-16 09:24 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-16 09:24 . 2010-02-16 09:24 28424 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-02-16 09:24 . 2010-02-25 23:59 ——– d—–w- c:\windows\system32\drivers\Avg
2010-02-16 09:24 . 2010-02-18 02:08 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-02-16 09:24 . 2010-02-16 09:24 ——– d—–w- c:\program files\AVG
2010-02-16 09:24 . 2010-02-16 09:24 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-02-16 09:07 . 2010-02-16 09:07 ——– d—–w- c:\windows\system32\wbem\Repository
2010-02-16 08:51 . 2010-02-16 08:51 ——– d—–w- c:\windows\system32\scripting
2010-02-16 08:51 . 2010-02-16 08:51 ——– d—–w- c:\windows\l2schemas
2010-02-16 08:50 . 2010-02-16 08:50 ——– d—–w- c:\windows\ServicePackFiles
2010-02-16 08:43 . 2008-06-13 13:10 272128 ——w- c:\windows\system32\drivers\bthport.sys
2010-02-16 08:43 . 2008-06-13 13:10 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2010-02-16 08:38 . 2009-12-04 14:41 453760 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-16 08:37 . 2009-08-04 13:58 2136064 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-16 08:37 . 2009-08-04 14:00 2180352 ——w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-16 08:37 . 2009-08-04 13:13 2015744 ——w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-16 08:37 . 2009-08-04 13:13 2057728 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 07:17 . 2005-05-26 17:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-08-16 06:35 . 2010-08-16 06:13 ——– d—–w- c:\documents and settings\HP_Administrator\Application Data\Symantec
2010-08-16 06:16 . 2005-05-26 17:46 ——– d—–w- c:\program files\Easy Internet signup
2010-08-16 06:14 . 2010-08-16 06:14 1832 –sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF528_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.20_T050708_WXP2_L4
09_M895_J250_7AMD_8Athlon 64_92.19_#100108_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK
2010-02-23 11:04 . 2005-05-26 17:49 ——– d—–w- c:\program files\Google
2010-02-18 05:39 . 2005-05-26 17:58 ——– d—–w- c:\program files\Symantec
2010-02-16 09:24 . 2010-02-16 09:41 3777280 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-02-16 09:24 . 2010-02-16 09:41 1260800 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-02-16 08:54 . 2005-01-28 09:40 93511 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-16 08:54 . 2010-02-16 08:54 45056 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2010-02-16 08:54 . 2010-02-16 08:54 44032 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2009-12-31 16:14 . 2004-08-10 12:00 352640 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-10 11:00 916480 ——w- c:\windows\system32\wininet.dll
2009-12-16 12:58 . 2004-08-10 12:00 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35 . 2004-08-10 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 14:41 . 2004-08-10 11:00 453760 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5244216]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-23 39408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-18 339968]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-05-26 180269]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-5 258048]
SpySubtract.lnk - c:\program files\InterMute\SpySubtract\sslaunch.exe [2005-5-26 73728]
Updates from HP.lnk - c:\program files\Updates from HP\309731\Program\Updates from HP.exe [2005-5-26 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-02-16 09:25 12464 —-a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2/16/2010 1:25 AM 25608]
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2/16/2010 1:25 AM 161800]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/16/2010 1:24 AM 333192]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/16/2010 1:25 AM 360584]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2/16/2010 1:24 AM 285392]
R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2/16/2010 1:24 AM 5832712]
R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [2/16/2010 1:24 AM 122376]
R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [2/16/2010 1:24 AM 30216]
R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [2/16/2010 1:24 AM 25736]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/23/2010 3:04 AM 135664]
.
Contents of the 'Scheduled Tasks' folder

2010-08-16 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-03-04 01:04]

2010-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 11:04]

2010-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 11:04]
.
.
——- Supplementary Scan ——-
.
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride =
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\v45qo4sv.default\
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-25 21:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(596)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1872)
c:\windows\system32\WININET.dll
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
c:\program files\InterMute\SpySubtract\SpySub.exe
.
**************************************************************************
.
Completion time: 2010-02-25 21:47:27 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-26 05:47
ComboFix2.txt 2010-02-25 09:51

Pre-Run: 225,917,341,696 bytes free
Post-Run: 225,938,223,104 bytes free

- - End Of File - - 33E8D53580EADBEA8BDF67B97FC01CC2

topfuelcoupe

Post #12February 26, 2010, 3:47 PM UTC

Malware log Malwarebytes' Anti-Malware 1.44 Database version: 3795 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 2/25/2010 10:22:36 PM mbam-log-2010-02-25 (22-22-36).txt Scan type: Quick Scan Objects scanned: 126436 Time elapsed: 4 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Friday, February 26, 2010 Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, February 26, 2010 02:17:50 Records in database: 3648622 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics: Objects scanned: 94303 Threats found: 1 Infected objects found: 1 Suspicious objects found: 0 Scan duration: 02:46:06 File name / Threat / Threats count C:\Program Files\Online Services\AOL90US\comps\toolbar\toolbr.EXE Infected: not-a-virus:AdWare.Win32.SearchIt.t 1 Selected area has been scanned.

CatByte

Post #13February 26, 2010, 4:00 PM UTC

Hi,

Please do the following:

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 18 and save it to your desktop.
Scroll down to where it says JDK 6 Update 18 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u18 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT

Please post a fresh DDS log and advise how your computer was running now and if there are any outstanding issues

topfuelcoupe

Post #14February 27, 2010, 9:37 AM UTC

DDS (Ver_09-12-01.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 8/15/2010 11:12:38 PM System Uptime: 2/27/2010 12:58:01 AM (1 hours ago) Motherboard: MSI | | ALBACORE Processor: AMD Athlon™ 64 Processor 3500+ | Socket 939 | 2188/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 225 GiB total, 210.122 GiB free. D: is FIXED (FAT32) - 8 GiB total, 1.395 GiB free. E: is CDROM () F: is CDROM () G: is Removable H: is Removable I: is Removable J: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1: 2/16/2010 12:25:12 AM - Software Distribution Service 3.0 RP2: 2/16/2010 12:41:28 AM - Software Distribution Service 3.0 RP3: 2/16/2010 1:04:42 AM - Restore Operation RP4: 2/16/2010 1:12:47 AM - Software Distribution Service 3.0 RP5: 2/16/2010 1:24:39 AM - Installed AVG 9.0 RP6: 2/16/2010 1:40:16 AM - Removed Norton Security Center RP7: 2/16/2010 1:41:15 AM - Avg8 Update RP8: 2/17/2010 2:38:11 AM - System Checkpoint RP9: 2/20/2010 10:50:41 AM - Software Distribution Service 3.0 RP10: 2/23/2010 1:15:42 AM - Removed AVG 9.0 RP11: 2/23/2010 1:23:55 AM - Removed AVG 9.0 RP12: 2/23/2010 1:44:02 AM - Software Distribution Service 3.0 RP13: 2/23/2010 2:33:40 AM - Software Distribution Service 3.0 RP14: 2/24/2010 3:00:14 AM - Software Distribution Service 3.0 RP15: 2/25/2010 3:49:40 AM - System Checkpoint RP16: 2/25/2010 10:29:16 PM - Installed Java™ 6 Update 18 RP17: 2/26/2010 11:04:16 PM - Removed Adobe Reader 6.0.1 RP18: 2/26/2010 11:04:34 PM - Removed Adobe Acrobat - Reader 6.0.2 Update RP19: 2/26/2010 11:04:40 PM - Installed Adobe Reader 9.3. RP20: 2/27/2010 12:51:30 AM - Removed J2SE Runtime Environment 5.0 RP21: 2/27/2010 12:52:13 AM - Removed Java™ 6 Update 18 RP22: 2/27/2010 1:10:25 AM - Installed Java™ 6 Update 18 ==== Installed Programs ====================== Acrobat.com Adobe AIR Adobe Download Manager Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 9.3 Agere Systems PCI Soft Modem AiO_Scan AiOSoftware ATI Control Panel ATI Display Driver AVG 9.0 Belarc Advisor 8.1 Blackhawk Striker 2 from HP Media Center (remove only) Blasterball 2 from HP Media Center (remove only) Blasterball 2 Holidays from HP Media Center (remove only) Blasterball 2 Remix from HP Media Center (remove only) Bounce Symphony from HP Media Center (remove only) BufferChm CameraDrivers Copy CP_AtenaShokunin1Config cp_dwSharkTaleAlbums1 cp_dwSharkTaleCards1 cp_dwShrek2Albums1 cp_dwShrek2Cards1 CP_PLSBusinessFlyers CreativeProjects CreativeProjectsTemplates Crystal Maze from HP Media Center (remove only) CueTour Destinations Director DocProc DocumentViewer Easy Internet Sign-up Fax Final Drive Nitro from HP Media Center (remove only) GemMaster Mystic Google Toolbar for Internet Explorer Google Update Helper Help and Support Additions HijackThis 2.0.2 Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) HP Boot Optimizer HP Deskjet Printer Preload HP Help and Support 4.0 HP Image Zone 4.8.6 HP Image Zone for Media Center PC HP Image Zone Plus 4.8.6 HP Photosmart Cameras 4.5 HP Product Assistant HP PSC & OfficeJet 4.7 HP Software Update HP Tunes HPIZplus450 HpSdpAppCoreApp HPSystemDiagnostics InstantShare IntelliMover Data Transfer Demo InterVideo WinDVD Player iTunes Java Auto Updater Java™ 6 Update 18 KBD Lexibox Deluxe from HP Media Center (remove only) LS_HSI Malwarebytes' Anti-Malware Microsoft .NET Framework 1.0 Hotfix (KB953295) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft Office Standard Edition 2003 Microsoft Plus! Dancer LE Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Works Mozilla Firefox (3.6) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) muvee autoProducer 4.0 muvee autoProducer unPlugged - HPD Otto Overball from HP Media Center (remove only) PanoStandAlone PC-Doctor for Windows Phoenix Assault from HP Media Center (remove only) PhotoGallery Photosmart 320,370,7400,8100,8400 Series Polar Bowler from HP Media Center (remove only) Polar Golfer from HP Media Center (remove only) PrintScreen PS2 PSPrinters06 Python 2.2 pywin32 extensions (build 203) Python 2.2.3 QFolder QuickProjects QuickTime Readme RealPlayer Remove Microsoft Money 2005 installer Remove Quicken New User Edition installer Scan ScannerCopy Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Internet Explorer 8 (KB978207) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971032) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978706) Shooting Stars Pool from HP Media Center (remove only) SkinsHP1 Slyder from HP Media Center (remove only) Sonic Encoders Sonic Express Labeler Sonic MyDVD Plus Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager Spybot - Search & Destroy SpySubtract Super Granny from HP Media Center (remove only) Tradewinds from HP Media Center (remove only) TrayApp Unload Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB978506) Update for Windows XP (KB898461) Update for Windows XP (KB955759) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Update for Windows XP (KB978207) Update Rollup 1 for Windows XP Media Center Edition 2005 with HDTV Support (KB873369) Updates from HP WebFldrs XP WebReg Windows Installer 3.1 (KB893803) Windows Internet Explorer 8 Windows Media Player 10 Hotfix [See KB889858 for more information] Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885354 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB891220 Windows XP Hotfix - KB891781 Windows XP Media Center Edition 2005 KB888316 Windows XP Media Center Edition 2005 KB890629 Windows XP Media Center Edition 2005 KB895678 Windows XP Media Center Edition 2005 KB973768 Yahoo! Messenger Yahoo! Software Update ==== Event Viewer Messages From Past Week ======== 2/23/2010 12:52:37 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 2/20/2010 10:59:06 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 AvgLdx86 AvgMfx86 Fips 2/20/2010 10:49:35 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: fasttx2k 2/20/2010 10:46:58 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 2/20/2010 10:24:23 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} ==== End Of File =========================== DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 1:22:46.15 on Sat 02/27/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.894.336 [GMT -8:00] AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe svchost.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe svchost.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe c:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\AVG\AVG9\avgam.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\InterMute\SpySubtract\SpySub.exe C:\WINDOWS\system32\wuauclt.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\AGRSMMSG.exe c:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\hphmon06.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows NT\Accessories\wordpad.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\O9KN83SR\dds[1].scr ============== Pseudo HJT Report =============== uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop uInternet Settings,ProxyOverride = uSearchURL,(Default) = hxxp://www.google.com/keyword/%s uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uURLSearchHooks: H - No File BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spysub~1.lnk - c:\program files\intermute\spysubtract\sslaunch.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\309731\program\Updates from HP.exe IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: avgrsstarter - avgrsstx.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\hp_adm~1\applic~1\mozilla\firefox\profiles\v45qo4sv.default\ FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-2-16 25608] R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-2-16 161800] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-16 333192] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-16 28424] R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-16 360584] R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-2-16 285392] R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-2-16 5832712] R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-2-16 122376] R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-2-16 30216] R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-2-16 25736] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-23 135664] =============== Created Last 30 ================ 2010-08-16 06:45:04 0 d-sha-r- C:\cmdcons 2010-08-16 06:45:03 0 d—–w- c:\windows\setup.pss 2010-08-16 06:44:53 0 d—–w- c:\windows\setupupd 2010-08-16 06:18:15 0 d-s—w- c:\documents and settings\hp_administrator\UserData 2010-08-16 06:14:28 1832 –sha-r- c:\windows\system32\drivers\103C_HP_CPC_PX769AA-ABA a1130n_YC_0Pavi_QMXF528_E53NAsyEPC2_47_IALBACORE_SMSI_V1.0_B3.20_T050708_WXP2_L4 09_M895_J250_7AMD_8Athlon 64_92.19_#100108_N10EC8139_Z11C1048C_G10025954_OHP DVD Writer 640c;IDE-DVD DROM6216.MRK 2010-08-16 06:14:17 90112 —-a-w- c:\windows\system32\ps2.EXE 2010-08-16 06:13:42 0 d—–w- c:\docume~1\hp_adm~1\applic~1\Symantec 2010-08-16 06:10:40 0 d—–w- c:\windows\system32\SoftwareDistribution 2010-08-16 06:04:07 243 —-a-w- c:\windows\system\hpsysdrv.dat 2010-08-16 06:02:55 0 d—–w- c:\windows\I386 2010-08-16 05:54:22 0 d—–r- c:\documents and settings\all users\Documents 2010-08-16 05:53:25 0 d—–r- c:\windows\Offline Web Pages 2010-08-16 05:52:47 0 d-sh–r- c:\windows\system32\dllcache 2010-02-27 09:10:45 73728 —-a-w- c:\windows\system32\javacpl.cpl 2010-02-26 06:29:38 411368 —-a-w- c:\windows\system32\deploytk.dll 2010-02-25 09:33:42 98816 —-a-w- c:\windows\sed.exe 2010-02-25 09:33:42 77312 —-a-w- c:\windows\MBR.exe 2010-02-25 09:33:42 261632 —-a-w- c:\windows\PEV.exe 2010-02-25 09:33:42 161792 —-a-w- c:\windows\SWREG.exe 2010-02-23 11:00:05 0 d-sh–w- c:\documents and settings\hp_administrator\PrivacIE 2010-02-23 10:57:37 0 d-sh–w- c:\documents and settings\hp_administrator\IETldCache 2010-02-23 10:42:47 69120 ——w- c:\windows\system32\dllcache\iecompat.dll 2010-02-23 10:42:29 0 d—–w- c:\windows\ie8updates 2010-02-23 10:42:13 12800 ——w- c:\windows\system32\dllcache\xpshims.dll 2010-02-23 10:42:12 594432 ——w- c:\windows\system32\dllcache\msfeeds.dll 2010-02-23 10:42:12 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll 2010-02-23 10:42:11 246272 ——w- c:\windows\system32\dllcache\ieproxy.dll 2010-02-23 10:42:11 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll 2010-02-23 10:42:11 11070464 ——w- c:\windows\system32\dllcache\ieframe.dll 2010-02-23 10:40:33 0 dc-h–w- c:\windows\ie8 2010-02-22 09:10:21 664 —-a-w- c:\windows\system32\d3d9caps.dat 2010-02-21 09:50:42 3840 —-a-w- c:\windows\system32\drivers\BANTExt.sys 2010-02-21 09:50:42 0 d—–w- c:\program files\Belarc 2010-02-20 18:52:09 0 d—–w- c:\program files\MSXML 4.0 2010-02-18 09:57:21 0 d—–w- c:\windows\system32\CatRoot_bak 2010-02-18 07:27:57 0 d—–w- c:\program files\Trend Micro 2010-02-18 07:20:01 0 d—–w- c:\docume~1\hp_adm~1\applic~1\Malwarebytes 2010-02-18 07:09:43 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-18 07:09:41 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-02-18 07:09:41 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-02-18 07:09:41 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-02-16 10:26:01 0 d—–w- c:\program files\Spybot - Search & Destroy 2010-02-16 10:26:01 0 d—–w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2010-02-16 09:45:48 0 d—–w- c:\program files\Yahoo! 2010-02-16 09:40:38 0 d—–w- c:\windows\system32\appmgmt 2010-02-16 09:25:19 0 d—–w- C:\$AVG 2010-02-16 09:25:09 12464 —-a-w- c:\windows\system32\avgrsstx.dll 2010-02-16 09:25:08 25608 —-a-w- c:\windows\system32\drivers\AVGIDSxx.sys 2010-02-16 09:25:08 161800 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-02-16 09:25:05 360584 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-02-16 09:24:58 333192 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-02-16 09:24:56 0 d—–w- c:\windows\system32\drivers\Avg 2010-02-16 09:24:53 0 d—–w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar 2010-02-16 09:24:43 0 d—–w- c:\program files\AVG 2010-02-16 09:24:40 0 d—–w- c:\docume~1\alluse~1\applic~1\avg9 2010-02-16 09:13:19 0 d—–w- c:\windows\system32\PreInstall 2010-02-16 09:07:41 0 d—–w- c:\windows\system32\wbem\Repository 2010-02-16 08:51:44 0 d—–w- c:\windows\system32\scripting 2010-02-16 08:51:44 0 d—–w- c:\windows\l2schemas 2010-02-16 08:50:28 0 d—–w- c:\windows\ServicePackFiles 2010-02-16 08:48:55 0 d—–w- c:\windows\network diagnostic 2010-02-16 08:43:18 272128 ——w- c:\windows\system32\drivers\bthport.sys 2010-02-16 08:43:18 272128 ——w- c:\windows\system32\dllcache\bthport.sys 2010-02-16 08:39:50 67866 ——w- c:\windows\system32\drivers\netwlan5.img 2010-02-16 08:38:56 64352 ——w- c:\windows\system32\drivers\ativmc20.cod 2010-02-16 08:38:52 453760 ——w- c:\windows\system32\dllcache\mrxsmb.sys 2010-02-16 08:37:29 2136064 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe 2010-02-16 08:37:28 2180352 ——w- c:\windows\system32\dllcache\ntoskrnl.exe 2010-02-16 08:37:28 2057728 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe 2010-02-16 08:37:28 2015744 ——w- c:\windows\system32\dllcache\ntkrpamp.exe ==================== Find3M ==================== 2009-12-31 16:14:12 352640 —-a-w- c:\windows\system32\drivers\srv.sys 2009-12-31 16:14:12 352640 —-a-w- c:\windows\system32\dllcache\srv.sys 2009-12-22 05:42:48 1506304 —-a-w- c:\windows\system32\dllcache\shdocvw.dll 2009-12-22 05:42:45 55808 —-a-w- c:\windows\system32\dllcache\extmgr.dll 2009-12-22 05:42:44 1054208 —-a-w- c:\windows\system32\dllcache\danim.dll 2009-12-22 05:42:43 151040 —-a-w- c:\windows\system32\dllcache\cdfview.dll 2009-12-22 05:42:43 1023488 —-a-w- c:\windows\system32\dllcache\browseui.dll 2009-12-21 19:14:05 916480 ——w- c:\windows\system32\wininet.dll 2009-12-21 19:14:05 916480 ——w- c:\windows\system32\dllcache\wininet.dll 2009-12-21 19:14:05 1208832 ——w- c:\windows\system32\dllcache\urlmon.dll 2009-12-21 19:14:04 5942784 ——w- c:\windows\system32\dllcache\mshtml.dll 2009-12-21 19:14:04 206848 ——w- c:\windows\system32\dllcache\occache.dll 2009-12-21 19:14:03 25600 ——w- c:\windows\system32\dllcache\jsproxy.dll 2009-12-21 19:14:03 184320 ——w- c:\windows\system32\dllcache\iepeers.dll 2009-12-21 19:14:01 387584 ——w- c:\windows\system32\dllcache\iedkcs32.dll 2009-12-21 13:19:18 173056 ——w- c:\windows\system32\dllcache\ie4uinit.exe 2009-12-16 12:58:04 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-16 12:58:04 343040 —-a-w- c:\windows\system32\dllcache\mspaint.exe 2009-12-16 12:57:07 18432 —-a-w- c:\windows\system32\dllcache\iedw.exe 2009-12-14 07:35:35 33280 —-a-w- c:\windows\system32\dllcache\csrsrv.dll 2009-12-14 07:35:35 33280 —-a-w- c:\windows\system32\csrsrv.dll 2009-12-09 05:53:44 726528 —-a-w- c:\windows\system32\dllcache\jscript.dll 2009-12-08 09:13:51 474112 —-a-w- c:\windows\system32\dllcache\shlwapi.dll ============= FINISH: 1:23:30.73 ===============

CatByte

Post #15February 27, 2010, 2:42 PM UTC

Hi,

you are clean Just some housekeeping to do know, please do the following:

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Now to remove the rest of the tools that we have used in fixing your machine:

Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If any logs/tools remain on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox, IE and chrome.
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

[Resolved] can't even Download SysRestorePoint

✨ Ask AI

Ask AI