8 replies to this topic

[techcurve]

I'd so appreciate some help

I downloaded google earth. computer started crashing.

This has happened to me before, I remedied it by rstoring computer back to facory settings. It worked.

However this time it hasn't.

I've updated all my drivers. The crashes are not so frequent, however its still happening.

I've Run avg, ccleaner, adaware,spybot and hijackthis who's log follows:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:20:36, on 14/01/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Virgin Media\HUB\ServicepointService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Thomson SpeedTouch\ST330\diagnostics\diagnostics.exe
C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Documents and Settings\g\Application Data\Virgin Media\HUB\downloads\VirginDetectionScriptsBundle-IE.41.zip.dir\tools\NetworkFinder.signed.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\g\My Documents\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.del.......;l=en&s=gen
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.euro.del.......;l=en&s=gen
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.del.......;l=en&s=gen
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.euro.del.......;l=en&s=gen
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" /icon -l:en
O4 - HKLM\..\Run: [VirginMediaHUB.exe] "C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe" /AUTORUN
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-2511150801-775967567-3960027194-1006\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'st')
O4 - HKUS\S-1-5-21-2511150801-775967567-3960027194-1007\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'sa')
O4 - HKUS\S-1-5-21-2511150801-775967567-3960027194-1008\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 't')
O4 - HKUS\S-1-5-21-2511150801-775967567-3960027194-1009\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'l')
O4 - HKUS\S-1-5-21-2511150801-775967567-3960027194-500\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{774568CF-7105-449B-9473-7EDAB21BD0C1}: NameServer = 194.168.4.100 194.168.8.100
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files\Virgin Media\HUB\ServicepointService.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe

--
End of file - 7804 bytes

hope someone can help,
techcurve

[Tomk]

Hi techcurve,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Nothing showing in your log.

I'm not convinced that this is a malware problem... but, let's stir around a bit and see what we find.

Download TFC to your desktop

• Close any open windows.
• Double click the TFC icon to run the program
• TFC will close all open programs itself in order to run,
• Click the Start button to begin the process.
• Allow TFC to run uninterrupted.
• The program should not take long to finish it's job
• Once its finished it should automatically reboot your machine,
• if it doesn't, manually reboot to ensure a complete clean

Then

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also please describe how your computer behaves at the moment.

[techcurve]

Hi tomk, thanks for repling and offering to help, I'm grateful. I'm following your instuction. I've run TFC, which picked up a few bits and pieces. I've run Malware, interesting, that's picked up some stuff too. Here's the log: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5537 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 17/01/2011 11:25:55 mbam-log-2011-01-17 (11-25-55).txt Scan type: Quick scan Objects scanned: 187557 Time elapsed: 3 minute(s), 37 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 5 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{E856B973-45FD-4559-8F82-EAB539144667} (Adware.Gdown) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{DF058C45-CD18-453e-8745-5A77F60722AB} (Adware.Gdown) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{B5A33C35-7298-4D15-8753-A2E851E2EAB3} (Adware.Gdown) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\GTDOWNDE.GTAutoFixDLCtrl.1 (Adware.Gdown) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\GTDOWNDE.GTAutoFixDLCtrl (Adware.Gdown) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\system32\gtdownde_87.ocx (Adware.Gdown) -> Quarantined and deleted successfully. I shall run the computer for the day, and see how it fairs. I'll post again, tonight, to say how it's behaved. Good to communicate with you, techcurve

[Tomk]

techcurve,

Seeing as how that was found... I'm thinking we better get a deeper look in there.

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

---------------------------------------------------

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

[techcurve]

tomk, it has crashed and the blue screen error message was: stop:0x0000008E (0x0000005,0x80579909,0xA8C14590,0x00000000) I've run DDS and the details are below: DDS (Ver_10-12-12.02) - NTFSx86 Run by g at 17:26:15.09 on 17/01/2011 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_23 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.220 [GMT 0:00] AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33} ============== Running Processes =============== C:\PROGRA~1\AVG\AVG10\avgchsvx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\AVG\AVG10\avgwdsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Virgin Media\HUB\ServicepointService.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AVG\AVG10\avgnsx.exe C:\Program Files\AVG\AVG10\avgemcx.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Thomson SpeedTouch\ST330\diagnostics\diagnostics.exe C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\AVG\AVG10\avgtray.exe C:\WINDOWS\stsystra.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe C:\WINDOWS\eHome\ehmsas.exe C:\Documents and Settings\g\Application Data\Virgin Media\HUB\downloads\VirginDetectionScriptsBundle-IE.41.zip.dir\tools\NetworkFinder.signed.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\PROGRA~1\AVG\AVG10\avgrsx.exe C:\Program Files\AVG\AVG10\avgcsrvx.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Documents and Settings\g\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen mDefault_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen mStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen uInternet Connection Wizard,ShellNext = hxxp://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [ehTray] c:\windows\ehome\ehtray.exe mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE mRun: [diagnostics] "C:\Program Files/Thomson SpeedTouch/ST330/diagnostics/diagnostics.exe" /icon -l:en mRun: [VirginMediaHUB.exe] "c:\program files\virgin media\hub\VirginMediaHUB.exe" /AUTORUN mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab TCP: {774568CF-7105-449B-9473-7EDAB21BD0C1} = 194.168.4.100 194.168.8.100 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll Notify: igfxcui - igfxdev.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\g\applic~1\mozilla\firefox\profiles\lli12b5f.default\ FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\avg\avg10\firefox\components\avgssff.dll FF - plugin: c:\documents and settings\g\application data\mozilla\firefox\profiles\lli12b5f.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - plugin: c:\program files\virgin media\hub\nprpspa.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg10\Firefox FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} ============= SERVICES / DRIVERS =============== R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-1-14 64288] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 251728] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 299984] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2010-11-23 6128208] R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-12-3 1402272] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 ServicepointService;ServicepointService;c:\program files\virgin media\hub\ServicepointService.exe [2011-1-6 668912] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192] R3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2011-1-5 30464] R3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2011-1-5 12672] R3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\drivers\stppp.sys [2011-1-5 32000] S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-12-3 15264] S3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\system32\drivers\steth.sys [2011-1-5 40320] =============== Created Last 30 ================ 2011-01-17 11:20:29 -------- d-----w- c:\docume~1\g\applic~1\Malwarebytes 2011-01-17 11:20:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-17 11:20:24 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2011-01-17 11:20:21 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-01-17 11:20:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-01-14 17:18:46 -------- d-----w- c:\program files\Spybot - Search & Destroy 2011-01-14 17:18:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2011-01-14 17:04:27 15880 ----a-w- c:\windows\system32\lsdelete.exe 2011-01-14 16:57:19 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2011-01-14 16:57:14 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-01-14 16:47:56 -------- d-----w- c:\docume~1\g\locals~1\applic~1\Sunbelt Software 2011-01-14 16:46:34 -------- d-----w- c:\program files\Lavasoft 2011-01-14 13:46:08 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{2162CCC0-3A5F-4887-B51F-CE5F195B3620} 2011-01-14 11:46:57 -------- d-----w- c:\docume~1\g\locals~1\applic~1\Temp 2011-01-14 11:39:25 -------- d-----w- c:\docume~1\g\locals~1\applic~1\Adobe 2011-01-11 16:30:46 25048 ----a-w- c:\program files\mozilla firefox\components\browserdirprovider.dll 2011-01-11 16:30:46 140248 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll 2011-01-11 14:40:35 -------- d-----w- c:\docume~1\g\applic~1\ntr 2011-01-10 14:42:59 -------- d-----w- c:\windows\system32\appmgmt 2011-01-10 06:14:54 -------- d--h--w- C:\$AVG 2011-01-10 04:30:07 -------- d-----w- c:\docume~1\g\applic~1\AVG10 2011-01-09 23:01:02 -------- d--h--w- c:\docume~1\alluse~1\applic~1\Common Files 2011-01-09 23:00:04 -------- d-----w- c:\windows\system32\drivers\AVG 2011-01-09 23:00:04 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVG10 2011-01-09 22:59:43 -------- d-----w- c:\program files\AVG 2011-01-09 16:21:33 -------- d-----w- c:\docume~1\alluse~1\applic~1\MFAData 2011-01-09 14:50:34 397312 ----a-w- c:\windows\system32\drivers\ETNADiag.exe 2011-01-09 14:27:27 53248 ----a-w- c:\windows\system32\atiexdxx.dll 2011-01-09 14:27:19 -------- d-----w- c:\program files\ATI Technologies 2011-01-09 14:27:02 212992 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ILog.dll 2011-01-09 14:24:55 -------- d-----w- c:\program files\CCleaner 2011-01-08 19:37:24 -------- d-----w- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters 2011-01-07 16:27:52 733184 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iKernel.dll 2011-01-07 16:27:52 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\ctor.dll 2011-01-07 16:27:52 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\DotNetInstaller.exe 2011-01-07 16:27:52 303104 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\setup.dll 2011-01-07 16:27:52 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iscript.dll 2011-01-07 16:27:52 180356 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iGdi.dll 2011-01-07 16:27:52 172032 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iuser.dll 2011-01-07 15:11:56 -------- d-----w- C:\drvrtmp 2011-01-07 15:09:50 139264 ----a-w- c:\windows\system32\igfxres.dll 2011-01-07 15:06:45 61440 ----a-w- c:\windows\system32\iAlmCoIn_v4543.dll 2011-01-07 15:03:52 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll 2011-01-07 15:03:52 32768 ------w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll 2011-01-07 15:03:52 225280 ------w- c:\program files\common files\installshield\iscript\iscript.dll 2011-01-07 15:03:52 176128 ------w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll 2011-01-07 15:03:51 614532 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe 2011-01-07 14:52:12 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll 2011-01-07 14:52:12 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll 2011-01-07 14:52:11 729088 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll 2011-01-07 14:52:11 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll 2011-01-07 14:52:11 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe 2011-01-07 14:52:11 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll 2011-01-07 14:52:11 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll 2011-01-07 14:52:11 188548 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll 2011-01-07 14:22:02 -------- d-----w- c:\windows\system32\XPSViewer 2011-01-07 14:20:20 -------- d-----w- C:\d418b21f53a86928c746aad110 2011-01-07 12:00:36 954368 ------w- c:\windows\system32\dllcache\mfc40.dll 2011-01-07 12:00:35 974848 ------w- c:\windows\system32\dllcache\mfc42.dll 2011-01-07 12:00:35 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll 2011-01-07 12:00:23 617472 ------w- c:\windows\system32\dllcache\comctl32.dll 2011-01-07 11:59:19 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys 2011-01-07 11:54:38 512000 ------w- c:\windows\system32\dllcache\jscript.dll 2011-01-07 11:54:33 45568 ------w- c:\windows\system32\dllcache\wab.exe 2011-01-07 10:42:17 -------- d-----w- c:\docume~1\g\locals~1\applic~1\Deployment 2011-01-07 10:41:21 89088 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll 2011-01-07 10:41:00 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2011-01-07 10:41:00 117760 ------w- c:\windows\system32\prntvpt.dll 2011-01-07 10:40:59 597504 ------w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe 2011-01-07 10:40:59 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2011-01-07 10:40:59 575488 ------w- c:\windows\system32\xpsshhdr.dll 2011-01-07 10:40:59 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll 2011-01-07 10:40:59 1676288 ------w- c:\windows\system32\xpssvcs.dll 2011-01-07 10:40:59 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll 2011-01-07 10:40:59 -------- d-----w- C:\bd6a1d4d827437bc79b493bd5fa8 2011-01-07 10:21:02 -------- d-----w- c:\program files\SystemRequirementsLab 2011-01-07 10:06:25 -------- d-----w- c:\docume~1\g\locals~1\applic~1\Identities 2011-01-06 17:27:32 -------- d-----w- c:\windows\system32\scripting 2011-01-06 17:27:31 -------- d-----w- c:\windows\system32\en 2011-01-06 17:27:31 -------- d-----w- c:\windows\system32\bits 2011-01-06 17:23:22 -------- d-----w- c:\windows\network diagnostic 2011-01-06 15:51:16 -------- d-----w- c:\windows\ServicePackFiles 2011-01-06 15:46:54 20 ----a-w- c:\windows\system32\WMV8DMOD.DLL 2011-01-06 15:34:35 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-01-06 15:34:35 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-01-06 15:34:35 472808 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll 2011-01-06 15:30:57 685056 ------w- c:\windows\system32\drivers\hsfcxts2.sys 2011-01-06 14:53:20 272128 ------w- c:\windows\system32\drivers\bthport.sys 2011-01-06 14:53:20 272128 ------w- c:\windows\system32\dllcache\bthport.sys 2011-01-06 14:53:13 357248 ------w- c:\windows\system32\dllcache\srv.sys 2011-01-06 14:52:55 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys 2011-01-06 14:52:50 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe 2011-01-06 14:52:44 81920 ------w- c:\windows\system32\dllcache\fontsub.dll 2011-01-06 14:52:44 119808 ------w- c:\windows\system32\dllcache\t2embed.dll 2011-01-06 14:52:39 153088 ------w- c:\windows\system32\dllcache\triedit.dll 2011-01-06 14:52:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe 2011-01-06 14:52:28 23040 ------w- c:\windows\kb913800.exe 2011-01-06 14:51:29 331776 ------w- c:\windows\system32\dllcache\msadce.dll 2011-01-06 14:51:22 293376 ------w- c:\windows\system32\browserchoice.exe 2011-01-06 14:50:33 290048 ------w- c:\windows\system32\dllcache\atmfd.dll 2011-01-06 14:48:45 471552 ------w- c:\windows\system32\dllcache\aclayers.dll 2011-01-06 14:46:51 345600 ------w- c:\windows\system32\dllcache\localspl.dll 2011-01-06 14:45:33 270336 ------w- c:\windows\system32\dllcache\oakley.dll 2011-01-06 13:47:15 -------- d-----w- c:\windows\system32\PreInstall 2011-01-06 13:45:21 203136 ------w- c:\windows\system32\dllcache\rmcast.sys 2011-01-06 10:25:48 5120 ----a-w- c:\windows\system32\xpsp4res.dll 2011-01-06 10:25:47 218112 ------w- c:\windows\system32\dllcache\wordpad.exe 2011-01-06 10:25:45 177664 ------w- c:\windows\system32\dllcache\wintrust.dll 2011-01-06 10:25:27 86016 ------w- c:\windows\system32\dllcache\cabview.dll 2011-01-06 09:38:41 -------- d-----w- c:\windows\l2schemas 2011-01-06 09:38:31 69120 ------w- c:\windows\system32\wlanapi.dll 2011-01-06 09:36:56 -------- d-----w- c:\program files\MSXML 6.0 2011-01-06 09:23:48 -------- d-----w- c:\docume~1\g\applic~1\Virgin Media 2011-01-06 09:23:45 -------- d-----w- c:\docume~1\alluse~1\applic~1\Radialpoint 2011-01-06 09:23:43 -------- d-----w- c:\program files\Virgin Media 2011-01-06 09:23:43 -------- d-----w- c:\docume~1\alluse~1\applic~1\Virgin Media 2011-01-06 09:22:39 74240 ------w- c:\windows\system32\dllcache\mscms.dll 2011-01-06 09:22:36 1435648 ------w- c:\windows\system32\dllcache\query.dll 2011-01-06 09:22:34 149504 ------w- c:\windows\system32\dllcache\schannel.dll 2011-01-06 09:22:33 58880 ------w- c:\windows\system32\dllcache\atl.dll 2011-01-06 09:22:32 81920 ------w- c:\windows\system32\dllcache\ieencode.dll 2011-01-06 09:22:31 629760 ------w- c:\windows\system32\dllcache\urlmon.dll 2011-01-06 09:22:31 251904 ------w- c:\windows\system32\dllcache\iepeers.dll 2011-01-06 09:22:30 667136 ------w- c:\windows\system32\dllcache\wininet.dll 2011-01-06 09:22:30 1025024 ------w- c:\windows\system32\dllcache\browseui.dll 2011-01-06 09:22:29 3076096 ------w- c:\windows\system32\dllcache\mshtml.dll 2011-01-06 09:22:29 1510400 ------w- c:\windows\system32\dllcache\shdocvw.dll 2011-01-06 09:21:16 2066432 ------w- c:\windows\system32\dllcache\mstscax.dll 2011-01-06 09:00:43 -------- d-----w- c:\windows\system32\SoftwareDistribution 2011-01-06 00:44:40 5632 ----a-w- c:\windows\system32\ptpusb.dll 2011-01-06 00:44:39 159232 ----a-w- c:\windows\system32\ptpusd.dll 2011-01-06 00:44:39 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys 2011-01-05 23:20:54 -------- d-s---w- c:\documents and settings\g\UserData 2011-01-05 22:18:00 32000 ----a-w- c:\windows\system32\drivers\stppp.sys 2011-01-05 22:17:59 40320 ----a-w- c:\windows\system32\drivers\steth.sys 2011-01-05 22:17:59 30464 ----a-w- c:\windows\system32\drivers\st330.sys 2011-01-05 22:17:59 16128 ----a-w- c:\windows\system32\drivers\lpwdm.sys 2011-01-05 22:17:59 12672 ----a-w- c:\windows\system32\drivers\stbus.sys 2011-01-05 22:17:13 -------- d-----w- c:\program files\Thomson SpeedTouch 2011-01-05 17:36:58 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys 2011-01-05 17:36:54 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys 2011-01-05 17:36:50 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys ==================== Find3M ==================== 2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll 2010-11-09 14:52:35 249856 ----a-w- c:\windows\system32\odbc32.dll 2010-11-05 05:05:36 667136 ----a-w- c:\windows\system32\wininet.dll 2010-11-05 05:05:36 61952 ----a-w- c:\windows\system32\tdc.ocx 2010-11-05 05:05:35 81920 ----a-w- c:\windows\system32\ieencode.dll 2010-11-03 12:59:07 369664 ----a-w- c:\windows\system32\html.iec 2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll 2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys ============= FINISH: 17:26:32.21 =============== techcurve

Attached Files

•  Attach.txt   13.05KB   299 downloads

[Tomk]

techcurve,

Lavasoft Ad-Watch Live! Anti-Virus

Ad-Aware by Lavasoft used to be just an anti-spyware/adware program. The new Lavasoft programs contain and Anti-Virus component. You are running AVG for Anti-Virus. Having two is not a good idea as they can conflict with each other. I suggest that you uninstall one of them. My suggestion would be that you uninstall Lavasoft and keep AVG. Then you should hold on to Malwarebytes and run it as your anti-spyware. You can upgrade to the paid versions of Mbam, if you choose, which will provide real time protection and a few more "perks" than you get in the free version.

Based upon the errors I'm seeing in your Event log... I'm thinking a memory problem. I am far from an expert in those issues and therefore believe you would be better served by the Tech Team. Therefore I suggest that you post your problem in the Windows forum. When you do so, please provide a link there back to this topic so that the Tech Team will have easy access to the information you've already provided.

Does this make sense to you?

[techcurve]

Thanks tomk. Yes it does make sense. Appreciated your help and support. I will post on the windows forum with a link. All the best tomk, big up to you! techcurve

[Tomk]

You can delete DDS as you shouldn't have any need of it. (It doesn't do anything but produce the log you posted).


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved as far as malware is concerned.

[Tomk]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatth...ed_t106388.html
and start a New Topic.