What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Internet really messed up

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer runs OK, but my internet speeds have become downright horrible.
Every time I connect, it runs fine for a few minutes and then the drag starts.
When I disconnect and come back in the process is repeated. Feels like a leech program
that detects when I'm online and hoards resources. See logs below.Thanks!


DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 13:17:04.31 on 08-05-2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.91.1033.18.2550.1798 [GMT 5.5:30]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Mediafour\MacDrive 8\MacDrive8Service.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe
C:\Windows\system32\NLSSRV32.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Mediafour\MacDrive 8\MacDrive.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Users\Ajay\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Ajay\Documents\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uRun: [Google Update] "c:\users\ajay\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [AnyDVD] c:\program files\slysoft\anydvd\AnyDVDtray.exe
mRun: [Windows Services] System.exe
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [MacDrive 8 application] "c:\program files\mediafour\macdrive 8\MacDrive.exe"
mRun: [Getting started with MacDrive 8] "c:\program files\mediafour\macdrive 8\MDGetStarted.exe" /auto
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Prefs] c:\program files\odesk\oDeskLaunch.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\ajay\appdata\roaming\mozilla\firefox\profiles\hb30g6yj.default\
FF - prefs.js: browser.search.selectedEngine - Surf Canyon
FF - plugin: c:\users\ajay\appdata\local\google\update\1.2.183.23\npGoogleOneClick8.dll

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-11-30 52872]
R0 MDFSYSNT;MacDrive file system driver;c:\windows\system32\drivers\MDFSYSNT.SYS [2009-9-3 259176]
R0 MDPMGRNT;MacDrive partition driver;c:\windows\system32\drivers\MDPMGRNT.SYS [2009-7-31 27488]
R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2005-11-14 34176]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-30 216200]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-11-30 29512]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-30 242896]
R2 avg9emc;AVG E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-3-5 916760]
R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-5 308064]
R2 MacDrive8Service;MacDrive 8 service;c:\program files\mediafour\macdrive 8\MacDrive8Service.exe [2009-9-3 192512]
R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\nitro pdf\professional\NitroPDFDriverService.exe [2009-12-16 188736]
R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [2009-12-16 65856]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-3 1343400]

=============== Created Last 30 ================

2010-04-28 21:02:57 194488 —-a-w- c:\windows\system32\drivers\fvevol.sys
2010-04-28 21:02:56 1037312 —-a-w- c:\windows\system32\lsasrv.dll
2010-04-28 21:02:55 133720 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-04-14 09:18:34 3954568 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-14 09:18:34 3899280 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-04-14 09:18:31 427520 —-a-w- c:\windows\system32\vbscript.dll
2010-04-14 09:18:29 95744 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 09:18:29 221696 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 09:18:29 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 09:17:42 172032 —-a-w- c:\windows\system32\wintrust.dll
2010-04-14 09:17:36 132608 —-a-w- c:\windows\system32\cabview.dll

==================== Find3M ====================

2010-04-19 16:22:20 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-05 17:15:20 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-02-23 07:56:00 977920 —-a-w- c:\windows\system32\wininet.dll
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 –sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 –sha-r- c:\windows\fonts\StaticCache.dat
2009-11-30 11:34:59 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-11-30 11:34:59 32768 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-11-30 11:34:59 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat
2009-11-30 11:34:59 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 13:18:00.87 ===============




GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-05-08 13:08:33
Windows 6.1.7600
Running: 71wnr0sk.exe; Driver: C:\Users\Ajay\AppData\Local\Temp\pxldypob.sys


—- Devices - GMER 1.0.15 —-

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

—- EOF - GMER 1.0.15 —-


I appreciate this greatly. Thank you for your time.
Post #2
Hello maverick_aj and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
Post #3
Hi Thanks for replying Here's the combo log. ComboFix 10-05-08.02 - Ajay 09-05-2010 15:53:20.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.91.1033.18.2550.1374 [GMT 5.5:30] Running from: c:\users\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2010-04-09 to 2010-05-09 ))))))))))))))))))))))))))))))) . 2010-05-09 10:28 . 2010-05-09 10:28 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-05-08 07:33 . 2010-05-08 07:33 ——– d—–w- c:\program files\ERUNT 2010-05-01 10:40 . 2010-05-01 10:41 ——– d—–w- c:\program files\Common Files\Adobe 2010-04-28 21:02 . 2009-09-26 05:58 194488 —-a-w- c:\windows\system32\drivers\fvevol.sys 2010-04-28 21:02 . 2009-12-11 07:38 1037312 —-a-w- c:\windows\system32\lsasrv.dll 2010-04-28 21:02 . 2009-12-11 07:44 133720 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2010-04-19 16:22 . 2010-04-19 16:22 242696 —-a-w- c:\programdata\avg9\update\backup\avgtdix.sys 2010-04-19 16:21 . 2010-04-19 16:21 1689952 —-a-w- c:\programdata\avg9\update\backup\avgupd.dll 2010-04-14 09:18 . 2010-02-27 12:07 3954568 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-04-14 09:18 . 2010-02-27 12:07 3899280 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-04-14 09:18 . 2010-03-08 21:33 427520 —-a-w- c:\windows\system32\vbscript.dll 2010-04-14 09:18 . 2010-02-27 07:32 221696 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-04-14 09:18 . 2010-02-27 07:32 95744 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2010-04-14 09:18 . 2010-02-27 07:32 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-04-14 09:17 . 2009-12-29 06:55 172032 —-a-w- c:\windows\system32\wintrust.dll 2010-04-14 09:17 . 2010-01-09 06:52 132608 —-a-w- c:\windows\system32\cabview.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-05-08 07:56 . 2009-12-22 11:43 ——– d—–w- c:\users\Ajay\AppData\Roaming\Nitro PDF 2010-04-19 16:22 . 2009-11-30 11:50 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-03-21 10:30 . 2010-03-21 10:30 ——– d—–w- c:\users\Ajay\AppData\Roaming\U3 2010-03-05 17:15 . 2010-03-05 17:15 12464 —-a-w- c:\windows\system32\avgrsstx.dll 2010-03-05 17:15 . 2009-11-30 11:49 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-03-05 17:15 . 2009-11-30 11:49 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-03-05 17:15 . 2009-11-30 11:50 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-02-23 07:56 . 2010-03-30 19:39 977920 —-a-w- c:\windows\system32\wininet.dll 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-11-25 07:32 1230080 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Google Update"="c:\users\Ajay\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-11-30 135664] "AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-11-11 3124160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MacDrive 8 application"="c:\program files\Mediafour\MacDrive 8\MacDrive.exe" [2009-06-15 202328] "Getting started with MacDrive 8"="c:\program files\Mediafour\MacDrive 8\MDGetStarted.exe" [2009-03-31 141312] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600] "Prefs"="c:\program files\oDesk\oDeskLaunch.exe" [2009-12-01 357696] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-11 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-11 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-11 150552] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-03 1343400] S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2010-03-05 52872] S0 MDFSYSNT;MacDrive file system driver; [x] S0 MDPMGRNT;MacDrive partition driver; [x] S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2005-11-14 34176] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-03-05 216200] S1 AvgTdiX;AVG Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-04-19 242896] S2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-03-05 916760] S2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-03-05 308064] S2 MacDrive8Service;MacDrive 8 service;c:\program files\Mediafour\MacDrive 8\MacDrive8Service.exe [2009-09-03 192512] S2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\Nitro PDF\Professional\NitroPDFDriverService.exe [2009-12-16 188736] S2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [2009-12-16 65856] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] . Contents of the 'Scheduled Tasks' folder 2010-05-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4218848366-2069249929-2307811531-1000Core.job - c:\users\Ajay\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-30 11:36] 2010-05-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4218848366-2069249929-2307811531-1000UA.job - c:\users\Ajay\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-30 11:36] . . ——- Supplementary Scan ——- . IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: {A45CDFF1-9EDC-48E2-B460-A1DBA8956306} = 202.138.97.193 202.138.96.2 FF - ProfilePath - c:\users\Ajay\AppData\Roaming\Mozilla\Firefox\Profiles\hb30g6yj.default\ FF - prefs.js: browser.search.selectedEngine - Surf Canyon FF - plugin: c:\users\Ajay\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll . - - - - ORPHANS REMOVED - - - - ShellIconOverlayIdentifiers-MacDrive volume icons - (no file) . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'Explorer.exe'(4740) c:\program files\Mediafour\MacDrive 8\MDVolumeIcons.dll c:\program files\Mediafour\MacDrive 8\MACDRAPI.DLL . Completion time: 2010-05-09 16:01:24 ComboFix-quarantined-files.txt 2010-05-09 10:31 Pre-Run: 13,913,210,880 bytes free Post-Run: 13,920,878,592 bytes free - - End Of File - - FC5ECAC191E2F8EA55C0523BFE368A99
Post #4
maverick_aj,

🖼Click to load external image (Posted Image) Please run DDS for me again and post both the DDS.txt and Attach.txt logs.

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • DDS and Attach.txt logs
  • MBAM log
  • Kaspersky log
Post #5
Hi Please see logs DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 0:18:41.93 on 10-05-2010 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.91.1033.18.2550.1607 [GMT 5.5:30] ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Mediafour\MacDrive 8\MacDrive8Service.exe C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\Program Files\Nitro PDF\Professional\NitroPDFDriverService.exe C:\Windows\system32\NLSSRV32.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\AVG\AVG9\avgemc.exe C:\Program Files\AVG\AVG9\avgam.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskhost.exe C:\Program Files\Mediafour\MacDrive 8\MacDrive.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Windows\system32\igfxsrvc.exe C:\Users\Ajay\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Reliance Netconnect - Broadband+\Reliance Netconnect.exe C:\Users\Ajay\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Ajay\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Ajay\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Ajay\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Ajay\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Ajay\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Ajay\Documents\Downloads\dds.scr C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll uRun: [Google Update] "c:\users\ajay\appdata\local\google\update\GoogleUpdate.exe" /c uRun: [AnyDVD] c:\program files\slysoft\anydvd\AnyDVDtray.exe mRun: [MacDrive 8 application] "c:\program files\mediafour\macdrive 8\MacDrive.exe" mRun: [Getting started with MacDrive 8] "c:\program files\mediafour\macdrive 8\MDGetStarted.exe" /auto mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Prefs] c:\program files\odesk\oDeskLaunch.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: {A45CDFF1-9EDC-48E2-B460-A1DBA8956306} = 202.138.97.193 202.138.96.2 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Notify: igfxcui - igfxdev.dll AppInit_DLLs: c:\windows\system32\avgrsstx.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\ajay\appdata\roaming\mozilla\firefox\profiles\hb30g6yj.default\ FF - prefs.js: browser.search.selectedEngine - Surf Canyon —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-11-30 52872] R0 MDFSYSNT;MacDrive file system driver;c:\windows\system32\drivers\MDFSYSNT.SYS [2009-9-3 259176] R0 MDPMGRNT;MacDrive partition driver;c:\windows\system32\drivers\MDPMGRNT.SYS [2009-7-31 27488] R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2005-11-14 34176] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-30 216200] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-11-30 29512] R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-30 242896] R2 avg9emc;AVG E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-3-5 916760] R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-5 308064] R2 MacDrive8Service;MacDrive 8 service;c:\program files\mediafour\macdrive 8\MacDrive8Service.exe [2009-9-3 192512] R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\nitro pdf\professional\NitroPDFDriverService.exe [2009-12-16 188736] R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [2009-12-16 65856] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-3 1343400] =============== Created Last 30 ================ 2010-05-09 10:30:37 0 d-sh–w- C:\$RECYCLE.BIN 2010-05-09 10:22:29 98816 —-a-w- c:\windows\sed.exe 2010-05-09 10:22:29 77312 —-a-w- c:\windows\MBR.exe 2010-05-09 10:22:29 256512 —-a-w- c:\windows\PEV.exe 2010-05-09 10:22:29 161792 —-a-w- c:\windows\SWREG.exe 2010-04-28 21:02:57 194488 —-a-w- c:\windows\system32\drivers\fvevol.sys 2010-04-28 21:02:56 1037312 —-a-w- c:\windows\system32\lsasrv.dll 2010-04-28 21:02:55 133720 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2010-04-14 09:18:34 3954568 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-04-14 09:18:34 3899280 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-04-14 09:18:31 427520 —-a-w- c:\windows\system32\vbscript.dll 2010-04-14 09:18:29 95744 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2010-04-14 09:18:29 221696 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2010-04-14 09:18:29 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-04-14 09:17:42 172032 —-a-w- c:\windows\system32\wintrust.dll 2010-04-14 09:17:36 132608 —-a-w- c:\windows\system32\cabview.dll ==================== Find3M ==================== 2010-04-19 16:22:20 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-03-05 17:15:20 12464 —-a-w- c:\windows\system32\avgrsstx.dll 2010-02-23 07:56:00 977920 —-a-w- c:\windows\system32\wininet.dll 2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2009-07-14 04:41:57 174 –sha-w- c:\program files\desktop.ini 2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2009-06-10 21:26:35 9633792 –sha-r- c:\windows\fonts\StaticCache.dat 2009-11-30 11:34:59 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2009-11-30 11:34:59 32768 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2009-11-30 11:34:59 16384 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat 2009-11-30 11:34:59 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe ============= FINISH: 0:19:11.25 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-03-17.01) Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume2 Install Date: 30-11-2009 17:04:10 System Uptime: 05-09-2010 23:42:39 (-2855 hours ago) Motherboard: Acer | | Tahoe Processor: Intel® Core™2 Duo CPU T7300 @ 2.00GHz | U2E1 | 2001/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 68 GiB total, 13.033 GiB free. D: is FIXED (NTFS) - 68 GiB total, 23.779 GiB free. E: is CDROM (CDFS) G: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP70: 29-04-2010 03:00:15 - Windows Update RP72: 29-04-2010 20:00:22 - Avg Update RP74: 06-05-2010 09:36:38 - Avg Update RP75: 08-05-2010 13:02:27 - whatthetech ==== Installed Programs ====================== "Nero SoundTrax Help µTorrent 2007 Microsoft Office Suite Service Pack 1 (SP1) Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 9.3.2 Advertising Center AnyDVD Apple Application Support Apple Mobile Device Support Apple Software Update AVG 9.0 Bonjour DolbyFiles ERUNT 1.1j Google Chrome HDAUDIO Soft Data Fax Modem with SmartCP Hijackthis 1.99.1 ImagXpress Intel® Graphics Media Accelerator Driver Intel® TV Wizard iPod To Computer Transfer 5.6 iTunes MacDrive 8 Menu Templates - Starter Kit Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Visual C++ 2005 Redistributable Movie Templates - Starter Kit Mozilla Firefox (3.5.7) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero 9 Nero BurningROM Nero BurnRights Nero ControlCenter Nero CoverDesigner Nero CoverDesigner Help Nero Disc Copy Gadget Nero Disc Copy Gadget Help Nero DiscSpeed Nero DriveSpeed Nero Express Nero InfoTool Nero Installer Nero PhotoSnap Nero PhotoSnap Help Nero Recode Nero Recode Help Nero Rescue Agent Nero RescueAgent Help Nero ShowTime Nero StartSmart Nero StartSmart Help Nero Vision Nero WaveEditor Nero WaveEditor Help NeroBurningROM NeroExpress neroxml Nitro PDF Professional oDesk MiniCam 2.0.73 oDesk ScreenSnap 2.0.113 oDesk Share 2.0.69 oDesk Team 2.0.140 QuickTime Reliance Netconnect - Broadband+ Security Update for 2007 Microsoft Office System (KB951550) Security Update for 2007 Microsoft Office System (KB951944) Security Update for 2007 Microsoft Office System (KB955936) Security Update for Microsoft Office Excel 2007 (KB955470) Security Update for Microsoft Office PowerPoint 2007 (KB951338) Security Update for Microsoft Office Publisher 2007 (KB950114) Security Update for Microsoft Office system 2007 (KB951808) Security Update for Microsoft Office system 2007 (KB954326) Security Update for Microsoft Office Word 2007 (KB950113) SoulSeek 157 NS 13e SoundTrax Update for Microsoft Office Access 2007 Help (KB957241) Update for Microsoft Office Excel 2007 Help (KB957242) Update for Microsoft Office Outlook 2007 (KB952142) Update for Microsoft Office Outlook 2007 Help (KB957246) Update for Microsoft Office PowerPoint 2007 Help (KB957247) Update for Microsoft Office Publisher 2007 Help (KB957249) Update for Microsoft Office Word 2007 Help (KB957252) Update for Microsoft Script Editor Help (KB957253) Update for Office 2007 (KB946691) Update for Outlook 2007 Junk Email Filter (kb957829) WinRAR archiver ==== Event Viewer Messages From Past Week ======== 09-05-2010 15:58:35, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 09-05-2010 15:52:55, Error: Service Control Manager [7034] - The XAudioService service terminated unexpectedly. It has done this 1 time(s). 08-05-2010 14:03:24, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cdrom 08-05-2010 13:57:05, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avg9wd service. 08-05-2010 13:56:35, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control. 08-05-2010 13:15:01, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f4 (0x00000003, 0x87502d40, 0x87502eac, 0x82c33d90). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 050810-25771-01. ==== End Of File =========================== Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4084 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 10-05-2010 01:29:19 mbam-log-2010-05-10 (01-29-19).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 275692 Time elapsed: 1 hour(s), 3 minute(s), 51 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Monday, May 10, 2010 Operating system: Microsoft Professional (build 7600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Sunday, May 09, 2010 16:14:07 Records in database: 4089138 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ G:\ Scan statistics: Objects scanned: 166212 Threats found: 2 Infected objects found: 2 Suspicious objects found: 0 Scan duration: 01:38:52 File name / Threat / Threats count C:\Program Files\Nero\nero9patch.exe Infected: Trojan.Win32.Rettesser.ak 1 D:\Audio\House\schiller & heppner(Club RMX).mp3 Infected: Trojan-Downloader.WMA.GetCodec.v 1 Selected area has been scanned. Thanks again!
Post #6
maverick_aj,

🖼Click to load external image (Posted Image)Your Nero9 software appears to be using cracks and/or keygens. We don't support software piracy on this forum so, while I’ll deal with your current problem, any further help will be based on you not being seen to involve yourself with such practices in the future. You should also be aware that the issues you have may very well have come from the various files you are handling, which are seen as an effective infection vector by the malware writers of this world. Not much else is showing up in your logs, so it may well be the source of your entire problem.

🖼Click to load external image (Posted Image) Please download OTM
  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Files
C:\Program Files\Nero\nero9patch.exe
D:\Audio\House\schiller & heppner(Club RMX).mp3

:Commands
[EmptyFlash]
[EmptyTemp]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

🖼Click to load external image (Posted Image) Uninstall ComboFix
  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
    Combofix /Uninstall
🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Cleanup with OTM
  • Double-click OTM.exe to start the program.
  • Close all other programs apart from OTM as this step will require a reboot
  • On the OTM main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
  • Manually delete any remaining tools or logs from our work
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  • Avoid using P2P programs, cracks and keygens! Refer back to my earlier post for more information.
  • Consider running in a limited user account. See this post for more information.
  • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
If you continue to have issues with your browser, start a new thread in our Browsers, Internet and email forum Be sure to include a link to this thread.

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #7
Hi Thanks a ton! Will follow all the advice. Couldn't get a copy of the log - it didn't let me click anything except "Yes" for a system restart. Thanks again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI