What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Excruciatingly slow computer [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please help me to reclaim my computer from whatever has taken over. It takes forever to do anything and I am about ready to toss it out the window. I started a thread several months ago and I apologize for not following through with it. I had some other issues that required my attention but I promise this time to follow through with the recommendations and hopefully I can get my computer back to normal.
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

Please download DDS from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
———-

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
    Vista and Windows 7 users right click the icon and choose "Run as administrator".
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

In your next reply please post both of the logs created by DDS and the log created by aswMBR.exe. :)
Post #3
. DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by [removed] at 17:00:29 on 2012-01-05 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.261 [GMT -6:00] . AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\ScsiAccess.EXE C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\progra~1\vision~1\paperp~1\pptd40nt.exe C:\WINDOWS\twain_32\paprport\3100b\flatbed.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe C:\Program Files\AT&T\Internet Security Wizard\ISW.exe C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe C:\Program Files\Pure Networks\Network Magic\nmapp.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\AVG Secure Search\vprot.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Dell Photo Printer 720\dlbcserv.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Documents and Settings\Marty Sellers\My Documents\RCA Detective\RCADetective.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Java\Java Update\jucheck.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.weather.com/outlook/travel/businesstraveler/local/38834?lswe=38834&lwsa=WeatherLocalUndeclared&from=whatwhere uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search/msie?p={searchTerms}&ei=UTF-8 uDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: H - No File mURLSearchHooks: H - No File BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\9.0.0.18\AVG Secure Search_toolbar.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\9.0.0.18\AVG Secure Search_toolbar.dll uRun: [Creative Detector] c:\program files\creative\mediasource\detector\CTDetect.exe /R uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Easy Dock] c:\documents and settings\marty sellers\my documents\rca easyrip\EZDock.exe mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe mRun: [PaperPort PTD] c:\progra~1\vision~1\paperp~1\pptd40nt.exe mRun: [PP3100b] c:\windows\twain_32\paprport\3100b\flatbed.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [SSP Notifier] c:\program files\fisher-price\fp3 player\sspnotifier.exe mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe" mRun: [ISW.exe] "c:\program files\at&t\internet security wizard\ISW.exe" /AUTORUN mRun: [HelpCenter4.1] c:\program files\fastaccessdsl\helpcenter43\bin\sprtcmd.exe /P HelpCenter4.1 mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe" mRun: [nmapp] "c:\program files\pure networks\network magic\nmapp.exe" -autorun -nosplash mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe" mRun: [Easy Dock] mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [Nikon Transfer Monitor] c:\program files\common files\nikon\monitor\NkMonitor.exe mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe mRun: [vProt] "c:\program files\avg secure search\vprot.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" StartupFolder: c:\docume~1\martys~1\startm~1\programs\startup\rcadet~1.lnk - c:\documents and settings\marty sellers\my documents\rca detective\RCADetective.exe StartupFolder: c:\docume~1\martys~1\startm~1\programs\startup\webshots.lnk - c:\program files\webshots\Launcher.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dlbcserv.lnk - c:\program files\dell photo printer 720\dlbcserv.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software updater\7288971\6.1.4.37-7288971l\program\runner.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe IE: &Webshots Photo Search - c:\program files\webshots\WSToolbar4IE.dll/MENUSEARCH.HTM IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll Trusted Zone: taxactonline.com\www Trusted Zone: musicmatch.com\online DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} - hxxp://community.webshots.com/html/atx/wsaxcontrol.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/27.38/uploader2.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} - hxxp://www.mpix.com/customer/uploading/activex/ImageUploader6.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} - hxxp://support.f-secure.com/ols/fscax.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{4DD7DDA4-4BA0-4C27-922D-B600C279E3BC} : DhcpNameServer = 192.168.1.254 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\9.0.1\ViProtocol.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 23120] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 32592] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 230608] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 40016] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-9-7 295248] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776] R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\9.0.1\ToolbarUpdater.exe [2011-11-30 855904] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 134608] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 24272] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 16720] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-4-15 1025352] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 PCD5SRVC{FBEA8B78-1B22F121-05040000};PCD5SRVC{FBEA8B78-1B22F121-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\dellsu~2\hwdiag\bin\PCD5SRVC.pkms [2007-12-5 20640] . =============== Created Last 30 ================ . 2012-01-04 22:46:19 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll 2012-01-04 22:46:19 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll 2012-01-04 22:46:19 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll 2012-01-04 22:46:19 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll 2012-01-04 22:46:19 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll 2012-01-04 22:46:19 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll 2012-01-04 22:46:19 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin.dll . ==================== Find3M ==================== . 2011-11-23 13:25:32 1859584 —-a-w- c:\windows\system32\win32k.sys 2011-11-04 19:20:51 916992 —-a-w- c:\windows\system32\wininet.dll 2011-11-04 19:20:51 43520 —-a-w- c:\windows\system32\licmgr10.dll 2011-11-04 19:20:51 1469440 ——w- c:\windows\system32\inetcpl.cpl 2011-11-04 11:23:59 385024 —-a-w- c:\windows\system32\html.iec 2011-11-01 16:07:10 1288704 —-a-w- c:\windows\system32\ole32.dll 2011-10-28 05:31:48 33280 —-a-w- c:\windows\system32\csrsrv.dll 2011-10-25 13:33:08 2192768 ——w- c:\windows\system32\ntoskrnl.exe 2011-10-25 12:52:03 2069376 ——w- c:\windows\system32\ntkrnlpa.exe 2011-10-24 20:29:02 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2011-10-24 20:29:02 69632 —-a-w- c:\windows\system32\QuickTime.qts 2011-10-18 11:13:22 186880 —-a-w- c:\windows\system32\encdec.dll 2011-10-10 14:22:41 692736 —-a-w- c:\windows\system32\inetcomm.dll . ============= FINISH: 17:01:49.06 =============== aswMBR version 0.9.9.1156 Copyright© 2011 AVAST Software Run date: 2012-01-05 17:57:58 —————————– 17:57:58.546 OS Version: Windows 5.1.2600 Service Pack 3 17:57:58.562 Number of processors: 1 586 0x401 17:57:58.562 ComputerName: SELLERS UserName: 17:58:01.109 Initialize success 18:02:23.984 AVAST engine defs: 12010501 18:02:35.484 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 18:02:35.484 Disk 0 Vendor: HDS728080PLAT20 PF2OA27A Size: 76293MB BusType: 3 18:02:35.562 Disk 0 MBR read successfully 18:02:35.562 Disk 0 MBR scan 18:02:35.859 Disk 0 unknown MBR code 18:02:35.890 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63 18:02:35.953 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 72888 MB offset 80325 18:02:36.078 Disk 0 Partition 3 00 DB CP/M / CTOS Dell 8.0 3357 MB offset 149356305 18:02:36.171 Disk 0 scanning sectors +156232125 18:02:36.640 Disk 0 scanning C:\WINDOWS\system32\drivers 18:05:31.296 Service scanning 18:05:35.562 Modules scanning 18:06:17.765 Disk 0 trace - called modules: 18:06:18.359 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 18:06:18.359 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82bd8ab8] 18:06:18.359 3 CLASSPNP.SYS[f85b7fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82b8ab00] 18:06:32.734 AVAST engine scan C:\WINDOWS 18:06:58.296 AVAST engine scan C:\WINDOWS\system32 18:17:08.781 AVAST engine scan C:\WINDOWS\system32\drivers 18:18:13.546 AVAST engine scan C:\Documents and Settings\Marty Sellers 18:38:37.484 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Marty Sellers\Desktop\MBR.dat" 18:38:37.515 The log file has been saved successfully to "C:\Documents and Settings\Marty Sellers\Desktop\aswMBR.txt" aswMBR version 0.9.9.1156 Copyright© 2011 AVAST Software Run date: 2012-01-05 17:57:58 —————————– 17:57:58.546 OS Version: Windows 5.1.2600 Service Pack 3 17:57:58.562 Number of processors: 1 586 0x401 17:57:58.562 ComputerName: SELLERS UserName: 17:58:01.109 Initialize success 18:02:23.984 AVAST engine defs: 12010501 18:02:35.484 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 18:02:35.484 Disk 0 Vendor: HDS728080PLAT20 PF2OA27A Size: 76293MB BusType: 3 18:02:35.562 Disk 0 MBR read successfully 18:02:35.562 Disk 0 MBR scan 18:02:35.859 Disk 0 unknown MBR code 18:02:35.890 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63 18:02:35.953 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 72888 MB offset 80325 18:02:36.078 Disk 0 Partition 3 00 DB CP/M / CTOS Dell 8.0 3357 MB offset 149356305 18:02:36.171 Disk 0 scanning sectors +156232125 18:02:36.640 Disk 0 scanning C:\WINDOWS\system32\drivers 18:05:31.296 Service scanning 18:05:35.562 Modules scanning 18:06:17.765 Disk 0 trace - called modules: 18:06:18.359 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 18:06:18.359 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82bd8ab8] 18:06:18.359 3 CLASSPNP.SYS[f85b7fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82b8ab00] 18:06:32.734 AVAST engine scan C:\WINDOWS 18:06:58.296 AVAST engine scan C:\WINDOWS\system32 18:17:08.781 AVAST engine scan C:\WINDOWS\system32\drivers 18:18:13.546 AVAST engine scan C:\Documents and Settings\Marty Sellers 18:38:37.484 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Marty Sellers\Desktop\MBR.dat" 18:38:37.515 The log file has been saved successfully to "C:\Documents and Settings\Marty Sellers\Desktop\aswMBR.txt"

Attachments:

Post #4
Hi cortspop,

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
Post #5
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Home Edition Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000000d Kernel Drivers (total 140): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EF000 \WINDOWS\system32\hal.dll 0xF8A77000 \WINDOWS\system32\KDCOM.DLL 0xF8987000 \WINDOWS\system32\BOOTVID.dll 0xF8528000 ACPI.sys 0xF8A79000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF8517000 pci.sys 0xF8577000 isapnp.sys 0xF8B3F000 pciide.sys 0xF87F7000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF8A7B000 intelide.sys 0xF8587000 MountMgr.sys 0xF84F8000 ftdisk.sys 0xF87FF000 PartMgr.sys 0xF8597000 VolSnap.sys 0xF84E0000 atapi.sys 0xF85A7000 disk.sys 0xF85B7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF84C0000 fltmgr.sys 0xF85C7000 PxHelp20.sys 0xF84A9000 KSecDD.sys 0xF841C000 Ntfs.sys 0xF83EF000 NDIS.sys 0xF898B000 ppsio2.sys 0xF83D5000 Mup.sys 0xF8807000 avgrkx86.sys 0xF898F000 AVGIDSEH.Sys 0xF87E7000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xF823E000 \SystemRoot\system32\DRIVERS\ialmnt5.sys 0xF822A000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF88A7000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xF8206000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF88AF000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF85E7000 \SystemRoot\system32\DRIVERS\IntelC53.sys 0xF81E3000 \SystemRoot\system32\DRIVERS\ks.sys 0xF80BC000 \SystemRoot\system32\DRIVERS\IntelC51.sys 0xF8027000 \SystemRoot\system32\DRIVERS\IntelC52.sys 0xF88B7000 \SystemRoot\system32\DRIVERS\mohfilt.sys 0xF88BF000 \SystemRoot\System32\Drivers\Modem.SYS 0xF8001000 \SystemRoot\system32\DRIVERS\e100b325.sys 0xF88C7000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF85F7000 \SystemRoot\system32\DRIVERS\serial.sys 0xF8A53000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF7FED000 \SystemRoot\system32\DRIVERS\parport.sys 0xF8607000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF8617000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF7FAD000 \SystemRoot\system32\drivers\smwdm.sys 0xF7F89000 \SystemRoot\system32\drivers\portcls.sys 0xF8627000 \SystemRoot\system32\drivers\drmk.sys 0xF7ED6000 \SystemRoot\system32\drivers\senfilt.sys 0xF8CC4000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF8637000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF8A5B000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF7EBF000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF8647000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF8657000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF88CF000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF7EAE000 \SystemRoot\system32\DRIVERS\psched.sys 0xF8667000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF88D7000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF88DF000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF8677000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF88E7000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF88EF000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF8AA3000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF7E50000 \SystemRoot\system32\DRIVERS\update.sys 0xF8A6F000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF8697000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF86B7000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF8AAB000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF8A0F000 \SystemRoot\system32\drivers\MODEMCSA.sys 0xF88FF000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xF8A23000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xF86D7000 \SystemRoot\system32\DRIVERS\avgmfx86.sys 0xF8A2B000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF86E7000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF8907000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF8AAD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF86F7000 \SystemRoot\system32\DRIVERS\DcCam.sys 0xEEFD1000 \SystemRoot\system32\DRIVERS\EXPORTIT.SYS 0xF8CBF000 \SystemRoot\System32\Drivers\Null.SYS 0xF8AAF000 \SystemRoot\System32\Drivers\Beep.SYS 0xF8917000 \SystemRoot\System32\drivers\vga.sys 0xF8AB1000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF8AB3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF891F000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF8927000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF8A33000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xEEF9E000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xEEF45000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xEEEFE000 \SystemRoot\system32\DRIVERS\avgtdix.sys 0xEEED8000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xF8757000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xF892F000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xEEEB0000 \SystemRoot\system32\DRIVERS\netbt.sys 0xF8A3B000 \SystemRoot\System32\drivers\ws2ifsl.sys 0xEEE66000 \SystemRoot\System32\drivers\afd.sys 0xF8767000 \SystemRoot\system32\DRIVERS\netbios.sys 0xEEE3B000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xEEDCB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF8787000 \SystemRoot\System32\Drivers\Fips.SYS 0xEED94000 \SystemRoot\system32\DRIVERS\avgldx86.sys 0xF8A6B000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xF715B000 \SystemRoot\system32\DRIVERS\usbscan.sys 0xF893F000 \SystemRoot\system32\DRIVERS\usbprint.sys 0xF8947000 \SystemRoot\system32\DRIVERS\HPZius12.sys 0xF7153000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xF8797000 \SystemRoot\system32\DRIVERS\HPZid412.sys 0xF714F000 \SystemRoot\system32\DRIVERS\HPZipr12.sys 0xEF09B000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xEECB4000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF8B13000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xEED28000 \SystemRoot\System32\drivers\Dxapi.sys 0xF8857000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF8B92000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF020000 \SystemRoot\System32\ialmdnt5.dll 0xBF012000 \SystemRoot\System32\ialmrnt5.dll 0xBF042000 \SystemRoot\System32\ialmdev5.DLL 0xBF077000 \SystemRoot\System32\ialmdd5.DLL 0xF87C7000 \SystemRoot\system32\drivers\dcfs2k.sys 0xEEB98000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xF886F000 \SystemRoot\system32\DRIVERS\pnarp.sys 0xF8877000 \SystemRoot\system32\DRIVERS\purendis.sys 0xEE84F000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xEEAA0000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys 0xF8AC5000 \SystemRoot\system32\DRIVERS\dsunidrv.sys 0xEE707000 \SystemRoot\system32\DRIVERS\srv.sys 0xEE61B000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xEE5E1000 \??\C:\WINDOWS\system32\drivers\PfModNT.sys 0xF881F000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys 0xEE481000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys 0xEE304000 \SystemRoot\system32\drivers\wdmaud.sys 0xEE7AF000 \SystemRoot\system32\drivers\sysaudio.sys 0xED755000 \SystemRoot\System32\Drivers\HTTP.sys 0xF8AE5000 \??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys 0xEE341000 \??\C:\DOCUME~1\MARTYS~1\LOCALS~1\Temp\mbr.sys 0xEDB0E000 \??\C:\DOCUME~1\MARTYS~1\LOCALS~1\Temp\aswMBR.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 66): 0 System Idle Process 4 System 572 C:\WINDOWS\system32\smss.exe 848 csrss.exe 872 C:\WINDOWS\system32\winlogon.exe 920 C:\WINDOWS\system32\services.exe 932 C:\WINDOWS\system32\lsass.exe 1096 C:\WINDOWS\system32\svchost.exe 1180 svchost.exe 1296 C:\WINDOWS\system32\svchost.exe 1400 svchost.exe 1536 svchost.exe 1692 C:\WINDOWS\system32\LEXBCES.EXE 1728 C:\WINDOWS\system32\spoolsv.exe 1740 C:\WINDOWS\system32\LEXPPS.EXE 412 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 424 C:\Program Files\AVG\AVG2012\avgwdsvc.exe 440 C:\WINDOWS\system32\CTSVCCDA.EXE 492 C:\WINDOWS\system32\svchost.exe 356 C:\Program Files\Java\jre6\bin\jqs.exe 524 C:\WINDOWS\system32\drivers\KodakCCS.exe 1016 C:\Program Files\Common Files\Motive\McciCMService.exe 1800 C:\WINDOWS\system32\svchost.exe 1852 C:\WINDOWS\system32\svchost.exe 1712 C:\WINDOWS\system32\ScsiAccess.EXE 1900 C:\Program Files\Dell Support Center\bin\sprtsvc.exe 1972 C:\WINDOWS\system32\svchost.exe 1940 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe 2116 C:\WINDOWS\explorer.exe 2120 C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe 2112 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 2976 C:\Program Files\Analog Devices\Core\smax4pnp.exe 3020 C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe 3072 C:\PROGRA~1\VISION~1\PAPERP~1\Pptd40nt.exe 3088 C:\WINDOWS\twain_32\paprport\3100b\Flatbed.exe 3116 C:\WINDOWS\system32\hkcmd.exe 3144 C:\WINDOWS\system32\igfxpers.exe 3180 C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe 3252 C:\Program Files\AT&T\Internet Security Wizard\ISW.exe 3280 C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe 3292 C:\Program Files\Dell Support Center\bin\sprtcmd.exe 3320 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe 3376 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe 3420 C:\Program Files\Pure Networks\Network Magic\nmapp.exe 3548 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 3612 C:\Program Files\AVG\AVG2012\avgtray.exe 3764 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac 1868 C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe 2092 C:\Program Files\Common Files\Java\Java Update\jusched.exe 1568 C:\Program Files\AVG Secure Search\vprot.exe 2744 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe 3304 C:\Program Files\DellSupport\DSAgnt.exe 3536 C:\WINDOWS\system32\ctfmon.exe 840 C:\Program Files\Dell Photo Printer 720\dlbcserv.exe 2008 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 1092 C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe 1520 C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe 1668 C:\Documents and Settings\Marty Sellers\My Documents\RCA Detective\RCADetective.exe 3028 C:\WINDOWS\system32\wscntfy.exe 1888 alg.exe 168 C:\Program Files\Common Files\Java\Java Update\jucheck.exe 2056 wmiprvse.exe 1824 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe 1268 C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe 668 C:\Program Files\Common Files\Real\Update_OB\realsched.exe 3604 C:\Documents and Settings\Marty Sellers\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS) PhysicalDrive0 Model Number: HDS728080PLAT20, Rev: PF2OA27A Size Device Name MBR Status ——————————————– 74 GB \\.\PhysicalDrive0 Dell MBR code detected SHA1: 84B95CE8A54B7C5C3AAF149934FC46FB70FF8365 Done!
Post #6
Hi cortspop,

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
———-
Post #7
ComboFix 12-01-06.03 - Marty Sellers 01/07/2012 13:01:49.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.151 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Marty Sellers\Local Settings\Temporary Internet Files\pse_350_enu.exe
c:\documents and settings\Marty Sellers\WINDOWS
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\374bead6bc7f65dd.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\CF25248.exe
c:\windows\system32\regdacl
c:\windows\system32\regdacl\doc\RegAudit.GIF
c:\windows\system32\regdacl\doc\RegAudit_e.htm
c:\windows\system32\regdacl\doc\RegDACL.GIF
c:\windows\system32\regdacl\doc\RegDACL_el.htm
c:\windows\system32\regdacl\doc\RegDACL_er1.htm
c:\windows\system32\regdacl\doc\RegDACL_er2.htm
c:\windows\system32\regdacl\doc\RegDACL_er3.htm
c:\windows\system32\regdacl\doc\RegDACLe.htm
c:\windows\system32\regdacl\doc\RegLast_e.htm
c:\windows\system32\regdacl\doc\RegOwner.GIF
c:\windows\system32\regdacl\doc\RegOwner_e.htm
c:\windows\system32\regdacl\doc\SMWNCV.cmd
c:\windows\system32\regdacl\Freeware_en.txt
c:\windows\system32\regdacl\Orderinfo.htm
c:\windows\system32\regdacl\RegToolsHelp.htm
.
.
((((((((((((((((((((((((( Files Created from 2011-12-07 to 2012-01-07 )))))))))))))))))))))))))))))))
.
.
2012-01-07 18:01 . 2008-04-14 01:11 21504 —-a-w- c:\windows\system32\dllcache\hidserv.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2012-01-04 22:41 . 2012-01-04 22:46 ——– d—–w- c:\program files\QuickTime
2012-01-04 22:41 . 2012-01-04 22:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:25 . 2004-08-10 18:51 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2004-08-10 18:51 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-10 18:51 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-10 18:51 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-10 18:51 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-10 18:51 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-10 18:50 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33 . 2004-08-10 18:51 2192768 ——w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-04 04:59 2069376 ——w- c:\windows\system32\ntkrnlpa.exe
2011-10-24 20:29 . 2011-10-24 20:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 20:29 . 2011-10-24 20:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-10-18 11:13 . 2004-08-10 18:51 186880 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2004-08-10 19:02 692736 —-a-w- c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2011-11-30 17:17 1547104 —-a-w- c:\program files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll" [2011-11-30 1547104]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 102400]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"Easy Dock"="c:\documents and settings\Marty Sellers\My Documents\RCA easyRip\EZDock.exe" [2010-06-07 581632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"PaperPort PTD"="c:\progra~1\vision~1\paperp~1\pptd40nt.exe" [1999-04-13 29184]
"PP3100b"="c:\windows\twain_32\paprport\3100b\flatbed.exe" [1999-04-21 34304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SSP Notifier"="c:\program files\Fisher-Price\FP3 Player\sspnotifier.exe" [2006-04-13 20480]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"ISW.exe"="c:\program files\AT&T\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]
"HelpCenter4.1"="c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-13 198184]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-12-03 2415456]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-23 202256]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-16 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-11-30 827232]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
.
c:\documents and settings\Marty Sellers\Start Menu\Programs\Startup\
RCA Detective.lnk - c:\documents and settings\Marty Sellers\My Documents\RCA Detective\RCADetective.exe [2010-12-27 910848]
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2006-9-8 45056]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2005-12-24 315392]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-6-25 614531]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\6.1.4.37-7288971L\Program\runner.exe [2003-6-8 16432]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
2005-09-09 01:20 8192 —-a-w- c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\att-nap\\McciBrowser.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [9/13/2010 3:27 PM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/7/2010 2:48 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [9/7/2010 2:48 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/7/2010 2:49 AM 295248]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [8/19/2010 8:42 PM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [8/19/2010 8:42 PM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [8/19/2010 8:42 PM 16720]
S3 PCD5SRVC{FBEA8B78-1B22F121-05040000};PCD5SRVC{FBEA8B78-1B22F121-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~2\HWDiag\bin\PCD5SRVC.pkms [12/5/2007 3:47 PM 20640]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - ppsio2
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2012-01-07 c:\windows\Tasks\AVG PC Tuneup 2011 Integrator Start On Windows Logon.job
- c:\program files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe [2010-10-19 16:21]
.
2012-01-07 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-6957201-2821788724-1616382380-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
2012-01-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-6957201-2821788724-1616382380-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.weather.com/outlook/travel/businesstraveler/local/38834?lswe=38834&lwsa=WeatherLocalUndeclared&from=whatwhere
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search/msie?p={searchTerms}&ei=UTF-8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Webshots Photo Search - c:\program files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: taxactonline.com\www
Trusted Zone: musicmatch.com\online
TCP: DhcpNameServer = 192.168.1.254
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} - hxxp://www.mpix.com/customer/uploading/activex/ImageUploader6.cab
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-Easy Dock - (no file)
MSConfigStartUp-CTFMON - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-07 13:17
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCD5SRVC{FBEA8B78-1B22F121-05040000}]
"ImagePath"="\??\c:\progra~1\DELLSU~2\HWDiag\bin\PCD5SRVC.pkms"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2076)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-01-07 13:26:52
ComboFix-quarantined-files.txt 2012-01-07 19:26
.
Pre-Run: 53,903,470,592 bytes free
Post-Run: 53,864,980,480 bytes free
.
- - End Of File - - 2F44243FF83A8362A183C532560208A8
Post #8
Hi cortspop,

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
    DDS::
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
Trusted Zone: taxactonline.com\www
Trusted Zone: musicmatch.com\online
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #9
ComboFix 12-01-06.03 - Marty Sellers 01/07/2012 20:17:09.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.233 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Marty Sellers\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2011-12-08 to 2012-01-08 )))))))))))))))))))))))))))))))
.
.
2012-01-07 18:01 . 2008-04-14 01:11 21504 —-a-w- c:\windows\system32\hidserv.dll
2012-01-07 18:01 . 2008-04-14 01:11 21504 —-a-w- c:\windows\system32\dllcache\hidserv.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll
2012-01-04 22:46 . 2012-01-04 22:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll
2012-01-04 22:41 . 2012-01-04 22:46 ——– d—–w- c:\program files\QuickTime
2012-01-04 22:41 . 2012-01-04 22:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:25 . 2004-08-10 18:51 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2004-08-10 18:51 916992 —-a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-10 18:51 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-10 18:51 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-10 18:51 385024 —-a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-10 18:51 1288704 —-a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-10 18:50 33280 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:33 . 2004-08-10 18:51 2192768 ——w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-04 04:59 2069376 ——w- c:\windows\system32\ntkrnlpa.exe
2011-10-24 20:29 . 2011-10-24 20:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 20:29 . 2011-10-24 20:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-10-18 11:13 . 2004-08-10 18:51 186880 —-a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2004-08-10 19:02 692736 —-a-w- c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2011-11-30 17:17 1547104 —-a-w- c:\program files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll" [2011-11-30 1547104]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 102400]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"Easy Dock"="c:\documents and settings\Marty Sellers\My Documents\RCA easyRip\EZDock.exe" [2010-06-07 581632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"PaperPort PTD"="c:\progra~1\vision~1\paperp~1\pptd40nt.exe" [1999-04-13 29184]
"PP3100b"="c:\windows\twain_32\paprport\3100b\flatbed.exe" [1999-04-21 34304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SSP Notifier"="c:\program files\Fisher-Price\FP3 Player\sspnotifier.exe" [2006-04-13 20480]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"ISW.exe"="c:\program files\AT&T\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]
"HelpCenter4.1"="c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-13 198184]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-12-03 2415456]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-23 202256]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-16 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-11-30 827232]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
.
c:\documents and settings\Marty Sellers\Start Menu\Programs\Startup\
RCA Detective.lnk - c:\documents and settings\Marty Sellers\My Documents\RCA Detective\RCADetective.exe [2010-12-27 910848]
Webshots.lnk - c:\program files\Webshots\Launcher.exe [2006-9-8 45056]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2005-12-24 315392]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-6-25 614531]
KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\6.1.4.37-7288971L\Program\runner.exe [2003-6-8 16432]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
2005-09-09 01:20 8192 —-a-w- c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\att-nap\\McciBrowser.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [9/13/2010 3:27 PM 23120]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/7/2010 2:48 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [9/7/2010 2:48 AM 230608]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/7/2010 2:49 AM 295248]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 5:09 AM 192776]
R2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe [11/30/2011 11:17 AM 855904]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [8/19/2010 8:42 PM 134608]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [8/19/2010 8:42 PM 24272]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [8/19/2010 8:42 PM 16720]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 5:25 AM 4433248]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [4/15/2011 4:55 AM 1025352]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 6:49 AM 227232]
S3 PCD5SRVC{FBEA8B78-1B22F121-05040000};PCD5SRVC{FBEA8B78-1B22F121-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~2\HWDiag\bin\PCD5SRVC.pkms [12/5/2007 3:47 PM 20640]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - ppsio2
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2012-01-07 c:\windows\Tasks\AVG PC Tuneup 2011 Integrator Start On Windows Logon.job
- c:\program files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe [2010-10-19 16:21]
.
2012-01-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-6957201-2821788724-1616382380-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
2012-01-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-6957201-2821788724-1616382380-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.weather.com/outlook/travel/businesstraveler/local/38834?lswe=38834&lwsa=WeatherLocalUndeclared&from=whatwhere
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search/msie?p={searchTerms}&ei=UTF-8
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Webshots Photo Search - c:\program files\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.1.254
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} - hxxp://www.mpix.com/customer/uploading/activex/ImageUploader6.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-07 20:33
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCD5SRVC{FBEA8B78-1B22F121-05040000}]
"ImagePath"="\??\c:\progra~1\DELLSU~2\HWDiag\bin\PCD5SRVC.pkms"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(2996)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-01-07 20:39:26
ComboFix-quarantined-files.txt 2012-01-08 02:39
ComboFix2.txt 2012-01-07 19:26
.
Pre-Run: 53,852,753,920 bytes free
Post-Run: 53,859,164,160 bytes free
.
- - End Of File - - 6104CC4D03F72B766EC434F228296CC1
Post #10
Hi cortspop,

I see that you have Malwarebytes on your system. Please open Malwarebytes, update it and then run a Quick Scan. Please save the log that is created for your next reply.
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/
———-

In your next reply please post the logs created by Malwarebytes and ESET online scanner. :)
Post #11
Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.08.03 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Marty Sellers :: SELLERS [administrator] 1/8/2012 11:15:39 AM mbam-log-2012-01-08 (11-15-39).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 195962 Time elapsed: 22 minute(s), 50 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Neither scan found anything.
Post #14

Seems to be operating much better.

Great! :)
———–

P2P - I see you have P2P software LimeWire 5.1.2 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly Identity Theft. It likely contributed to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.
———-


You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 9.4.7 first. Be sure to move any PDF documents to another folder first though.
———-

Please download JavaRa to your desktop and unzip it to its own
folder
  • Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
    click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
    Java Runtime Environment (JRE) version for your computer.
———-

Please run a new scan with DDS and post the new logs into your next reply. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI