What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Previously infected computer needs one last check...

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I'm cleaning a computer for a friend, and I got rid of a lot of viruses and spyware using AVG and Malwarebyes' Anti-Malware in safe mode. It's no longer symptomatic, but I would appreciate one final check so that I can hand it back in the best condition possible. Thank you for any help.

–


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:01:05 PM, on 8/13/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\Internet Security\UfUpdUi.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Safari\Safari.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…O&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…O&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - MRI_DISABLED - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
O4 - HKLM\..\Run: [WAWifiMessage] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [Boingo Wi-Fi] "C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk"
O4 - HKLM\..\Run: [Performance Center] "C:\Program Files\Ascentive\Performance Center\APCMain.exe" -m
O4 - HKLM\..\Run: [PC SpeedScan Pro] "C:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe" -m
O4 - HKLM\..\Run: [HP Health Check Scheduler] "c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [RunSpySweeperScheduleAtStartup] "C:\Windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{BD3DBAFC-593D-4BAD-962A-D1FAD5649AA1}
O4 - HKCU\..\Run: [Desktop Software] "C:\Program Files\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden
O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
O4 - HKCU\..\RunOnce: [Shockwave Updater] "C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE" -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.1; .NET CLR 3.5.30729; .NET CLR 3.0.30618)" -"http://www.miniclip.com/games/slingshot/en/"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: MRI_DISABLED
O4 - Global Startup: Skype Zones.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: skype Monitor Service (skypeMonitor) - Boingo Wireless, Inc. - C:\Program Files\Skype Wi-Fi\WENGINE\wmonitor.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 9484 bytes
Post #2
Hi

Please do the following:



Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows Vista Home Premium Edition Windows Information: Service Pack 2 (build 6002), 32-bit Base Board Manufacturer: Hewlett-Packard BIOS Manufacturer: Hewlett-Packard System Manufacturer: Hewlett-Packard System Product Name: Presario C700 Notebook PC Logical Drives Mask: 0x0000001c Kernel Drivers (total 151): 0x81C08000 \SystemRoot\system32\ntkrnlpa.exe 0x81FC1000 \SystemRoot\system32\hal.dll 0x80409000 \SystemRoot\system32\kdcom.dll 0x80410000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x80480000 \SystemRoot\system32\PSHED.dll 0x80491000 \SystemRoot\system32\BOOTVID.dll 0x80499000 \SystemRoot\system32\CLFS.SYS 0x804DA000 \SystemRoot\system32\CI.dll 0x80607000 \SystemRoot\system32\drivers\Wdf01000.sys 0x80683000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x80690000 \SystemRoot\system32\drivers\acpi.sys 0x806D6000 \SystemRoot\system32\drivers\WMILIB.SYS 0x806DF000 \SystemRoot\system32\drivers\msisadrv.sys 0x806E7000 \SystemRoot\system32\drivers\pci.sys 0x8070E000 \SystemRoot\System32\drivers\partmgr.sys 0x8071D000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x80720000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x8072A000 \SystemRoot\system32\drivers\volmgr.sys 0x80739000 \SystemRoot\System32\drivers\volmgrx.sys 0x80783000 \SystemRoot\system32\DRIVERS\pciide.sys 0x8078A000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS 0x80798000 \SystemRoot\System32\drivers\mountmgr.sys 0x8220A000 \SystemRoot\system32\DRIVERS\iaStor.sys 0x822D1000 \SystemRoot\system32\drivers\atapi.sys 0x822D9000 \SystemRoot\system32\drivers\ataport.SYS 0x822F7000 \SystemRoot\system32\drivers\fltmgr.sys 0x82329000 \SystemRoot\system32\drivers\fileinfo.sys 0x82339000 \SystemRoot\System32\Drivers\PxHelp20.sys 0x82342000 \SystemRoot\System32\Drivers\ksecdd.sys 0x87A0B000 \SystemRoot\system32\drivers\ndis.sys 0x87B16000 \SystemRoot\system32\drivers\msrpc.sys 0x87B41000 \SystemRoot\system32\drivers\NETIO.SYS 0x87C09000 \SystemRoot\System32\drivers\tcpip.sys 0x87CF3000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x87E06000 \SystemRoot\System32\Drivers\Ntfs.sys 0x87F16000 \SystemRoot\system32\drivers\volsnap.sys 0x87F4F000 \SystemRoot\System32\Drivers\spldr.sys 0x87F57000 \SystemRoot\System32\Drivers\mup.sys 0x87F66000 \SystemRoot\System32\drivers\ecache.sys 0x87F8D000 \SystemRoot\system32\drivers\disk.sys 0x87F9E000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x87FBF000 \SystemRoot\system32\drivers\crcdisk.sys 0x87FD5000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x87FE0000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x87FE9000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x87FF8000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x87FFC000 \SystemRoot\system32\DRIVERS\cpqbttn.sys 0x87DD5000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x87DE5000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x87DEC000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x8C007000 \SystemRoot\system32\DRIVERS\igdkmd32.sys 0x8C654000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x8C6F5000 \SystemRoot\System32\drivers\watchdog.sys 0x8C701000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8BC08000 \SystemRoot\system32\DRIVERS\bcmwl6.sys 0x8BC8E000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x8BC99000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x8BCD7000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x8BCE6000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys 0x8BCF7000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x8BD0A000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x8BD15000 \SystemRoot\system32\DRIVERS\Apfiltr.sys 0x8BD3E000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x8BD49000 \SystemRoot\system32\drivers\pfc.sys 0x8BD4F000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x8BD67000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys 0x8BD6D000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x8BD9C000 \SystemRoot\system32\DRIVERS\storport.sys 0x8BDDD000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8BDE8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x8C78E000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8C799000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8C7BC000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8C7CB000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8C7DF000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x87B7C000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8BC00000 \SystemRoot\system32\DRIVERS\swenum.sys 0x87B8C000 \SystemRoot\system32\DRIVERS\ks.sys 0x8C7F4000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x87BB6000 \SystemRoot\system32\DRIVERS\umbus.sys 0x87DF5000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x87BC3000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x823B3000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x823C4000 \SystemRoot\system32\drivers\CHDRT32.sys 0x807A8000 \SystemRoot\system32\drivers\portcls.sys 0x807D5000 \SystemRoot\system32\drivers\drmk.sys 0x805BA000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys 0x8CA09000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys 0x8CB0C000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys 0x8CBC1000 \SystemRoot\system32\drivers\modem.sys 0x8CBCE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x8CBD7000 \SystemRoot\System32\Drivers\Null.SYS 0x8CBDE000 \SystemRoot\System32\Drivers\Beep.SYS 0x8CBE5000 \SystemRoot\System32\drivers\vga.sys 0x8CC0D000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8CC2E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x8CC36000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8CC3E000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8CC49000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8CC57000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x8CC60000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8CC76000 \SystemRoot\system32\DRIVERS\smb.sys 0x8CC8A000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8CCBC000 \SystemRoot\system32\drivers\afd.sys 0x8CD04000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8CD1A000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8CD28000 \SystemRoot\system32\DRIVERS\eabfiltr.sys 0x8CD2A000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x8CD3D000 \SystemRoot\system32\DRIVERS\tmtdi.sys 0x8CD4F000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8CD8B000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8CD95000 \SystemRoot\System32\Drivers\dfsc.sys 0x8CDAC000 \SystemRoot\System32\Drivers\avgmfx86.sys 0x8CDB2000 \SystemRoot\System32\Drivers\avgldx86.sys 0x8CDE6000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x8CC00000 \SystemRoot\System32\Drivers\crashdmp.sys 0x87D0E000 \SystemRoot\System32\Drivers\dump_iaStor.sys 0x94A00000 \SystemRoot\System32\win32k.sys 0x8CBF1000 \SystemRoot\System32\drivers\Dxapi.sys 0xA5A08000 \SystemRoot\system32\DRIVERS\monitor.sys 0x94C20000 \SystemRoot\System32\TSDDD.dll 0x94C40000 \SystemRoot\System32\cdd.dll 0xA5A17000 \SystemRoot\system32\drivers\luafv.sys 0xA5A32000 \SystemRoot\system32\DRIVERS\tmpreflt.sys 0xA5A3F000 \SystemRoot\system32\DRIVERS\vsapint.sys 0xA5B81000 \SystemRoot\system32\DRIVERS\tmxpflt.sys 0xA8E0A000 \SystemRoot\system32\drivers\spsys.sys 0xA8EBA000 \SystemRoot\system32\DRIVERS\lltdio.sys 0xA8ECA000 \SystemRoot\system32\DRIVERS\nwifi.sys 0xA8EF4000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xA8EFE000 \SystemRoot\system32\DRIVERS\rspndr.sys 0xA8F11000 \SystemRoot\system32\drivers\HTTP.sys 0xA8F7E000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xA8F9B000 \SystemRoot\system32\DRIVERS\bowser.sys 0xA8FB4000 \SystemRoot\System32\drivers\mpsdrv.sys 0xA8FC9000 \SystemRoot\system32\drivers\mrxdav.sys 0xA5BD2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xAB40F000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xAB448000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0xAB460000 \SystemRoot\System32\DRIVERS\srv2.sys 0xAB487000 \SystemRoot\System32\DRIVERS\srv.sys 0xAB4D5000 \SystemRoot\system32\DRIVERS\tmcomm.sys 0xAB500000 \SystemRoot\system32\DRIVERS\tmevtmgr.sys 0xAB50F000 \SystemRoot\system32\DRIVERS\tmactmon.sys 0xAB522000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xAD60E000 \SystemRoot\system32\drivers\peauth.sys 0xAD6EC000 \SystemRoot\System32\Drivers\secdrv.SYS 0xAD6F6000 \SystemRoot\System32\drivers\tcpipreg.sys 0xAD702000 \SystemRoot\system32\DRIVERS\xaudio.sys 0xAD70A000 \SystemRoot\system32\DRIVERS\ipnat.sys 0x77760000 \Windows\System32\ntdll.dll Processes (total 87): 0 System Idle Process 4 System 412 C:\Windows\System32\smss.exe 500 csrss.exe 544 C:\Windows\System32\wininit.exe 556 csrss.exe 564 C:\Program Files\AVG\AVG9\avgchsvx.exe 572 C:\Program Files\AVG\AVG9\avgrsx.exe 624 C:\Program Files\AVG\AVG9\avgcsrvx.exe 664 C:\Windows\System32\services.exe 676 C:\Windows\System32\lsass.exe 684 C:\Windows\System32\lsm.exe 748 C:\Windows\System32\winlogon.exe 860 C:\Windows\System32\svchost.exe 960 C:\Windows\System32\svchost.exe 1104 C:\Windows\System32\svchost.exe 1148 C:\Windows\System32\svchost.exe 1180 C:\Windows\System32\svchost.exe 1400 C:\Windows\System32\audiodg.exe 1524 C:\Windows\System32\svchost.exe 1548 C:\Windows\System32\SLsvc.exe 1592 C:\Windows\System32\svchost.exe 1808 C:\Windows\System32\svchost.exe 2004 C:\Windows\System32\dwm.exe 352 C:\Windows\explorer.exe 432 C:\Windows\System32\taskeng.exe 420 C:\Windows\System32\spoolsv.exe 12 C:\Windows\System32\svchost.exe 680 C:\Windows\System32\taskeng.exe 1924 C:\Program Files\Trend Micro\BM\TMBMSRV.exe 2072 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 2156 C:\Program Files\AVG\AVG9\avgwdsvc.exe 2192 C:\Program Files\Bonjour\mDNSResponder.exe 2408 C:\Program Files\Common Files\LightScribe\LSSrvc.exe 2488 C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE 2532 C:\Windows\System32\svchost.exe 2624 C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe 2688 C:\Program Files\Skype Wi-Fi\WENGINE\wmonitor.exe 2776 C:\Program Files\Apoint2K\Apoint.exe 2796 C:\Windows\System32\svchost.exe 2820 C:\Program Files\HP\QuickPlay\QPService.exe 2860 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe 2908 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe 2948 C:\Program Files\Trend Micro\Internet Security\TmProxy.exe 2956 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe 2988 C:\Program Files\Java\jre6\bin\jusched.exe 3024 C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe 3032 C:\Windows\System32\igfxtray.exe 3128 C:\Windows\System32\svchost.exe 3172 C:\Windows\System32\SearchIndexer.exe 3228 C:\Windows\System32\hkcmd.exe 3248 C:\Windows\System32\igfxpers.exe 3268 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe 3368 C:\Windows\System32\igfxsrvc.exe 3488 C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe 3520 C:\Windows\System32\drivers\XAudio.exe 3592 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe 4056 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe 2188 C:\Program Files\iTunes\iTunesHelper.exe 2292 C:\Program Files\HP\HP Software Update\hpwuschd2.exe 2432 C:\Program Files\AVG\AVG9\avgtray.exe 2896 C:\Program Files\Windows Sidebar\sidebar.exe 2784 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe 1616 C:\Windows\ehome\ehtray.exe 2172 C:\Program Files\Windows Media Player\wmpnscfg.exe 2728 WmiPrvSE.exe 3632 C:\Windows\System32\alg.exe 3048 C:\Program Files\Google\Chrome\Application\chrome.exe 3512 C:\Program Files\Windows Media Player\wmpnetwk.exe 4288 C:\Program Files\Apoint2K\ApMsgFwd.exe 4324 C:\Windows\ehome\ehmsas.exe 4740 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe 4776 C:\Windows\System32\wbem\unsecapp.exe 4832 C:\Program Files\Google\Chrome\Application\chrome.exe 4872 C:\Program Files\Apoint2K\ApntEx.exe 4892 C:\Program Files\Google\Chrome\Application\chrome.exe 5240 C:\Program Files\Internet Explorer\iexplore.exe 5632 C:\Program Files\iPod\bin\iPodService.exe 5712 C:\Windows\System32\SearchProtocolHost.exe 4264 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe 5140 C:\Program Files\Google\Chrome\Application\chrome.exe 5996 C:\Windows\System32\SearchProtocolHost.exe 3332 WmiPrvSE.exe 4524 C:\Windows\System32\SearchFilterHost.exe 5828 dllhost.exe 776 dllhost.exe 5328 C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6X990JP5\MBRCheck[1].exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000019`e26b9800 (NTFS) PhysicalDrive0 Model Number: HitachiHTS541612J9SA00, Rev: SBDOC7BP Size Device Name MBR Status ——————————————– 111 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!
Post #5
DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 18:00:49.93 on Sun 08/15/2010 Internet Explorer: 8.0.6001.18943 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.857 [GMT -5:00] AV: Trend Micro AntiVirus *On-access scanning enabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\AVG\AVG9\avgtray.exe C:\Program Files\Trend Micro\BM\TMBMSRV.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Skype Wi-Fi\WENGINE\wmonitor.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Trend Micro\Internet Security\TmProxy.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\alg.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\wbem\unsecapp.exe c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOWLPW6Q\dds[1].com C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://msn.com/ mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop uInternet Settings,ProxyOverride = *.local BHO: MRI_DISABLED - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [Sidebar] "c:\program files\windows sidebar\sidebar.exe" /autoRun uRun: [LightScribe Control Panel] "c:\program files\common files\lightscribe\LightScribeControlPanel.exe" -hidden uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [Skype] "c:\program files\skype\\phone\Skype.exe" /nosplash /minimized uRun: [RunSpySweeperScheduleAtStartup] "c:\windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{BD3DBAFC-593D-4BAD-962A-D1FAD5649AA1} uRun: [Desktop Software] "c:\program files\common files\supportsoft\bin\bcont.exe" /ini "c:\program files\comcastui\desktop software\uinstaller.ini" /fromrun /starthidden uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe" uRunOnce: [Shockwave Updater] "c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE" -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.1; .NET CLR 3.5.30729; .NET CLR 3.0.30618)" -"http://www.miniclip.com/games/slingshot/en/" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [Apoint] "c:\program files\apoint2k\Apoint.exe" mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe" mRun: [QlbCtrl] "c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe" /Start mRun: [hpWirelessAssistant] "c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe" mRun: [WAWifiMessage] "c:\program files\hewlett-packard\hp wireless assistant\WiFiMsg.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [UfSeAgnt.exe] "c:\program files\trend micro\internet security\UfSeAgnt.exe" mRun: [Boingo Wi-Fi] "c:\program files\boingo\boingo wi-fi\Boingo.lnk" mRun: [Performance Center] "c:\program files\ascentive\performance center\APCMain.exe" -m mRun: [PC SpeedScan Pro] "c:\program files\ascentive\pc speedscan pro\PCSpeedScan.exe" -m mRun: [HP Health Check Scheduler] "c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe" mRun: [AppleSyncNotifier] "c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe" mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\skypez~1.lnk - c:\windows\installer\{391b14a7-27b2-4113-a1b4-f5e12eade4d4}\Icon391B14A71.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mri_di~1\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mri_di~1\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: igfxcui - igfxdev.dll AppInit_DLLs: avgrsstx.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" ================= FIREFOX =================== FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\tx6ocx6u.default\ FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|http://www.comcast.net?cid=NET_mmhpset FF - component: c:\program files\automated content enhancer\4.1.0.5260\ff\components\ACEFFAddOn.dll FF - component: c:\program files\customized platform advancer\4.1.0.1850\ff\components\CPAFFAddOn.dll FF - component: c:\program files\web search operator\4.1.0.1990\ff\components\WSOFFAddOn.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-8-13 216400] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-8-13 29584] S3 BW2NDIS5;BW2NDIS5;c:\windows\system32\drivers\BW2NDIS5.SYS [2004-11-1 17536] =============== Created Last 30 ================ 2010-08-13 23:13:04 0 —ha-w- C:\ProgramData.LOG2 2010-08-13 23:13:04 0 —ha-w- C:\ProgramData.LOG1 2010-08-13 23:05:04 0 d—–w- c:\users\owner\appdata\roaming\Malwarebytes 2010-08-13 23:04:26 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-13 23:04:22 0 d—–w- c:\programdata\Malwarebytes 2010-08-13 23:04:20 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-08-13 23:04:12 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-08-13 19:23:21 0 d–h–w- C:\$AVG 2010-08-13 19:20:43 12536 —-a-w- c:\windows\system32\avgrsstx.dll 2010-08-13 19:20:43 0 d—–w- c:\windows\system32\drivers\Avg 2010-08-13 19:19:53 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-08-13 19:19:38 0 d—–w- c:\program files\AVG 2010-08-13 19:19:22 0 d—–w- c:\programdata\avg9 2010-08-11 00:52:26 274944 —-a-w- c:\windows\system32\schannel.dll 2010-08-11 00:52:11 2037760 —-a-w- c:\windows\system32\win32k.sys 2010-08-11 00:52:03 36864 —-a-w- c:\windows\system32\rtutils.dll 2010-08-11 00:51:55 3600768 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-08-11 00:51:54 3548040 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-08-11 00:48:26 1248768 —-a-w- c:\windows\system32\msxml3.dll 2010-08-11 00:48:19 302080 —-a-w- c:\windows\system32\drivers\srv.sys 2010-08-11 00:48:19 144896 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-08-11 00:48:11 905088 —-a-w- c:\windows\system32\drivers\tcpip.sys ==================== Find3M ==================== 2010-07-05 15:20:02 50256 —-a-w- c:\windows\system32\drivers\tmactmon.sys 2010-07-05 15:19:56 50256 —-a-w- c:\windows\system32\drivers\tmevtmgr.sys 2010-07-05 15:19:50 154192 —-a-w- c:\windows\system32\drivers\tmcomm.sys 2010-06-26 06:05:49 916480 —-a-w- c:\windows\system32\wininet.dll 2010-06-26 06:02:15 71680 —-a-w- c:\windows\system32\iesetup.dll 2010-06-26 06:02:15 109056 —-a-w- c:\windows\system32\iesysprep.dll 2010-06-26 04:25:02 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2010-05-27 20:08:17 81920 —-a-w- c:\windows\system32\iccvid.dll 2010-05-26 17:06:41 34304 —-a-w- c:\windows\system32\atmlib.dll 2010-05-26 14:47:41 289792 —-a-w- c:\windows\system32\atmfd.dll 2010-05-21 19:14:28 221568 ——w- c:\windows\system32\MpSigStub.exe 2010-04-01 02:39:44 51200 —-a-w- c:\windows\inf\infpub.dat 2010-04-01 02:39:44 143360 —-a-w- c:\windows\inf\infstrng.dat 2010-04-01 02:39:44 143360 —-a-w- c:\windows\inf\infstor.dat 2009-12-18 09:26:20 665600 —-a-w- c:\windows\inf\drvindex.dat 2008-11-07 05:23:46 174 –sha-w- c:\program files\desktop.ini 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2010-01-17 20:49:32 245760 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2009-12-19 00:47:44 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2007-11-03 00:59:59 22 –sha-w- c:\windows\sminst\HPCD.sys ============= FINISH: 18:04:58.72 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-03-17.01) Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 9/22/2007 5:10:52 PM System Uptime: 8/15/2010 2:28:09 PM (4 hours ago) Motherboard: Hewlett-Packard | | 30D9 Processor: Intel® Pentium® Dual CPU T2310 @ 1.46GHz | CPU | 800/533mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 104 GiB total, 45.073 GiB free. D: is FIXED (NTFS) - 8 GiB total, 1.867 GiB free. E: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft 6to4 Adapter Device ID: ROOT\*6TO4MP\0001 Manufacturer: Microsoft Name: Microsoft 6to4 Adapter #2 PNP Device ID: ROOT\*6TO4MP\0001 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0001 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter PNP Device ID: ROOT\*ISATAP\0001 Service: tunnel Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft ISATAP Adapter Device ID: ROOT\*ISATAP\0004 Manufacturer: Microsoft Name: Microsoft ISATAP Adapter #4 PNP Device ID: ROOT\*ISATAP\0004 Service: tunnel ==== System Restore Points =================== RP991: 8/1/2010 9:17:50 PM - Scheduled Checkpoint RP992: 8/3/2010 9:30:25 PM - Windows Update RP993: 8/4/2010 3:00:28 AM - Windows Update RP994: 8/4/2010 7:04:48 PM - Scheduled Checkpoint RP995: 8/5/2010 5:29:26 PM - Windows Update RP996: 8/5/2010 5:37:17 PM - Windows Backup RP997: 8/6/2010 11:49:00 PM - Scheduled Checkpoint RP998: 8/8/2010 7:42:51 PM - Scheduled Checkpoint RP999: 8/9/2010 6:41:32 PM - Windows Update RP1000: 8/10/2010 8:21:25 PM - Scheduled Checkpoint RP1001: 8/12/2010 8:25:22 PM - Windows Update RP1002: 8/13/2010 6:08:02 PM - Removed LimeWire Toolbar. RP1003: 8/13/2010 7:09:51 PM - Installed HiJackThis RP1004: 8/14/2010 2:13:13 PM - Removed Skype Zones RP1005: 8/15/2010 5:50:12 PM - Scheduled Checkpoint ==== Installed Programs ====================== Acrobat.com Activation Assistant for the 2007 Microsoft Office suites ActiveCheck component for HP Active Support Library Adobe AIR Adobe Flash Player 10 ActiveX Adobe Reader 8.1.5 Apple Application Support Apple Mobile Device Support Apple Software Update ArcSoft PhotoImpression 5 AVG Free 9.0 Boingo Wi-Fi Bonjour Conexant HD Audio EPSON CX 3800 Guide EPSON Printer Software EPSON Scan ESU for Microsoft Vista Gameztar Toolbar Google Chrome Google Earth Google Update Helper HDAUDIO Soft Data Fax Modem with SmartCP HiJackThis HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP Active Support Library HP Active Support Library 32 bit components HP Customer Experience Enhancements HP Doc Viewer HP DVD Play 3.2 HP Easy Setup - Frontend HP Help and Support HP Photosmart Essential 2.0 HP Photosmart Essential2.5 HP Quick Launch Buttons 6.20 G2 HP Update HP User Guides 0078 HP Wireless Assistant HPAsset component for HP Active Support Library HPNetworkAssistant Intel® Graphics Media Accelerator Driver iTunes Java™ 6 Update 16 Java™ 6 Update 3 Java™ 6 Update 5 Java™ 6 Update 7 Java™ SE Runtime Environment 6 KB408682 KODAK EASYSHARE Gallery Upload ActiveX Control LightScribe Applications LightScribe System Software 1.12.29.2 LightScribeTemplateLabeler Malwarebytes' Anti-Malware Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Works MobileMe Control Panel Mozilla Firefox (3.5.5) MSCU for Microsoft Vista MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) muvee autoProducer 6.0 NetWaiting PC SpeedScan Pro PSSWCORE QuickTime Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista Realtek USB 2.0 Card Reader Rhapsody Player Engine Roxio Activation Module Roxio Creator Audio Roxio Creator Basic v9 Roxio Creator Copy Roxio Creator Data Roxio Creator EasyArchive Roxio Creator Tools Roxio Express Labeler 3 Roxio MyDVD Basic v9 Safari Security Update for CAPICOM (KB931906) Skype Zones Skype™ 3.8 Touch Pad Driver Trend Micro AntiVirus Update for Microsoft .NET Framework 3.5 SP1 (KB963707) ==== Event Viewer Messages From Past Week ======== 8/9/2010 9:53:16 AM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period. 8/9/2010 10:24:01 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 001A73A546E1 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 8/15/2010 2:29:50 PM, Error: Microsoft-Windows-SharedAccess_NAT [31004] - The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error. 8/15/2010 2:28:45 PM, Error: EventLog [6008] - The previous system shutdown at 2:26:16 PM on 8/15/2010 was unexpected. 8/15/2010 2:14:24 PM, Error: EventLog [6008] - The previous system shutdown at 2:12:14 PM on 8/15/2010 was unexpected. 8/15/2010 10:16:32 AM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{C1671A0D-48B3-4FCA-82D5-844326C639E0} because another computer on the network has the same name. The server could not start. 8/15/2010 10:16:32 AM, Error: netbt [4321] - The name "OWNER-PC :20" could not be registered on the interface with IP address 192.168.1.69. The computer with the IP address 192.168.1.68 did not allow the name to be claimed by this computer. 8/15/2010 10:16:32 AM, Error: netbt [4321] - The name "OWNER-PC :0" could not be registered on the interface with IP address 192.168.1.69. The computer with the IP address 192.168.1.68 did not allow the name to be claimed by this computer. 8/15/2010 10:16:22 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service. 8/15/2010 1:59:35 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.69 for the Network Card with network address 001A73A546E1 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message). 8/14/2010 4:10:13 PM, Error: EventLog [6008] - The previous system shutdown at 4:07:53 PM on 8/14/2010 was unexpected. 8/14/2010 2:09:27 PM, Error: EventLog [6008] - The previous system shutdown at 2:06:21 PM on 8/14/2010 was unexpected. 8/13/2010 6:42:16 PM, Error: PlugPlayManager [11] - The device Root\LEGACY_SSIDRV\0000 disappeared from the system without first being prepared for removal. 8/13/2010 6:42:16 PM, Error: PlugPlayManager [11] - The device Root\LEGACY_SSHRMD\0000 disappeared from the system without first being prepared for removal. 8/13/2010 6:42:16 PM, Error: PlugPlayManager [11] - The device Root\LEGACY_SSFS0BB9\0000 disappeared from the system without first being prepared for removal. 8/13/2010 6:13:01 PM, Error: Service Control Manager [7034] - The Webroot Spy Sweeper Engine service terminated unexpectedly. It has done this 1 time(s). 8/13/2010 5:53:55 PM, Error: EventLog [6008] - The previous system shutdown at 5:52:34 PM on 8/13/2010 was unexpected. 8/13/2010 5:44:20 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.0.167 for the Network Card with network address 001A73A546E1 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 8/13/2010 5:39:43 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the DNS Client service to connect. 8/13/2010 5:39:43 PM, Error: Service Control Manager [7000] - The DNS Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 8/13/2010 2:29:21 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 8/13/2010 2:14:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046} 8/13/2010 2:08:52 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: spldr tmtdi Wanarpv6 8/13/2010 2:08:52 PM, Error: Service Control Manager [7001] - The Trend Micro Proxy Service service depends on the Trend Micro TDI Driver service which failed to start because of the following error: A device attached to the system is not functioning. 8/13/2010 2:08:52 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 8/13/2010 2:08:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MDM with arguments "" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064} 8/13/2010 2:08:40 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 8/13/2010 2:08:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 8/13/2010 2:08:35 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 8/13/2010 2:08:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 8/13/2010 2:08:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 8/13/2010 2:08:07 PM, Error: EventLog [6008] - The previous system shutdown at 10:27:48 PM on 8/12/2010 was unexpected. 8/12/2010 9:32:58 PM, Error: EventLog [6008] - The previous system shutdown at 9:31:17 PM on 8/12/2010 was unexpected. 8/12/2010 9:22:37 PM, Error: Microsoft-Windows-Dhcp-Client [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001A73A546E1. The following error occurred: The semaphore timeout period has expired.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. ==== End Of File ===========================

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI