bluespoons61
Have re-run MCPR and got the message CLEAN UP SUCCESSFUL
Spyware / Malware / Virus Removal
[Solved] Unknown Infection - second attempt
26 min read
bluespoons61
Logs, as requested in your most recent post - awaiting further instructions at your convenience;
DDS
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 21:11:40.35 on 25/05/2010
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255.19 [GMT 1:00]
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\AOL\1254164638\ee\AOLSoftware.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\AOL\1254164638\ee\AOLDesktop.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\Common Files\AOL\1254164638\ee\aexplore.exe
C:\DOCUME~1\Jez\LOCALS~1\Temp\MCPR.tmp\McClnUI.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Documents and Settings\Jez\Desktop\dds.scr
C:\WINDOWS\system32\wuauclt.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://www.myaolbroadband.co.uk
uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\spybot~1\spybot~1\SDHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol broadband toolbar 5.0\aoltb.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AOL Broadband Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol broadband toolbar 5.0\aoltb.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [HostManager] c:\program files\common files\aol\1254164638\ee\AOLSoftware.exe
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: &AOL Toolbar Search - c:\program files\aol\aol broadband toolbar 5.0\resources\en-gb\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\spybot~1\spybot~1\SDHelper.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} - hxxp://www.pitchero.com/profile/ImageUploader5.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
============= SERVICES / DRIVERS ===============
=============== Created Last 30 ================
2010-04-26 22:17 –ds—- c:\documents and settings\jez\UserData
2010-04-26 21:14 a-dshr– C:\autorun.inf
==================== Find3M ====================
2010-04-29 15:39 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 15:39 20,952 a——- c:\windows\system32\drivers\mbam.sys
2010-03-12 18:02 261,632 a——- c:\windows\PEV.exe
2010-03-10 09:02 417,792 a——- c:\windows\system32\vbscript.dll
2010-02-26 07:12 662,016 a——- c:\windows\system32\wininet.dll
2010-02-26 07:12 81,920 a——- c:\windows\system32\ieencode.dll
============= FINISH: 21:12:33.68 ===============
ATTACH
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-06-26.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 27/09/2009 15:09:04
System Uptime: 25/05/2010 20:01:49 (1 hours ago)
Motherboard: ABIT | | i845E-W83627HF
Processor: Intel® Pentium® 4 CPU 2.00GHz | Socket 478 | 2009/100mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 10 GiB total, 0.178 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 5.148 GiB free.
E: is FIXED (FAT32) - 9 GiB total, 4.054 GiB free.
F: is FIXED (FAT32) - 10 GiB total, 6.491 GiB free.
G: is CDROM ()
H: is CDROM (CDFS)
==== Disabled Device Manager Items =============
==== System Restore Points ===================
No restore point in system.
==== Installed Programs ======================
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.1
Adobe Shockwave Player 11.5
AOL Broadband Toolbar 5.0
AOL Registration
AOL Uninstaller (Choose which Products to Remove)
Argente - Registry Cleaner 1.5.5.2
avast! Free Antivirus
CDDRV_Installer
ERUNT 1.1j
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976002-v5)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Java™ 6 Update 16
Junk Mail filter update
KhalSetup
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSVCRT
Nero 7 Premium
OGA Notifier 2.0.0048.0
Realtek AC'97 Audio
Revo Uninstaller 1.85
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB960003)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB959997)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981350)
Segoe UI
Spybot - Search & Destroy
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Office 2007 (KB934391)
Update for Outlook 2007 Junk Email Filter (kb981726)
Update for Windows XP (KB898461)
Update for Windows XP (KB925720)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
Update for Windows XP (KB980182)
Viewpoint Media Player
WebFldrs XP
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows XP Hotfix - KB885295
==== Event Viewer Messages From Past Week ========
19/05/2010 23:42:52, error: Dhcp [1002] - The IP address lease 192.168.1.35 for the Network Card with network address 00508DA4C8D3 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
19/05/2010 23:03:49, error: Print [6161] - The document Microsoft Word - audit_0709[2].doc owned by Jez failed to print on printer Canon MP140 series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 805144. Number of bytes printed: 483080. Total number of pages in the document: 16. Number of pages printed: 0. Client machine: \\SAYLE-7BD765717. Win32 error code returned by the print processor: 13 (0xd).
==== End Of File ===========================
oldman960
Hi bluesspoons61,
Let's clean out the temp files then remove the tools. That should give you a bit more space.
Download TFC to your desktop
From your desktop, please delete, if present
Next
Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Post back after you are finished. Perhaps there are some programs you can move to another partion.
Good job.Have re-run MCPR and got the message CLEAN UP SUCCESSFUL
For all intents and purposes your C:\ drive is full. That combined with the small amount of ram would account for some of the sluggishness. 10GB is very small for running XP, windows itself will take up almost half of that. I'm not sure if you will be able to update your java or adobe reader with the small amount of free space left.C: is FIXED (NTFS) - 10 GiB total, 0.178 GiB free.
Let's clean out the temp files then remove the tools. That should give you a bit more space.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
From your desktop, please delete, if present
- any notepads/logs that we created
- MCPR.exe (if you haven't used it yet, please do so before deleting)
- GMER.exe (i91vxye6.exe)
Next
Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Post back after you are finished. Perhaps there are some programs you can move to another partion.
bluespoons61
As ever your advice is clear and constructive, am about to run TFC but was slightly confused by this section of the message
Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Post back after you are finished. Perhaps there are some programs you can move to another partion.
What do you mean by following line?
Thank You
Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Post back after you are finished. Perhaps there are some programs you can move to another partion.
What do you mean by following line?
Thank You
oldman960
Hi bluespoons61,
It was one of those days 
Click the Start button, click Run. Copy and paste the following line into the run box and click OK
combofix /uninstall
It was one of those days Click the Start button, click Run. Copy and paste the following line into the run box and click OK
combofix /uninstall
bluespoons61
Thank you for the clarification. I have taken all the steps you asked of me in the first mail and then ran the unistall, which has completed successfully. In between the two steps the servicehost.defaultGRP message popped up again, this time with the following information following a colon
AOLSoftware.exe Application Error
Not sure if this is of any significance?
All the issues that were a concern when I first posted, suich as lack of access to hidden folders and the constant errosion of free storage space appear resolved. I think your diagnosis has prompted me to also recognise that the old pc probably needs a bit of an upgrade now!!
Any advice on further steps I should take (other than donating to help keep the site up, which I am going to do on completion of this post!) would be welcome.
Also - there was an application to 'flash' clean remote drives used in this process; can I plug additional USBs and the like in and flash them or would that just create the danger of re-infecting the system?
oldman960
Hi bluespoons61,
Local big box stores usually have ram at a reasonable price. I recently bought 1GB for less than $30C, unfortunately the $16 wouldn't work on the computer I was working on. Sites like Crucial have scanners that you can use to identify the type and amount of ram you can install in your computer.
When attaching an unknown USB device to the computer, hold down the shift key to prevent it from auto running. Once windows recognizes the drive, run FDD.
Take care and good luck with your upgrades.
I posted some additional information earlier in this thread. I would hold off on updating Adobe Reader or installing additional Security programs until you either upgrade or replace the harddrive or create enough room. It may be possible to install and run some of the programs from a different drive. http://forums.whatthetech.com/Unknown_Infe…130#entry651130Any advice on further steps I should take
Local big box stores usually have ram at a reasonable price. I recently bought 1GB for less than $30C, unfortunately the $16 wouldn't work on the computer I was working on. Sites like Crucial have scanners that you can use to identify the type and amount of ram you can install in your computer.
Thank you.(other than donating to help keep the site up, which I am going to do on completion of this post!)
AOL is on the list of suspects for this message. The solution is to uninstall it if you don't use it or try uninstalling and reinstalling.In between the two steps the servicehost.defaultGRP message popped up again, this time with the following information following a colon
AOLSoftware.exe Application Error
Yes that would be Flash Drive Disinfector. If you have deleted it you can get the link and instructions from HEREAlso - there was an application to 'flash' clean remote drives used in this process; can I plug additional USBs and the like in and flash them or would that just create the danger of re-infecting the system?
When attaching an unknown USB device to the computer, hold down the shift key to prevent it from auto running. Once windows recognizes the drive, run FDD.
Take care and good luck with your upgrades.
bluespoons61
Oldman960, thanks for all your support - it has been a holiday weekend here in the UK and now I'm going away for a few days with work again. Will be sure to look at all your suggestions but just wanted to thank you again to pretty much wrap the thread up.
Cheers amigo
oldman960
Hi bluespoons61,
You are welcome.
oldman960
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI