This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

virus or malware issues HJT included

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

My comp is running fine. It never really started running bad. So how sure can you be that I am clean? out of 100% DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 22:27:29.62 on 09/03/2011 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_24 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2170 [GMT -5:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Documents and Settings\Shawn\Desktop\dds.scr . ============== Pseudo HJT Report =============== . BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office14\GROOVEEX.DLL BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~3\office14\URLREDIR.DLL uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [ASUS Probe] c:\program files\asus\probe\AsusProb.exe mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe" mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe mPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\micros~3\office14\ONBttnIE.dll/105 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} - hxxp://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab64162.cab Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office14\GROOVEEX.DLL . ================= FIREFOX =================== . FF - ProfilePath - c:\docume~1\shawn\applic~1\mozilla\firefox\profiles\dmjy0zsd.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/ig?hl=en FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll FF - plugin: c:\progra~1\micros~3\office14\NPAUTHZ.DLL FF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLL FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-12-30 64288] R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [2010-12-30 16640] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-12-21 115008] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-12-21 94872] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2011-1-12 810144] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-12-3 1405384] R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-1-21 110592] R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480] S3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\drivers\ivusb.sys –> c:\windows\system32\drivers\ivusb.sys [?] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-12-3 15232] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-3-25 30969208] S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-12-30 11520] S4 Rdpnsolenw;Rdpnsolenw; [x] . =============== Created Last 30 ================ . 2011-03-06 14:49:11 ——– d—–w- c:\windows\system32\xircom 2011-03-06 14:49:11 ——– d—–w- c:\windows\system32\wbem\snmp 2011-03-06 14:49:11 ——– d—–w- c:\windows\system32\oobe 2011-03-06 14:49:11 ——– d—–w- c:\windows\system32\inetsrv 2011-03-06 14:49:11 ——– d—–w- c:\program files\windows nt 2011-03-06 14:49:11 ——– d—–w- c:\program files\msn gaming zone 2011-03-06 02:18:53 ——– d—–w- c:\docume~1\shawn\locals~1\applic~1\ESET 2011-03-06 02:06:58 ——– d—–w- c:\program files\ESET 2011-03-05 18:39:27 ——– d-sha-r- C:\cmdcons 2011-03-05 18:38:15 98816 —-a-w- c:\windows\sed.exe 2011-03-05 18:38:15 89088 —-a-w- c:\windows\MBR.exe 2011-03-05 18:38:15 256512 —-a-w- c:\windows\PEV.exe 2011-03-05 18:38:15 161792 —-a-w- c:\windows\SWREG.exe 2011-03-05 18:38:10 ——– d—–w- C:\ComboFix 2011-03-03 04:26:28 16432 —-a-w- c:\windows\system32\lsdelete.exe 2011-03-03 03:30:48 ——– d—–w- C:\$AVG 2011-03-03 00:15:43 ——– d—–r- c:\program files\Skype 2011-02-22 23:10:23 ——– d—–w- c:\program files\PeerBlock 2011-02-21 17:32:36 73728 —-a-w- c:\windows\system32\javacpl.cpl 2011-02-21 17:32:36 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-02-21 17:32:36 472808 —-a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll 2011-02-18 23:22:29 ——– d—–w- c:\program files\BitTorrent 2011-02-18 23:21:45 ——– d—–w- c:\docume~1\shawn\applic~1\BitTorrent 2011-02-11 18:48:54 1172872 —-a-w- c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll . ==================== Find3M ==================== . 2011-03-06 23:18:59 202008 —-a-w- c:\windows\system32\PnkBstrB.exe 2011-01-04 00:16:20 60416 —-a-w- c:\windows\ALCFDRTM.VER 2011-01-04 00:16:20 60416 —-a-w- c:\windows\ALCFDRTM.EXE 2011-01-03 14:06:30 66872 —-a-w- c:\windows\system32\PnkBstrA.exe 2011-01-01 15:53:17 240592 —-a-w- c:\windows\system32\nvdrsdb0.bin 2011-01-01 15:53:17 1 —-a-w- c:\windows\system32\nvdrssel.bin 2011-01-01 15:53:16 240592 —-a-w- c:\windows\system32\nvdrsdb1.bin . ============= FINISH: 22:27:45.79 ===============
addman:

I see no remaining malware in your logs, but we still have those files that are failing a check of their digital signatures. I would recommend that you uninstall and reinstall Windows XP Service Pack 3:

1. Click Start, click Run, (or Windows Key +R) and copy the following command into the run box that opens and then click OK:
c:\windows\$NtServicePackUninstall$\spuninst\spuninst.exe
2. When the Windows XP Service Pack 3 Removal Wizard starts, click Next.
3. Follow the instructions on the screen to remove Windows XP SP3.


Then go to MS to download and reinstall the service pack:

Download the latest Windows XP service pack from the Microsoft Download Center. This page will say that this installation package is intended for IT professionals and developers. However, you can safely download this file.

http://www.microsoft.com/downloads/details…;displaylang=en

Let me know once you have this completed and we can finish cleaning your PC up.
The most important file is the one that is missing. wscntfy.exe is part of the Windows Security Center. I don't think I was clear enough in my last instructions - I am only suggesting that you uninstall / reinstall Service Pack 3, I'm not recommending that you reinstall Windows.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI