What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow PC

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hello – I am working on my Dads girlfriends laptop and I have updated all drivers, fixed all spyware, fixed all registry issues, etc. and the PC is still slow. Please see HijackThis and advise on what is needed deleted as I know there are some, but just want to make sure and provide any other tools to utilize with my issues. Thanks so much for all and any assistance…



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:06:50 PM, on 9/5/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\WINDOWS\system32\lxeccoms.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Atheros WLAN Client\ACU.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toshibadirect.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros WLAN Client\ACU.exe" -nogui
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-21-2859619677-3002885496-3510284245-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-21-2859619677-3002885496-3510284245-500\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H (User 'Administrator')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (file missing)
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\ACS.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: FVKQBZQZHVV - Unknown owner - C:\DOCUME~1\Owner\LOCALS~1\Temp\FVKQBZQZHVV.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: lxecCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe
O23 - Service: lxec_device - - C:\WINDOWS\system32\lxeccoms.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: SOCTZSZF - Unknown owner - C:\DOCUME~1\Administrator\Local Settings\Temp\SOCTZSZF.exe (file missing)
O23 - Service: YPS - Unknown owner - C:\DOCUME~1\Owner\LOCALS~1\Temp\YPS.exe (file missing)

–
End of file - 8186 bytes
Post #2
Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

  • Absence of symptoms does not always mean the computer is clean
  • Please do not run any scans or fixes without my direction.
  • Finally, stay with this topic until I give you the final 'All clear' post.


1) MBRCheck
Please download MBRCheck.exe to your desktop.

  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.

2) DDS
Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

3) GMER
Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.

  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


4) What You Will Need To Post:
  • MBRCheck log
  • DDS logs
  • GMER log
Post #3
Hi Raktor,

Thanks for the fast reply; please see attached info as requested.

Also, I forgot to mention that I am also having issues with her wireless connection; it will allow me to login to my wireless router, but it cannot find the acquire network address, not allowing me to connect to the Internet.

Also, when trying to change the Power options within Display Options under Screen Saver, it states that I need to use Toshiba Power Mangement, but I could not find this program.



MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 133):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF8B03000 \WINDOWS\system32\KDCOM.DLL
0xF8A13000 \WINDOWS\system32\BOOTVID.dll
0xF85B4000 ACPI.sys
0xF8B05000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF85A3000 pci.sys
0xF8603000 isapnp.sys
0xF8A17000 compbatt.sys
0xF8A1B000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF8BCB000 pciide.sys
0xF8883000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF8B07000 intelide.sys
0xF8633000 MountMgr.sys
0xF8566000 ftdisk.sys
0xF8A1F000 ACPIEC.sys
0xF8BCC000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF888B000 PartMgr.sys
0xF8643000 VolSnap.sys
0xF854E000 atapi.sys
0xF8653000 disk.sys
0xF8663000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF852E000 fltmgr.sys
0xF851C000 sr.sys
0xF8505000 KSecDD.sys
0xF8478000 Ntfs.sys
0xF844B000 NDIS.sys
0xF8431000 Mup.sys
0xF8673000 avgrkx86.sys
0xF8683000 agp440.sys
0xF87A3000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF8B2B000 \SystemRoot\System32\Drivers\hkdrv.sys
0xF79EF000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xF79DB000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF88B3000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF79B7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF88BB000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF8AEB000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF87C3000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF88C3000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF88CB000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF87D3000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7779000 \SystemRoot\system32\drivers\ks.sys
0xF75E2000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0xF88D3000 \SystemRoot\System32\Drivers\Modem.SYS
0xF8B2F000 \SystemRoot\system32\DRIVERS\serscan.sys
0xF8CEA000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF88DB000 \SystemRoot\system32\DRIVERS\rasirda.sys
0xF88E3000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF87F3000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF8AFB000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF75CB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF8803000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF8813000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF88EB000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF88F3000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF8823000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF8B31000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF73A8000 \SystemRoot\system32\DRIVERS\update.sys
0xF8AFF000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7EFB000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7E8B000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF8B47000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF8B4F000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8D4A000 \SystemRoot\System32\Drivers\Null.SYS
0xF8B51000 \SystemRoot\System32\Drivers\Beep.SYS
0xF894B000 \SystemRoot\System32\drivers\vga.sys
0xF8B53000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8B55000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF8953000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF895B000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF8ABB000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEE76A000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF7C19000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xEE711000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEE6D7000 \SystemRoot\System32\Drivers\avgtdix.sys
0xEE6B1000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF7C09000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF7BF9000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xEE661000 \SystemRoot\system32\DRIVERS\netbt.sys
0xEE63F000 \SystemRoot\System32\drivers\afd.sys
0xF7BE9000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF8963000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xF8B59000 \SystemRoot\System32\Drivers\SSIoMngr.sys
0xF8B5B000 \SystemRoot\System32\Drivers\EPIoMngr.sys
0xF8B5D000 \SystemRoot\System32\Drivers\ECioctl.sys
0xF8B5F000 \SystemRoot\System32\Drivers\EKIoMngr.sys
0xEE614000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEE5A4000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF8843000 \SystemRoot\System32\Drivers\Fips.SYS
0xF8973000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xEE4D0000 \SystemRoot\System32\Drivers\avgldx86.sys
0xF897B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xEB910000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF8AB7000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8983000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8C61000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF021000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF043000 \SystemRoot\System32\ialmdev5.DLL
0xBF07C000 \SystemRoot\System32\ialmdd5.DLL
0xED53E000 \??\C:\WINDOWS\system32\drivers\mbam.sys
0xEB882000 \SystemRoot\system32\DRIVERS\irda.sys
0xEE414000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xEBA5E000 \SystemRoot\system32\drivers\wdmaud.sys
0xF8793000 \SystemRoot\system32\drivers\sysaudio.sys
0xED383000 \SystemRoot\system32\DRIVERS\srv.sys
0xED22B000 \??\C:\WINDOWS\system32\drivers\tmcomm.sys
0xEBA1D000 \SystemRoot\System32\Drivers\HTTP.sys
0xED6F3000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
0xEC7FC000 \SystemRoot\system32\drivers\ALCXWDM.SYS
0xEC7D8000 \SystemRoot\system32\drivers\portcls.sys
0xED1D3000 \SystemRoot\system32\drivers\drmk.sys
0xED193000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0xECF5F000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0xEC74F000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0xEC5EB000 \SystemRoot\system32\DRIVERS\pcmcia.sys
0xECF2F000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xECEFF000 \SystemRoot\system32\DRIVERS\wsimd.sys
0xF8CC8000 \SystemRoot\System32\Drivers\LBeepKE.sys
0xEBF1D000 \SystemRoot\system32\DRIVERS\athw.sys
0xEB934000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
0xEC19B000 \SystemRoot\System32\Drivers\WDFLDR.SYS
0xEBC98000 \SystemRoot\System32\Drivers\wdf01000.sys
0xECEA3000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF8743000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xEB97C000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0xF7E38000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xEB93C000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0xEBD09000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 44):
0 System Idle Process
4 System
448 C:\WINDOWS\system32\smss.exe
500 csrss.exe
524 C:\WINDOWS\system32\winlogon.exe
568 C:\WINDOWS\system32\services.exe
580 C:\WINDOWS\system32\lsass.exe
752 C:\WINDOWS\system32\svchost.exe
816 svchost.exe
908 C:\WINDOWS\system32\svchost.exe
1020 C:\Program Files\AVG\AVG9\avgchsvx.exe
1028 C:\Program Files\AVG\AVG9\avgrsx.exe
1280 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1504 C:\WINDOWS\system32\spoolsv.exe
1640 C:\WINDOWS\explorer.exe
1984 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
2020 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
144 C:\PROGRA~1\AVG\AVG9\avgtray.exe
212 C:\WINDOWS\system32\hkcmd.exe
284 C:\WINDOWS\system32\igfxpers.exe
296 C:\WINDOWS\system32\ctfmon.exe
316 C:\Program Files\Registry Mechanic\RegMech.exe
360 C:\Program Files\AVG\AVG9\avgwdsvc.exe
980 C:\Program Files\Java\jre6\bin\jqs.exe
1488 C:\Program Files\AVG\AVG9\avgam.exe
1592 C:\WINDOWS\system32\lxeccoms.exe
1636 C:\Program Files\AVG\AVG9\avgnsx.exe
1680 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
1828 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
1000 C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
1972 C:\WINDOWS\system32\svchost.exe
2920 svchost.exe
3164 alg.exe
3372 C:\Program Files\AVG\AVG9\avgcsrvx.exe
2276 C:\Program Files\Atheros WLAN Client\ACU.exe
3252 C:\WINDOWS\system32\WISPTIS.EXE
2420 C:\Program Files\Internet Explorer\iexplore.exe
3452 C:\WINDOWS\explorer.exe
3172 C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
2712 C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
388 C:\Program Files\Internet Explorer\iexplore.exe
332 C:\Program Files\AVG\AVG9\avgui.exe
3896 C:\WINDOWS\system32\wscntfy.exe
2304 C:\Documents and Settings\Owner\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: IC25N060ATMR04-0, Rev: MO3OAD4A

Size Device Name MBR Status
——————————————–
55 GB \\.\PhysicalDrive0 Windows 98 MBR code detected
SHA1: 48F01D7E76A0F3C038D08611E3FDC0EE4EF9FD3E


Done!





DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 20:08:00.25 on Sun 09/05/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.141 [GMT -4:00]

AV: AVG Internet Security SBS Edition *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\WINDOWS\system32\lxeccoms.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Atheros WLAN Client\ACU.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AVG\AVG9\avgui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Owner\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://my.yahoo.com/
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://toshibadirect.com/
uInternet Settings,ProxyOverride = *.local;localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - No File
BHO: Lexmark Printable Web: {d2c5e510-be6d-42cc-9f61-e4f939078474} - c:\program files\lexmark printable web\bho.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - No File
TB: {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No File
TB: {D3360B9E-9AAF-49E5-BD48-E793E415A208} - No File
TB: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [ACU] "c:\program files\atheros wlan client\ACU.exe" -nogui
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll
Trusted Zone: adobe.com\www
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-9-4 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-9-4 216400]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-9-4 29584]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-9-4 243024]
R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-9-4 308136]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2010-9-5 10448]
R2 lxec_device;lxec_device;c:\windows\system32\lxeccoms.exe -service –> c:\windows\system32\lxeccoms.exe -service [?]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-9-3 304464]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2010-9-3 583640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-9-3 20952]
S2 aawservice;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" –> c:\program files\lavasoft\ad-aware\aawservice.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 lxecCATSCustConnectService;lxecCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxecserv.exe [2010-7-6 98984]
S2 mrtRate;mrtRate; [x]
S3 FVKQBZQZHVV;FVKQBZQZHVV;c:\docume~1\owner\locals~1\temp\fvkqbzqzhvv.exe –> c:\docume~1\owner\locals~1\temp\FVKQBZQZHVV.exe [?]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2010-9-3 27064]
S3 SOCTZSZF;SOCTZSZF;c:\docume~1\administrator\local settings\temp\soctzszf.exe –> c:\docume~1\administrator\local settings\temp\SOCTZSZF.exe [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-19 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18

753504]
S3 YPS;YPS;c:\docume~1\owner\locals~1\temp\yps.exe –> c:\docume~1\owner\locals~1\temp\YPS.exe [?]

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2010-09-05 17:04:00 0 dc—-w- c:\program files\HDD Regenerator
2010-09-05 15:49:44 0 dc—-w- c:\program files\CodeStuff
2010-09-05 15:18:15 10448 -c–a-w- c:\windows\system32\drivers\LBeepKE.sys
2010-09-05 14:57:06 16400 -c–a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-09-05 14:57:06 0 -c-ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-09-05 14:56:47 16928 -c—-w- c:\windows\system32\spmsgXP_2k3.dll
2010-09-05 14:33:45 0 dc—-w- c:\docume~1\owner\applic~1\Logishrd
2010-09-05 14:23:05 40960 -c–a-w- c:\windows\system32\RemoveWLAN.exe
2010-09-05 14:22:05 0 dc—-w- c:\program files\Atheros WLAN Client
2010-09-05 14:17:01 0 dc—-w- c:\docume~1\alluse~1\applic~1\WLAN
2010-09-05 14:14:12 577536 -c–a-w- c:\windows\soundman.exe
2010-09-05 14:14:12 49152 -c–a-w- c:\windows\system32\ChCfg.exe
2010-09-05 14:14:02 141016 -c–a-w- c:\windows\system32\alsndmgr.wav
2010-09-05 14:14:02 10528768 -c–a-w- c:\windows\system32\RTLCPL.exe
2010-09-05 14:13:51 18804736 -c–a-w- c:\windows\system32\alsndmgr.cpl
2010-09-05 14:12:12 0 dc—-w- c:\program files\Realtek AC97
2010-09-05 14:09:17 53248 -c–a-w- c:\windows\system32\CSVer.dll
2010-09-05 14:07:25 0 dc—-w- C:\Intel
2010-09-05 13:12:44 135168 -c–a-w- c:\windows\system32\igfxres.dll
2010-09-05 12:34:31 0 dc—-w- c:\program files\Driver-Soft
2010-09-05 11:32:03 0 dc—-w- c:\docume~1\owner\applic~1\AVG9
2010-09-05 10:12:00 0 dc-h–w- C:\$AVG
2010-09-05 00:56:21 12536 -c–a-w- c:\windows\system32\avgrsstx.dll
2010-09-05 00:33:35 52872 -c–a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-09-05 00:33:34 243024 -c–a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-05 00:33:34 216400 -c–a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-05 00:33:33 0 dc—-w- c:\windows\system32\drivers\Avg
2010-09-05 00:33:01 0 dc—-w- c:\docume~1\alluse~1\applic~1\avg9
2010-09-04 02:17:14 0 dc—-w- c:\docume~1\owner\applic~1\WinPatrol
2010-09-04 01:28:41 27064 -c–a-w- c:\windows\system32\drivers\revoflt.sys
2010-09-04 01:28:38 0 dc—-w- c:\program files\VS Revo Group
2010-09-04 01:11:21 880640 -c–a-w- c:\windows\system32\UniBox10.ocx
2010-09-04 01:11:21 212992 -c–a-w- c:\windows\system32\UniBoxVB12.ocx
2010-09-04 01:11:21 1101824 -c–a-w- c:\windows\system32\UniBox210.ocx
2010-09-04 01:11:19 0 dc—-w- c:\program files\common files\PC Tools
2010-09-04 00:05:29 0 dc—-w- c:\program files\BillP Studios
2010-09-03 23:55:21 0 dc—-w- c:\program files\SpywareBlaster
2010-09-03 23:50:19 0 dc—-w- c:\program files\IZArc
2010-09-03 23:45:40 0 dc—-w- c:\program files\Defraggler
2010-09-03 23:44:13 0 dc—-w- c:\program files\CCleaner
2010-09-03 22:23:10 0 dc—-w- c:\docume~1\owner\applic~1\Malwarebytes
2010-09-03 20:08:39 38224 -c–a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-03 20:08:09 0 dc—-w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-09-03 20:04:07 20952 -c–a-w- c:\windows\system32\drivers\mbam.sys
2010-09-03 20:03:40 0 dc—-w- c:\program files\Malwarebytes' Anti-Malware
2010-08-29 17:25:41 0 dc—-w- c:\program files\AVG
2010-08-29 15:50:15 0 dc—-w- C:\downloads
2010-08-14 16:12:09 0 dc—-w- c:\windows\system32\wbem\Repository
2010-08-12 23:13:47 0 dc—-w- C:\7d3468a68038a05a6b0b8aca9841
2010-08-11 23:33:21 0 -c–a-w- C:\install.rdf
2010-08-09 15:10:31 73728 -c–a-w- c:\windows\system32\javacpl.cpl

==================== Find3M ====================

2010-07-17 09:00:04 423656 -c–a-w- c:\windows\system32\deployJava1.dll
2010-06-30 12:31:35 149504 -c–a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22:03 916480 -c–a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44:04 1851904 -c–a-w- c:\windows\system32\win32k.sys
2010-06-17 14:03:00 80384 -c–a-w- c:\windows\system32\iccvid.dll
2010-06-14 07:41:45 1172480 -c–a-w- c:\windows\system32\msxml3.dll
2009-04-15 14:57:58 16384 -csha-w- c:\windows\system32\config\systemprofile\cookies\index.dat
2009-04-12 14:24:48 16384 -csha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat
2009-04-15 14:57:58 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2008-06-22 00:33:07 32768 -csha-w- c:\windows\system32\config\systemprofile\local

settings\history\history.ie5\mshist012008062120080622\index.dat
2009-04-15 14:57:58 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 20:09:01.59 ===============






UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 6/3/2005 11:28:50 AM
System Uptime: 9/5/2010 9:11:27 AM (11 hours ago)

Motherboard: TOSHIBA | | EAL20
Processor: Intel® Celeron® M processor 1.40GHz | BAN |

1398/mhz
==== Disk Partitions =========================

C: is FIXED (NTFS) - 56 GiB total, 46.281 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP758: 9/4/2010 8:09:55 AM - Installed AVG Free 9.0
RP759: 9/4/2010 8:55:32 AM - Revo Uninstaller Pro's restore point -

Adobe AIR
RP760: 9/4/2010 8:33:00 PM - Installed AVG 9.0
RP761: 9/4/2010 8:42:00 PM - Avg8 Update
RP762: 9/4/2010 8:56:50 PM - Avg Update
RP763: 9/5/2010 3:00:23 AM - Software Distribution Service 3.0
RP764: 9/5/2010 8:26:40 AM - Installed Realtek AC'97 Audio
RP765: 9/5/2010 10:11:58 AM - Installed Realtek AC'97 Audio
RP766: 9/5/2010 10:21:57 AM - Installed Atheros WLAN Client

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Shockwave Player 11.5
Atheros Client Utility
Atheros Wireless LAN MiniPCI card Driver
Atheros WLAN Client
AVG 9.0
CCleaner
CCScore
CodeStuff Starter
Critical Update for Windows Media Player 11 (KB959772)
Defraggler
Driver Genius Professional Edition
eReg
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
fflink
HDD Regenerator
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB945060-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel® Extreme Graphics 2 Driver
IZArc 4.1.2
Java Auto Updater
Java™ 6 Update 21
kgcbaby
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
Kodak EasyShare software
Lexmark Printable Web
Lexmark Pro800-Pro900 Series
Logitech SetPoint 6.15
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSXML 4.0 SP2 (KB973688)
netbrdg
OfotoXMI
Princess Countdown Connection™
QuickTime
Realtek AC'97 Audio
Realtek Fast Ethernet Adapter Driver
Registry Mechanic 9.0
Revo Uninstaller Pro 2.2.3
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
SFR
SHASTA
skin0001
SKINXSDK
Spybot - Search & Destroy
SpywareBlaster 4.4
SRS WOW XT Plug-In for Windows Media Player for Toshiba version 1.0.2
staticcr
TOSHIBA Hotkey Utility
TOSHIBA Power Management
TOSHIBA Zooming Hotkey Hook
TouchPad On/Off Utility
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows Internet Explorer 8 (KB982664)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VPRINTOL
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinPatrol
WIRELESS
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

9/5/2010 12:32:58 AM, error: sr [1] - The System Restore filter

encountered the unexpected error '0xC0000243' while processing the file

'avgupd.exe.old' on the volume 'HarddiskVolume1'. It has stopped

monitoring the volume.
9/4/2010 7:01:01 AM, error: Service Control Manager [7009] - Timeout

(30000 milliseconds) waiting for the YPS service to connect.
9/4/2010 7:01:01 AM, error: Service Control Manager [7000] - The YPS

service failed to start due to the following error: The service did

not respond to the start or control request in a timely fashion.
9/4/2010 7:00:27 AM, error: Service Control Manager [7009] - Timeout

(30000 milliseconds) waiting for the FVKQBZQZHVV service to connect.
9/4/2010 7:00:27 AM, error: Service Control Manager [7000] - The

FVKQBZQZHVV service failed to start due to the following error: The

service did not respond to the start or control request in a timely

fashion.
9/3/2010 8:41:26 PM, error: DCOM [10005] - DCOM got error "%1084"

attempting to start the service wuauserv with arguments "" in order to

run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
9/3/2010 8:16:59 PM, error: DCOM [10005] - DCOM got error "%1084"

attempting to start the service StiSvc with arguments "" in order to

run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
9/3/2010 7:28:20 PM, error: Service Control Manager [7026] - The

following boot-start or system-start driver(s) failed to load:

AvgLdx86 AvgMfx86 Fips intelppm SrvcEKIOMngr SrvcEPECioctl SrvcEPIOMngr

SrvcSSIOMngr ssmdrv
9/3/2010 7:27:21 PM, error: DCOM [10005] - DCOM got error "%1084"

attempting to start the service EventSystem with arguments "" in order

to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/3/2010 11:12:21 PM, error: Windows Update Agent [20] - Installation

Failure: Windows failed to install the following update with error

0x80070643: Update for Microsoft Silverlight (KB982926).
9/3/2010 11:12:21 PM, error: Windows Update Agent [20] - Installation

Failure: Windows failed to install the following update with error

0x80070643: Security Update for Microsoft Silverlight (KB978464).
9/3/2010 10:48:06 PM, error: Service Control Manager [7034] - The

ArcSoft Connect Daemon service terminated unexpectedly. It has done

this 1 time(s).
9/3/2010 10:17:52 PM, error: Service Control Manager [7009] - Timeout

(30000 milliseconds) waiting for the lxecCATSCustConnectService service

to connect.
9/3/2010 10:17:52 PM, error: Service Control Manager [7000] - The

TBiosDrv service failed to start due to the following error: The

system cannot find the file specified.
9/3/2010 10:17:52 PM, error: Service Control Manager [7000] - The

mrtRate service failed to start due to the following error: The system

cannot find the file specified.
9/3/2010 10:17:52 PM, error: Service Control Manager [7000] - The

lxecCATSCustConnectService service failed to start due to the following

error: The service did not respond to the start or control request in

a timely fashion.

==== End Of File ===========================




GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-05 20:24:02
Windows 5.1.2600 Service Pack 3
Running: ovqnfg8f.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pwriyfob.sys

—- System - GMER 1.0.15 —-

INT 0x83 ? FE34D044
INT 0x84 ? FC698DD4

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD135 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254666 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E4B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E49D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[388] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4EF0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215501 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E4B6F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4AA1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4B0C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4972 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E49D4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E4BD2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2420] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4A36 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs EE371400

—- EOF - GMER 1.0.15 —-
Post #4
Download Combofix to your desktop from any of the links below.

Link 1
Link 2

==================================

Double click on ComboFix.exe & follow the prompts. Ensure that you accept the Recovery Console install.

  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.
Post #5
See ComboFix log:


ComboFix 10-09-04.06 - Owner 09/05/2010 20:40:57.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.220 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Internet Security SBS Edition *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll
c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
c:\program files\QuickTime\Plugins\npqtplugin2.dll
c:\program files\QuickTime\Plugins\npqtplugin3.dll
c:\program files\QuickTime\Plugins\npqtplugin4.dll
c:\program files\QuickTime\Plugins\npqtplugin5.dll
c:\program files\QuickTime\Plugins\npqtplugin6.dll
c:\program files\QuickTime\Plugins\npqtplugin7.dll

.
((((((((((((((((((((((((( Files Created from 2010-08-06 to 2010-09-06 )))))))))))))))))))))))))))))))
.

2010-09-05 22:14 . 2010-09-05 22:14 ——– dc—-w- c:\program files\Microsoft Silverlight
2010-09-05 17:04 . 2010-09-05 17:51 ——– dc—-w- c:\program files\HDD Regenerator
2010-09-05 17:03 . 2010-09-05 17:03 ——– dc—-w- c:\documents and settings\Owner\Local Settings\Application Data\Downloaded Installations
2010-09-05 15:49 . 2010-09-05 15:49 ——– dc—-w- c:\program files\CodeStuff
2010-09-05 15:20 . 2010-09-05 15:20 53248 -c–a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-09-05 15:18 . 2010-03-18 09:01 10448 -c–a-w- c:\windows\system32\drivers\LBeepKE.sys
2010-09-05 15:17 . 2010-09-05 15:17 ——– dc—-w- c:\program files\Logitech
2010-09-05 15:12 . 2010-09-05 15:12 ——– dc—-w- c:\documents and settings\Owner\Application Data\Leadertech
2010-09-05 14:57 . 2010-09-05 15:18 16400 -c–a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-09-05 14:56 . 2008-11-07 22:55 16928 -c—-w- c:\windows\system32\spmsgXP_2k3.dll
2010-09-05 14:35 . 2010-09-05 15:19 ——– dc—-w- c:\documents and settings\All Users\Application Data\Logishrd
2010-09-05 14:34 . 2010-09-05 15:19 ——– dc—-w- c:\program files\Common Files\LogiShrd
2010-09-05 14:33 . 2010-09-05 15:20 ——– dc—-w- c:\documents and settings\Owner\Application Data\Logitech
2010-09-05 14:33 . 2010-09-05 14:34 ——– dc—-w- c:\documents and settings\Owner\Application Data\Logishrd
2010-09-05 14:23 . 2007-05-10 08:01 40960 -c–a-w- c:\windows\system32\RemoveWLAN.exe
2010-09-05 14:17 . 2010-09-05 14:17 ——– dc—-w- c:\documents and settings\All Users\Application Data\WLAN
2010-09-05 14:14 . 2007-04-16 19:28 577536 -c–a-w- c:\windows\soundman.exe
2010-09-05 14:14 . 2006-08-01 19:02 49152 -c–a-w- c:\windows\system32\ChCfg.exe
2010-09-05 14:14 . 2006-12-08 19:20 10528768 -c–a-w- c:\windows\system32\RTLCPL.exe
2010-09-05 14:13 . 2010-09-05 15:19 ——– dc—-w- c:\windows\LastGood
2010-09-05 14:12 . 2010-09-05 14:12 ——– dc—-w- c:\program files\Realtek AC97
2010-09-05 14:09 . 2010-09-05 14:09 ——– dc—-w- c:\program files\Intel
2010-09-05 14:09 . 2010-03-02 20:04 53248 -c–a-w- c:\windows\system32\CSVer.dll
2010-09-05 14:07 . 2010-09-05 14:07 ——– dc—-w- C:\Intel
2010-09-05 13:12 . 2006-02-07 12:35 135168 -c–a-w- c:\windows\system32\igfxres.dll
2010-09-05 12:34 . 2010-09-05 12:34 ——– dc—-w- c:\program files\Driver-Soft
2010-09-05 11:32 . 2010-09-05 11:32 ——– dc—-w- c:\documents and settings\Owner\Application Data\AVG9
2010-09-05 10:12 . 2010-09-05 10:12 ——– dc—-w- C:\$AVG
2010-09-05 00:56 . 2010-09-05 00:56 12536 -c–a-w- c:\windows\system32\avgrsstx.dll
2010-09-05 00:33 . 2010-09-05 00:55 52872 -c–a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-09-05 00:33 . 2010-09-05 00:56 243024 -c–a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-05 00:33 . 2010-09-05 00:55 216400 -c–a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-05 00:33 . 2010-09-05 23:13 ——– dc—-w- c:\windows\system32\drivers\Avg
2010-09-05 00:33 . 2010-09-05 00:56 29584 -c–a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-05 00:33 . 2010-09-05 00:33 ——– dc—-w- c:\documents and settings\All Users\Application Data\avg9
2010-09-04 10:48 . 2010-09-04 10:48 388096 -c–a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-04 02:59 . 2010-09-04 02:59 ——– dc—-w- c:\documents and settings\Owner\Local Settings\Application Data\VS Revo Group
2010-09-04 02:17 . 2010-09-04 12:17 ——– dc—-w- c:\documents and settings\Owner\Application Data\WinPatrol
2010-09-04 01:29 . 2010-09-04 01:29 ——– dc—-w- c:\documents and settings\Administrator\Local Settings\Application Data\VS Revo Group
2010-09-04 01:28 . 2009-12-30 16:20 27064 -c–a-w- c:\windows\system32\drivers\revoflt.sys
2010-09-04 01:28 . 2010-09-04 01:28 ——– dc—-w- c:\program files\VS Revo Group
2010-09-04 01:20 . 2010-09-04 01:20 ——– dc—-w- c:\documents and settings\Administrator\Application Data\Registry Mechanic
2010-09-04 01:11 . 2010-09-04 01:11 ——– dc—-w- c:\program files\Common Files\PC Tools
2010-09-04 00:06 . 2010-09-04 00:06 ——– dcsh–w- c:\documents and settings\Administrator\IECompatCache
2010-09-04 00:05 . 2010-09-04 00:05 ——– dc—-w- c:\documents and settings\Administrator\Application Data\WinPatrol
2010-09-04 00:05 . 2010-09-04 00:05 ——– dc—-w- c:\program files\BillP Studios
2010-09-03 23:55 . 2010-09-03 23:55 ——– dc—-w- c:\program files\SpywareBlaster
2010-09-03 23:50 . 2010-09-03 23:51 ——– dc—-w- c:\documents and settings\Administrator\Local Settings\Application Data\OpenCandy
2010-09-03 23:50 . 2010-09-03 23:52 ——– dc—-w- c:\program files\IZArc
2010-09-03 23:45 . 2010-09-03 23:45 ——– dc—-w- c:\program files\Defraggler
2010-09-03 23:44 . 2010-09-03 23:44 ——– dc—-w- c:\program files\CCleaner
2010-09-03 23:27 . 2010-09-03 23:27 ——– dc—-w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-09-03 22:23 . 2010-09-03 22:23 ——– dc—-w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-09-03 20:08 . 2010-04-29 19:39 38224 -c–a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-03 20:08 . 2010-09-03 20:08 ——– dc—-w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-03 20:04 . 2010-04-29 19:39 20952 -c–a-w- c:\windows\system32\drivers\mbam.sys
2010-09-03 20:03 . 2010-09-03 22:23 ——– dc—-w- c:\program files\Malwarebytes' Anti-Malware
2010-08-29 17:25 . 2010-09-05 00:33 ——– dc—-w- c:\program files\AVG
2010-08-29 15:50 . 2010-09-04 12:46 ——– dc—-w- C:\downloads
2010-08-29 15:33 . 2010-08-29 15:33 ——– dcsh–w- c:\documents and settings\Administrator\PrivacIE
2010-08-14 16:12 . 2010-08-14 16:12 ——– dc—-w- c:\windows\system32\wbem\Repository
2010-08-14 16:11 . 2010-09-04 12:56 ——– dc—-w- c:\program files\Common Files\Adobe AIR
2010-08-14 16:11 . 2010-08-14 16:11 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-08-12 23:13 . 2010-08-12 23:14 ——– dc—-w- C:\7d3468a68038a05a6b0b8aca9841
2010-08-10 18:37 . 2010-08-10 18:37 ——– dc—-w- c:\documents and settings\Owner\Application Data\Apple Computer
2010-08-09 15:12 . 2010-08-09 15:12 ——– dc—-w- c:\program files\Common Files\Java

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-05 22:43 . 2008-06-21 04:27 ——– dc–a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-05 21:03 . 2008-06-21 12:28 ——– dc—-w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-09-05 14:57 . 2010-09-05 14:57 0 -c-ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-09-05 14:23 . 2010-09-05 14:22 ——– dc—-w- c:\program files\Atheros WLAN Client
2010-09-05 14:21 . 2004-08-19 23:00 ——– dc-h–w- c:\program files\InstallShield Installation Information
2010-09-05 12:24 . 2004-08-19 23:00 ——– dc—-w- c:\program files\Common Files\InstallShield
2010-09-04 00:15 . 2009-09-11 17:48 ——– dc—-w- c:\program files\Spybot - Search & Destroy
2010-09-03 21:30 . 2010-02-13 21:54 ——– dc—-w- c:\program files\Google
2010-09-03 20:36 . 2010-06-01 15:30 ——– dc—-w- c:\program files\Microsoft
2010-09-03 20:26 . 2009-12-04 17:46 ——– dc—-w- c:\program files\Yahoo!
2010-09-03 20:26 . 2009-12-04 17:47 ——– dc—-w- c:\documents and settings\Owner\Application Data\Yahoo!
2010-09-03 20:26 . 2009-12-04 17:47 ——– dc—-w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-08-29 15:45 . 2009-04-13 02:10 ——– dc—-w- c:\program files\Foxit Software
2010-08-14 16:11 . 2004-08-19 23:22 ——– dc—-w- c:\program files\Atheros
2010-08-14 16:11 . 2010-05-31 18:12 ——– dc—-w- c:\program files\QuickTime
2010-08-09 15:09 . 2004-08-19 22:59 ——– dc—-w- c:\program files\Java
2010-08-06 21:47 . 2010-08-06 21:47 ——– dc—-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series
2010-08-03 00:40 . 2010-08-03 00:40 503808 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4eeb6d81-n\msvcp71.dll
2010-08-03 00:40 . 2010-08-03 00:40 499712 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4eeb6d81-n\jmc.dll
2010-08-03 00:40 . 2010-08-03 00:40 12800 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-28a60d14-n\decora-d3d.dll
2010-08-03 00:40 . 2010-08-03 00:40 348160 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4eeb6d81-n\msvcr71.dll
2010-08-03 00:40 . 2010-08-03 00:40 61440 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-28a60d14-n\decora-sse.dll
2010-07-17 09:00 . 2010-06-01 15:27 423656 -c–a-w- c:\windows\system32\deployJava1.dll
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4446W01.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw44432W2.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4444301.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4444201.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4444101.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4443301.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4443201.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4443101.bat
2010-06-30 15:49 . 2006-11-09 22:35 65400 -c–a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2004-08-19 21:49 149504 -c–a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2004-08-19 21:49 916480 -c–a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-19 21:49 1851904 -c–a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-19 21:49 354304 -c–a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-19 21:48 80384 -c–a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2004-08-19 22:28 744448 -c–a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-19 21:48 1172480 -c–a-w- c:\windows\system32\msxml3.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2009-10-14 3217368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-05-31 323976]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-09-05 2065760]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"ACU"="c:\program files\Atheros WLAN Client\ACU.exe" [2009-05-12 479320]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-09-05 00:56 12536 -c–a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 -c–a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pinger
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2004-02-20 22:00 88363 -c–a-w- c:\windows\agrsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2004-06-11 04:10 339968 -c–a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CeEKEY]
2004-08-06 22:14 643072 -c–a-w- c:\program files\Toshiba\E-KEY\CeEKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CeEPOWER]
2004-08-20 01:14 135168 -c–a-w- c:\program files\Toshiba\Power Management\CePMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2006-02-07 12:39 94208 -c–a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 -csh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PadTouch]
2004-02-03 21:47 1089589 -c–a-w- c:\program files\Toshiba\Touch and Launch\PadExe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 -c–a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2004-03-02 20:45 135168 -c–a-w- c:\program files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPNF]
2004-07-28 23:23 53248 -c–a-w- c:\program files\Toshiba\TouchPad\TPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoomingHook]
2004-07-14 23:07 24576 -c–a-w- c:\windows\system32\ZoomingHook.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\lxeccoms.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [9/4/2010 8:33 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/4/2010 8:33 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/4/2010 8:33 PM 243024]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [9/4/2010 8:56 PM 308136]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [9/5/2010 11:18 AM 10448]
R2 lxec_device;lxec_device;c:\windows\system32\lxeccoms.exe -service –> c:\windows\system32\lxeccoms.exe -service [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/3/2010 4:09 PM 304464]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [9/3/2010 9:11 PM 583640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/3/2010 4:04 PM 20952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 lxecCATSCustConnectService;lxecCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxecserv.exe [7/6/2010 3:15 PM 98984]
S2 mrtRate;mrtRate; [x]
S3 FVKQBZQZHVV;FVKQBZQZHVV;c:\docume~1\Owner\LOCALS~1\Temp\FVKQBZQZHVV.exe –> c:\docume~1\Owner\LOCALS~1\Temp\FVKQBZQZHVV.exe [?]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [9/3/2010 9:28 PM 27064]
S3 SOCTZSZF;SOCTZSZF;c:\docume~1\Administrator\Local Settings\Temp\SOCTZSZF.exe –> c:\docume~1\Administrator\Local Settings\Temp\SOCTZSZF.exe [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/19/2004 5:49 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S3 YPS;YPS;c:\docume~1\Owner\LOCALS~1\Temp\YPS.exe –> c:\docume~1\Owner\LOCALS~1\Temp\YPS.exe [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - PWRIYFOB
*NewlyCreated* - WDF01000
*Deregistered* - pwriyfob

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder

2010-09-05 c:\windows\Tasks\User_Feed_Synchronization-{8865935F-8192-4618-AC3A-176F9D4442C9}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://toshibadirect.com/
uInternet Settings,ProxyOverride = *.local;localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: adobe.com\www
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - (no file)
WebBrowser-{D3360B9E-9AAF-49E5-BD48-E793E415A208} - (no file)
SafeBoot-svcWRSSSDK
MSConfigStartUp-NDSTray - NDSTray.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-05 20:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2859619677-3002885496-3510284245-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,74,b4,b6,24,bc,59,43,9a,ea,e7,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,74,b4,b6,24,bc,59,43,9a,ea,e7,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2010-09-05 20:55:14
ComboFix-quarantined-files.txt 2010-09-06 00:55

Pre-Run: 49,661,255,680 bytes free
Post-Run: 49,669,955,584 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 8963870CB6D002E6127483EC076CB886
Post #6
1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Driver::
FVKQBZQZHVV
SOCTZSZF
YPS


Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Post #7
See attached:

ComboFix 10-09-04.06 - Owner 09/05/2010 21:22:29.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.189 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Internet Security SBS Edition *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_FVKQBZQZHVV
——-\Legacy_SOCTZSZF
——-\Legacy_YPS
——-\Service_FVKQBZQZHVV
——-\Service_SOCTZSZF
——-\Service_YPS


((((((((((((((((((((((((( Files Created from 2010-08-06 to 2010-09-06 )))))))))))))))))))))))))))))))
.

2010-09-06 01:32 . 2010-09-06 01:32 ——– dc-h–r- c:\documents and settings\All Users\Application Data\Atheros
2010-09-05 22:14 . 2010-09-05 22:14 ——– dc—-w- c:\program files\Microsoft Silverlight
2010-09-05 17:04 . 2010-09-05 17:51 ——– dc—-w- c:\program files\HDD Regenerator
2010-09-05 17:03 . 2010-09-05 17:03 ——– dc—-w- c:\documents and settings\Owner\Local Settings\Application Data\Downloaded Installations
2010-09-05 15:49 . 2010-09-05 15:49 ——– dc—-w- c:\program files\CodeStuff
2010-09-05 15:20 . 2010-09-05 15:20 53248 -c–a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-09-05 15:18 . 2010-03-18 09:01 10448 -c–a-w- c:\windows\system32\drivers\LBeepKE.sys
2010-09-05 15:17 . 2010-09-05 15:17 ——– dc—-w- c:\program files\Logitech
2010-09-05 15:12 . 2010-09-05 15:12 ——– dc—-w- c:\documents and settings\Owner\Application Data\Leadertech
2010-09-05 14:57 . 2010-09-05 15:18 16400 -c–a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-09-05 14:56 . 2008-11-07 22:55 16928 -c—-w- c:\windows\system32\spmsgXP_2k3.dll
2010-09-05 14:35 . 2010-09-05 15:19 ——– dc—-w- c:\documents and settings\All Users\Application Data\Logishrd
2010-09-05 14:34 . 2010-09-05 15:19 ——– dc—-w- c:\program files\Common Files\LogiShrd
2010-09-05 14:33 . 2010-09-05 15:20 ——– dc—-w- c:\documents and settings\Owner\Application Data\Logitech
2010-09-05 14:33 . 2010-09-05 14:34 ——– dc—-w- c:\documents and settings\Owner\Application Data\Logishrd
2010-09-05 14:23 . 2007-05-10 08:01 40960 -c–a-w- c:\windows\system32\RemoveWLAN.exe
2010-09-05 14:17 . 2010-09-05 14:17 ——– dc—-w- c:\documents and settings\All Users\Application Data\WLAN
2010-09-05 14:14 . 2007-04-16 19:28 577536 -c–a-w- c:\windows\soundman.exe
2010-09-05 14:14 . 2006-08-01 19:02 49152 -c–a-w- c:\windows\system32\ChCfg.exe
2010-09-05 14:14 . 2006-12-08 19:20 10528768 -c–a-w- c:\windows\system32\RTLCPL.exe
2010-09-05 14:13 . 2010-09-05 15:19 ——– dc—-w- c:\windows\LastGood.Tmp
2010-09-05 14:12 . 2010-09-05 14:12 ——– dc—-w- c:\program files\Realtek AC97
2010-09-05 14:09 . 2010-09-05 14:09 ——– dc—-w- c:\program files\Intel
2010-09-05 14:09 . 2010-03-02 20:04 53248 -c–a-w- c:\windows\system32\CSVer.dll
2010-09-05 14:07 . 2010-09-05 14:07 ——– dc—-w- C:\Intel
2010-09-05 13:12 . 2006-02-07 12:35 135168 -c–a-w- c:\windows\system32\igfxres.dll
2010-09-05 12:34 . 2010-09-05 12:34 ——– dc—-w- c:\program files\Driver-Soft
2010-09-05 11:32 . 2010-09-05 11:32 ——– dc—-w- c:\documents and settings\Owner\Application Data\AVG9
2010-09-05 10:12 . 2010-09-05 10:12 ——– dc—-w- C:\$AVG
2010-09-05 00:56 . 2010-09-05 00:56 12536 -c–a-w- c:\windows\system32\avgrsstx.dll
2010-09-05 00:33 . 2010-09-05 00:55 52872 -c–a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-09-05 00:33 . 2010-09-05 00:56 243024 -c–a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-05 00:33 . 2010-09-05 00:55 216400 -c–a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-05 00:33 . 2010-09-05 23:13 ——– dc—-w- c:\windows\system32\drivers\Avg
2010-09-05 00:33 . 2010-09-05 00:56 29584 -c–a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-05 00:33 . 2010-09-05 00:33 ——– dc—-w- c:\documents and settings\All Users\Application Data\avg9
2010-09-04 10:48 . 2010-09-04 10:48 388096 -c–a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-04 02:59 . 2010-09-04 02:59 ——– dc—-w- c:\documents and settings\Owner\Local Settings\Application Data\VS Revo Group
2010-09-04 02:17 . 2010-09-04 12:17 ——– dc—-w- c:\documents and settings\Owner\Application Data\WinPatrol
2010-09-04 01:29 . 2010-09-04 01:29 ——– dc—-w- c:\documents and settings\Administrator\Local Settings\Application Data\VS Revo Group
2010-09-04 01:28 . 2009-12-30 16:20 27064 -c–a-w- c:\windows\system32\drivers\revoflt.sys
2010-09-04 01:28 . 2010-09-04 01:28 ——– dc—-w- c:\program files\VS Revo Group
2010-09-04 01:20 . 2010-09-04 01:20 ——– dc—-w- c:\documents and settings\Administrator\Application Data\Registry Mechanic
2010-09-04 01:11 . 2010-09-04 01:11 ——– dc—-w- c:\program files\Common Files\PC Tools
2010-09-04 00:06 . 2010-09-04 00:06 ——– dcsh–w- c:\documents and settings\Administrator\IECompatCache
2010-09-04 00:05 . 2010-09-04 00:05 ——– dc—-w- c:\documents and settings\Administrator\Application Data\WinPatrol
2010-09-04 00:05 . 2010-09-04 00:05 ——– dc—-w- c:\program files\BillP Studios
2010-09-03 23:55 . 2010-09-03 23:55 ——– dc—-w- c:\program files\SpywareBlaster
2010-09-03 23:50 . 2010-09-03 23:51 ——– dc—-w- c:\documents and settings\Administrator\Local Settings\Application Data\OpenCandy
2010-09-03 23:50 . 2010-09-03 23:52 ——– dc—-w- c:\program files\IZArc
2010-09-03 23:45 . 2010-09-03 23:45 ——– dc—-w- c:\program files\Defraggler
2010-09-03 23:44 . 2010-09-03 23:44 ——– dc—-w- c:\program files\CCleaner
2010-09-03 23:27 . 2010-09-03 23:27 ——– dc—-w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-09-03 22:23 . 2010-09-03 22:23 ——– dc—-w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-09-03 20:08 . 2010-04-29 19:39 38224 -c–a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-03 20:08 . 2010-09-03 20:08 ——– dc—-w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-03 20:04 . 2010-04-29 19:39 20952 -c–a-w- c:\windows\system32\drivers\mbam.sys
2010-09-03 20:03 . 2010-09-03 22:23 ——– dc—-w- c:\program files\Malwarebytes' Anti-Malware
2010-08-29 17:25 . 2010-09-05 00:33 ——– dc—-w- c:\program files\AVG
2010-08-29 15:50 . 2010-09-04 12:46 ——– dc—-w- C:\downloads
2010-08-29 15:33 . 2010-08-29 15:33 ——– dcsh–w- c:\documents and settings\Administrator\PrivacIE
2010-08-14 16:12 . 2010-08-14 16:12 ——– dc—-w- c:\windows\system32\wbem\Repository
2010-08-14 16:11 . 2010-09-04 12:56 ——– dc—-w- c:\program files\Common Files\Adobe AIR
2010-08-14 16:11 . 2010-08-14 16:11 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-08-12 23:13 . 2010-08-12 23:14 ——– dc—-w- C:\7d3468a68038a05a6b0b8aca9841
2010-08-10 18:37 . 2010-08-10 18:37 ——– dc—-w- c:\documents and settings\Owner\Application Data\Apple Computer
2010-08-09 15:12 . 2010-08-09 15:12 ——– dc—-w- c:\program files\Common Files\Java

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-06 01:36 . 2008-06-21 04:27 ——– dc–a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-05 21:03 . 2008-06-21 12:28 ——– dc—-w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-09-05 14:57 . 2010-09-05 14:57 0 -c-ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-09-05 14:23 . 2010-09-05 14:22 ——– dc—-w- c:\program files\Atheros WLAN Client
2010-09-05 14:21 . 2004-08-19 23:00 ——– dc-h–w- c:\program files\InstallShield Installation Information
2010-09-05 12:24 . 2004-08-19 23:00 ——– dc—-w- c:\program files\Common Files\InstallShield
2010-09-04 00:15 . 2009-09-11 17:48 ——– dc—-w- c:\program files\Spybot - Search & Destroy
2010-09-03 21:30 . 2010-02-13 21:54 ——– dc—-w- c:\program files\Google
2010-09-03 20:36 . 2010-06-01 15:30 ——– dc—-w- c:\program files\Microsoft
2010-09-03 20:26 . 2009-12-04 17:46 ——– dc—-w- c:\program files\Yahoo!
2010-09-03 20:26 . 2009-12-04 17:47 ——– dc—-w- c:\documents and settings\Owner\Application Data\Yahoo!
2010-09-03 20:26 . 2009-12-04 17:47 ——– dc—-w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-08-29 15:45 . 2009-04-13 02:10 ——– dc—-w- c:\program files\Foxit Software
2010-08-14 16:11 . 2004-08-19 23:22 ——– dc—-w- c:\program files\Atheros
2010-08-14 16:11 . 2010-05-31 18:12 ——– dc—-w- c:\program files\QuickTime
2010-08-09 15:09 . 2004-08-19 22:59 ——– dc—-w- c:\program files\Java
2010-08-06 21:47 . 2010-08-06 21:47 ——– dc—-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series
2010-08-03 00:40 . 2010-08-03 00:40 503808 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4eeb6d81-n\msvcp71.dll
2010-08-03 00:40 . 2010-08-03 00:40 499712 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4eeb6d81-n\jmc.dll
2010-08-03 00:40 . 2010-08-03 00:40 12800 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-28a60d14-n\decora-d3d.dll
2010-08-03 00:40 . 2010-08-03 00:40 348160 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-4eeb6d81-n\msvcr71.dll
2010-08-03 00:40 . 2010-08-03 00:40 61440 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-28a60d14-n\decora-sse.dll
2010-07-17 09:00 . 2010-06-01 15:27 423656 -c–a-w- c:\windows\system32\deployJava1.dll
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4446W01.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw44432W2.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4444301.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4444201.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4444101.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4443301.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4443201.bat
2010-07-01 21:05 . 2010-08-06 21:48 66 -c–a-w- c:\documents and settings\All Users\Application Data\Lexmark Pro800-Pro900 Series\Job Status\Scripts\fw4443101.bat
2010-06-30 15:49 . 2006-11-09 22:35 65400 -c–a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2004-08-19 21:49 149504 -c–a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2004-08-19 21:49 916480 -c–a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-19 21:49 1851904 -c–a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-19 21:49 354304 -c–a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-19 21:48 80384 -c–a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2004-08-19 22:28 744448 -c–a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-19 21:48 1172480 -c–a-w- c:\windows\system32\msxml3.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2009-10-14 3217368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-05-31 323976]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-09-05 2065760]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"ACU"="c:\program files\Atheros WLAN Client\ACU.exe" [2009-05-12 479320]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-09-05 00:56 12536 -c–a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 -c–a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RAMASST.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2004-02-20 22:00 88363 -c–a-w- c:\windows\agrsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2004-06-11 04:10 339968 -c–a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CeEKEY]
2004-08-06 22:14 643072 -c–a-w- c:\program files\Toshiba\E-KEY\CeEKey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CeEPOWER]
2004-08-20 01:14 135168 -c–a-w- c:\program files\Toshiba\Power Management\CePMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2006-02-07 12:39 94208 -c–a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 -csh–w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PadTouch]
2004-02-03 21:47 1089589 -c–a-w- c:\program files\Toshiba\Touch and Launch\PadExe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 -c–a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2004-03-02 20:45 135168 -c–a-w- c:\program files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPNF]
2004-07-28 23:23 53248 -c–a-w- c:\program files\Toshiba\TouchPad\TPTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoomingHook]
2004-07-14 23:07 24576 -c–a-w- c:\windows\system32\ZoomingHook.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\lxeccoms.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [9/4/2010 8:33 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/4/2010 8:33 PM 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/4/2010 8:33 PM 243024]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [9/4/2010 8:56 PM 308136]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [9/5/2010 11:18 AM 10448]
R2 lxec_device;lxec_device;c:\windows\system32\lxeccoms.exe -service –> c:\windows\system32\lxeccoms.exe -service [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/3/2010 4:09 PM 304464]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [9/3/2010 9:11 PM 583640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/3/2010 4:04 PM 20952]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 lxecCATSCustConnectService;lxecCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxecserv.exe [7/6/2010 3:15 PM 98984]
S2 mrtRate;mrtRate; [x]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [9/3/2010 9:28 PM 27064]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/19/2004 5:49 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder

2010-09-05 c:\windows\Tasks\User_Feed_Synchronization-{8865935F-8192-4618-AC3A-176F9D4442C9}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://toshibadirect.com/
uInternet Settings,ProxyOverride = *.local;localhost
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: adobe.com\www
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-05 21:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2859619677-3002885496-3510284245-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,74,b4,b6,24,bc,59,43,9a,ea,e7,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,74,b4,b6,24,bc,59,43,9a,ea,e7,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(680)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\windows\system32\athgina.dll
c:\windows\system32\athcfg11.dll

- - - - - - - > 'explorer.exe'(2912)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\ACS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lxeccoms.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\AVG\AVG9\avgam.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-09-05 21:42:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-06 01:42
ComboFix2.txt 2010-09-06 00:55

Pre-Run: 49,672,179,712 bytes free
Post-Run: 49,583,431,680 bytes free

- - End Of File - - A3E6599A9B4B830901DB7BDC2D441842
Post #8
There's not really much on there in the way of bugs. The main issue I see for the slowness is the amount of RAM - only 512MB - that's really the minimum required to run XP. I've suggested some other things that might speed things up somewhat, but the RAM seems to be the underlying issue.

1) TFC
Please download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should reboot your machine, if not, manually reboot to ensure a complete clean

2) chkdsk
  • Close any open windows.
  • Go to the Start Menu, Run[/]b,type in cmd.exe
  • In the command window that appears, type chkdsk /r, and press enter
  • Agree to any prompts - then reboot the computer.
  • chkdsk should run as you boot the machine up - this will check the harddrive for damaged sectors and attempt to repair them.

3) Defrag
  • Close any open windows.
  • Go to the Start Menu, Programs, Accessories, System Tools, Disk Defragmenter
  • Defrag all drives in the Disk Defragmenter

The following will implement some cleanup procedures as well as reset System Restore points:

  • Please press the Windows Key and R on your keyboard. This will bring up the Run… command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
    🖼Click to load external image (Posted Image)
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

How to reduce your chances of infection in the future

Web Browsers
Internet Explorer does come pre-installed with all Windows machines - but this doesn't necessarily mean you have to use it! Because it is the most widely used browser, it is targeted by more malware writers, making you more susceptible to infection. There are many other free alternatives out there that offer better security, take one of these for a spin and see if it takes your fancy.
Mozilla Firefox
Google Chrome
Opera

WOT - Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for Firefox, Google Chrome and Internet Explorer.

If you would prefer to keep using Internet Explorer, follow these additional steps to make the browser more secure.
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Additional Security Measures
Keep your software up-to-date - You should be manually performing updates of your software once a week to ensure that you are current with anti-virus definitions and patched for any security vulnerabilities. This does not just apply to your anti-virus/anti-malware software; malware authors rely on exploiting commonly used software such as Java and Adobe Reader, which need to be kept up to date as well.

Keep Windows up-to-date - Use Windows Update regularly to stay current with security patches and service packs.

MVPS Hosts File - This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.

Firewalls - Without a firewall your computer is susceptible to being hacked and taken over. If you use the Windows Firewall you might think that's sufficient - but it only controls one way of the traffic (inbound). Simply using a Firewall in its default configuration can lower your risk greatly.

What Not To Do
The Perils of P2P File Sharing - Even if a P2P application is on the 'safe' list, malware can still be downloaded through infected files - executables, zip files and even MP3s. It is just not worth the risk.

Fake Security/Optimization Software - Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Additional Reading
How to prevent Malware - I strongly recommend that you read Miekiemoses' good advice

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.
Post #9
For some reason TFC will not run and just freezes up; I did use this program on my PC & it worked like a charm. Plus I am not able to kill it in WIN Task Manager & have to reboot… I have not done any other steps yet either!!!
Post #11
Thanks for the help do far. Are you able to let me know about updates from Toshiba on what I actually need, such as DVD firmware, BIOS, wireless, etc… Aslo, what about my HijackThis file; I still see some things that need deleted as files are missing, but just want to make sure & is there a good cheap site you recommend to upgrade the RAM too.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:25:02 PM, on 9/6/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\lxeccoms.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Atheros WLAN Client\ACU.exe
C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toshibadirect.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-2859619677-3002885496-3510284245-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-21-2859619677-3002885496-3510284245-500\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H (User 'Administrator')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (file missing)
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\ACS.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: lxecCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe
O23 - Service: lxec_device - - C:\WINDOWS\system32\lxeccoms.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe

–
End of file - 8140 bytes
Post #12
Toshiba Updates: Don't bother with them, unless you're having issues with something specific. They are more likely to break something than fix anything.

HijackThis: The log is fine, nothing to worry about there.

RAM: I'm assuming you're in the USA or Canada from your timezone - in that case I'd probably recommend newegg.com for RAM, but the guys in the Hardware forum can give you more specific advice about what you need to get if you want to do it yourself.

Any other issues? :)
Post #14
Forgot that I am stilling having issues with the wireless connection; it will log me into my router, but then cannot acquire the IP address and states its invalid. I have never had an issue with her laptop connecting before…
Post #15
Try this to see if it fixes your wireless issue.

If your network icon appears on the Windows taskbar, then you can repair it by right-clicking on the icon and selecting Repair.

[external image: Posted Image]

If you have no task bar icon do this:

  • Click on the Start button.
  • Click on the Settings menu option.
  • Click on the Control Panel option.
  • When the Control Panel opens, double-click on the Network Connections icon. If your Control Panel is set to Category View, then double-click on Network and Internet Connections and then click on Network Connections at the bottom.
  • You will now see a list of available network connections. Locate the connection for your Wireless Adapter and right-click on it.
  • click on the Repair menu option.

[external image: Posted Image]

Let the repair process perform its tasks and when it has finished, your Internet connection should be working again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI