What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Startpins [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi there, I have been searching the web for a while looking for useful information on Startpins, especially about how to get rid of it! There seems to be a lot of bogus information out there with ads for buying anti-malware programmes. I would be greatful for any help as my laptop is running slower everytime and from what I hear this is not a very benign programme. This is from DDS.txt: . DDS (Ver_11-03-05.01) - NTFSx86 Run by [removed] at 11:56:56,14 on 01.11.2012 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_37 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1526.521 [GMT 0:00] . AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\spoolsv.exe C:\Program Files\SUPERAntiSpyware\SASCORE.EXE C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\Expat Shield\bin\openvpnas.exe C:\Program Files\Expat Shield\HssWPR\hsssrv.exe C:\Program Files\Expat Shield\bin\hsswd.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\WinPcap\rpcapd.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe C:\Program Files\AVG\AVG2012\avgnsx.exe C:\Program Files\AVG\AVG2012\avgemcx.exe C:\Program Files\AVG\AVG2012\avgrsx.exe C:\Program Files\AVG\AVG2012\avgcsrvx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe svchost.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe C:\Program Files\Evernote\Evernote\EvernoteClipper.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Application Data\Spotify\Data\SpotifyWebHelper.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\IObit\Advanced SystemCare 5\Asc.exe C:\Program Files\Browsers Protector\regmon32.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\dds (1).scr . ============== Pseudo HJT Report =============== . uStart Page = hxxp://startsear.ch/?aff=1&cf=a1614402-ec3d-11e0-b9e2-00155829778b mStart Page = hxxp://startsear.ch/?aff=1&cf=a1614402-ec3d-11e0-b9e2-00155829778b BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AVG Do Not Track: {31332eef-cb9f-458f-afeb-d30e9a66b6ba} - c:\program files\avg\avg2012\avgdtiex.dll BHO: Expat Shield Class: {3706ee7c-3cad-445d-8a43-03ebc3b75908} - c:\program files\expat shield\hssie\ExpatIE.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - IE5BarLauncherBHO Class BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uRun: [Advanced SystemCare 5] "c:\program files\iobit\advanced systemcare 5\ASCTray.exe" /AutoStart uRun: [Google Update] "c:\documents and settings\lewis.daisy-a189183ee\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe" mRun: [InstaLAN] "c:\program files\belkin\router setup and monitor\BelkinRouterMonitor.exe" startup mRun: [Browsers Protector] c:\program files\browsers protector\regmon32.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\lewis~1.dai\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe IE: Add to Evernote 4.0 - c:\program files\evernote\evernote\EvernoteIE.dll/204 IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\program files\evernote\evernote\EvernoteIE.dll/204 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\avg\avg2012\avgdtiex.dll DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1348601093078 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 31952] R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-10-10 14776] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-7-10 237408] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 41040] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-10 301920] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664] R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2012-7-11 116608] R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\iobit\advanced systemcare 5\ASCService.exe [2012-1-23 913792] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\avgidsagent.exe [2012-8-13 5167736] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2012-2-14 193288] R2 ExpatShieldService;Expat Shield Service;c:\program files\expat shield\bin\openvpnas.exe [2012-1-6 331608] R2 ExpatSrv;Expat Shield Routing Service;c:\program files\expat shield\hsswpr\hsssrv.exe [2012-1-4 363336] R2 ExpatWd;Expat Shield Monitoring Service;c:\program files\expat shield\bin\hsswd.exe -product expat –> c:\program files\expat shield\bin\hsswd.exe -product Expat [?] R2 Iprip;RIP Listener;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336] R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2011-12-16 32512] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 139856] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232] R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [2010-7-8 606056] S3 ExpatTrayService;Expat Shield Tray Service;c:\program files\expat shield\bin\ExpatTrayService.exe [2012-1-6 77520] S3 FsUsbExDisk;FsUsbExDisk;\??\c:\windows\system32\fsusbexdisk.sys –> c:\windows\system32\FsUsbExDisk.SYS [?] S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [2011-4-28 89256] S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [2011-4-28 15016] S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [2011-4-28 120744] S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [2011-4-28 114216] S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [2011-4-28 25512] S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [2011-4-28 110632] S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [2011-4-28 115752] S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [2011-2-2 98560] S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [2011-2-2 14848] S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [2011-2-2 123648] S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\system32\drivers\tascusb2.sys [2011-1-27 360448] S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device;c:\windows\system32\drivers\tscusb2m.sys [2011-1-27 18944] S3 TASCAM_US122L_WDM;TASCAM US-122L WDM;c:\windows\system32\drivers\tscusb2a.sys [2011-1-27 33792] . =============== Created Last 30 ================ . 2012-11-01 11:18:01 ——– d—–w- c:\docume~1\lewis~1.dai\applic~1\DriverCure 2012-11-01 11:17:59 ——– d—–w- c:\docume~1\lewis~1.dai\applic~1\SpeedyPC Software 2012-11-01 11:17:45 ——– d—–w- c:\program files\common files\SpeedyPC Software 2012-11-01 11:17:42 ——– d—–w- c:\program files\SpeedyPC Software 2012-11-01 11:17:42 ——– d—–w- c:\docume~1\alluse~1.win\applic~1\SpeedyPC Software 2012-10-31 20:08:40 75045 —-a-w- c:\windows\system32\d209bc1e.exe 2012-10-31 20:08:19 ——– d—–w- c:\program files\Browsers Protector 2012-10-31 20:08:08 ——– d—–w- c:\program files\StartSearch plugin 2012-10-27 23:09:23 ——– d—–w- c:\program files\Avalanche 2012-10-27 22:39:32 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-10-11 23:28:47 ——– d—–w- c:\docume~1\lewis~1.dai\locals~1\applic~1\Spotify 2012-10-11 23:28:15 ——– d—–w- c:\docume~1\lewis~1.dai\applic~1\Spotify 2012-10-09 16:26:21 ——– d—–w- c:\program files\Spybot - Search & Destroy 2012-10-09 16:26:21 ——– d—–w- c:\docume~1\alluse~1.win\applic~1\Spybot - Search & Destroy . ==================== Find3M ==================== . 2012-10-27 22:39:32 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-09-24 14:32:24 477168 —-a-w- c:\windows\system32\npdeployJava1.dll 2012-09-24 14:32:20 473072 —-a-w- c:\windows\system32\deployJava1.dll 2012-09-24 12:51:47 73728 —-a-w- c:\windows\system32\javacpl.cpl 2012-08-30 20:29:36 81920 —-a-w- c:\windows\system32\ieencode.dll 2012-08-30 20:29:36 667136 —-a-w- c:\windows\system32\wininet.dll 2012-08-30 20:29:36 61952 —-a-w- c:\windows\system32\tdc.ocx 2012-08-28 13:00:25 369664 —-a-w- c:\windows\system32\html.iec 2012-08-24 13:53:22 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-08-21 13:29:19 2192896 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-08-21 12:58:06 2069632 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-03-30 09:40:34 517976 —-a-w- c:\program files\DXSETUP.exe 2011-03-30 09:40:32 95576 —-a-w- c:\program files\DSETUP.dll 2011-03-30 09:40:32 1566040 —-a-w- c:\program files\dsetup32.dll . ============= FINISH: 11:58:06,17 =============== Thanks so much. Lewis
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • If you are asked to update the Avast Virus database please allow it to do so.
  • When it finishes, press the save log button, save the logfile to your desktop and attach its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-
Post #3
Hi Jeff, thanks for your help! I have run the aswMBR and below you will see the logfile contents….just a quick question, would you be able to tell me what exactly this Startpins thing is? What does it do and why is such a lengthy procedure required to get rid of it? aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-11-02 09:47:55 —————————– 09:47:55.500 OS Version: Windows 5.1.2600 Service Pack 3 09:47:55.500 Number of processors: 1 586 0xD08 09:47:55.500 ComputerName: DAISY-A189183EE UserName: Lewis 09:47:56.656 Initialize success 09:51:01.906 AVAST engine defs: 12110200 09:51:33.062 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 09:51:33.062 Disk 0 Vendor: HTS541060G9AT00 MB3IA60A Size: 57231MB BusType: 3 09:51:33.078 Disk 0 MBR read successfully 09:51:33.078 Disk 0 MBR scan 09:51:33.171 Disk 0 Windows XP default MBR code 09:51:33.171 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 53030 MB offset 63 09:51:33.203 Disk 0 Partition 2 00 12 Compaq diag MSWIN4.1 4193 MB offset 108606960 09:51:33.203 Disk 0 scanning sectors +117195120 09:51:33.296 Disk 0 scanning C:\WINDOWS\system32\drivers 09:51:53.625 Service scanning 09:52:25.312 Modules scanning 09:52:31.953 Disk 0 trace - called modules: 09:52:31.968 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 09:52:31.968 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89fcfab8] 09:52:31.968 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\0000008b[0x8a0079e8] 09:52:31.968 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a01e940] 09:52:32.765 AVAST engine scan C:\WINDOWS 09:52:38.781 AVAST engine scan C:\WINDOWS\system32 09:57:51.437 AVAST engine scan C:\WINDOWS\system32\drivers 09:58:13.328 AVAST engine scan C:\Documents and Settings\Lewis.DAISY-A189183EE 10:21:38.796 AVAST engine scan C:\Documents and Settings\All Users.WINDOWS 10:23:46.359 Scan finished successfully 10:25:30.421 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Lewis.DAISY-A189183EE\Desktop\MBR.dat" 10:25:30.437 The log file has been saved successfully to "C:\Documents and Settings\Lewis.DAISY-A189183EE\Desktop\aswMBR.txt" Thanks! Lewis
Post #4
Hi,

Basically Startpins is a type of web browser that will try to insert itself into your system just everywhere and if you don't remove all of it at once it will come back….like a weed. It is not a lengthy process but we should be sure that it did not pull anything else onto your system in the meantime. :)
———-

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
4. If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.
———-
Post #5
Hi Jeff. Here is the log file content:

ComboFix 12-11-02.02 - Lewis 03.11.2012 12:20:48.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1526.1124 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\LEWIS~1.DAI\LOCALS~1\Temp\1.tmp\F_IN_BOX.dll
c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Temp\1.tmp\F_IN_BOX.dll
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Eigene Musik\50s\Johnny Cash\johnny cash's greatest hits, vol. 1\_desktop.ini
c:\program files\StartSearch plugin
c:\program files\StartSearch plugin\IEhelperActiveX.dll
c:\program files\StartSearch plugin\startsplg.crx
c:\program files\StartSearch plugin\uninst.exe
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\d209bc1e.exe
c:\windows\system32\drivers\etc\lmhosts
c:\windows\system32\drivers\npf.sys
c:\windows\system32\muzapp.exe
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\SET2B1.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_NPF
——-\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2012-10-03 to 2012-11-03 )))))))))))))))))))))))))))))))
.
.
2012-11-01 11:18 . 2012-11-01 11:18 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\DriverCure
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\program files\Common Files\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\program files\SpeedyPC Software
2012-10-31 20:08 . 2012-10-31 20:08 ——– d—–w- c:\program files\Browsers Protector
2012-10-31 01:04 . 2012-10-31 01:06 ——– d—–w- c:\program files\Google
2012-10-27 23:09 . 2012-10-27 23:09 ——– d—–w- c:\program files\Avalanche
2012-10-27 22:39 . 2012-10-27 22:39 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-17 08:17 . 2012-10-17 08:23 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\U3
2012-10-11 23:28 . 2012-10-28 21:42 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Spotify
2012-10-11 23:28 . 2012-10-28 21:12 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify
2012-10-09 16:26 . 2012-10-18 10:02 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2012-10-09 16:26 . 2012-10-09 16:26 ——– d—–w- c:\program files\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-27 22:39 . 2011-09-18 14:32 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-24 14:32 . 2012-09-24 23:10 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 14:32 . 2011-12-08 10:08 473072 —-a-w- c:\windows\system32\deployJava1.dll
2012-09-24 12:51 . 2012-09-24 23:10 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-08-30 20:29 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2012-08-30 20:29 . 2004-08-04 12:00 667136 —-a-w- c:\windows\system32\wininet.dll
2012-08-30 20:29 . 2004-08-04 12:00 61952 —-a-w- c:\windows\system32\tdc.ocx
2012-08-28 13:00 . 2004-08-04 12:00 369664 —-a-w- c:\windows\system32\html.iec
2012-08-24 14:43 . 2011-07-10 23:14 301920 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2012-08-24 13:53 . 2004-08-04 12:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:29 . 2004-08-04 12:00 2192896 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-03 22:59 2069632 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-03-30 09:40 . 2011-03-30 09:40 517976 —-a-w- c:\program files\DXSETUP.exe
2011-03-30 09:40 . 2011-03-30 09:40 95576 —-a-w- c:\program files\DSETUP.dll
2011-03-30 09:40 . 2011-03-30 09:40 1566040 —-a-w- c:\program files\dsetup32.dll
2012-10-27 08:54 . 2012-10-27 08:54 261600 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]
2012-01-04 23:02 233288 —-a-w- c:\program files\Expat Shield\HssIE\ExpatIE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-10-27 4762496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 561152]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-03-17 1141144]
"Browsers Protector"="c:\program files\Browsers Protector\regmon32.exe" [2012-07-06 207360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2012-10-27 22:36 7901144 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2012-10-27 22:35 1199576 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-09-17 11:41 254896 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Documents and Settings\\Lewis.DAISY-A189183EE\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\SoulseekQt\\SoulseekQt.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Lewis.DAISY-A189183EE\\Application Data\\Spotify\\spotify.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19.04.2012 02:50 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [13.09.2011 04:30 31952]
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [10.10.2011 07:47 14776]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10.07.2011 23:13 237408]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [10.07.2011 23:14 301920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22.07.2011 16:27 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.07.2011 21:55 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [11.07.2012 18:54 116608]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [23.01.2012 17:11 913792]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [13.08.2012 02:24 5167736]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [14.02.2012 02:53 193288]
R2 ExpatShieldService;Expat Shield Service;c:\program files\Expat Shield\bin\openvpnas.exe [06.01.2012 18:32 331608]
R2 ExpatSrv;Expat Shield Routing Service;c:\program files\Expat Shield\HssWPR\hsssrv.exe [04.01.2012 23:01 363336]
R2 ExpatWd;Expat Shield Monitoring Service;c:\program files\Expat Shield\bin\hsswd.exe -product Expat –> c:\program files\Expat Shield\bin\hsswd.exe -product Expat [?]
R2 Iprip;RIP Listener;c:\windows\System32\svchost.exe -k netsvcs [04.08.2004 12:00 14336]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23.12.2011 11:32 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [23.12.2011 11:32 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23.12.2011 11:32 17232]
R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [08.07.2010 14:09 606056]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [29.02.2012 06:50 158856]
S3 ExpatTrayService;Expat Shield Tray Service;c:\program files\Expat Shield\bin\ExpatTrayService.exe [06.01.2012 18:39 77520]
S3 FsUsbExDisk;FsUsbExDisk;\??\c:\windows\system32\FsUsbExDisk.SYS –> c:\windows\system32\FsUsbExDisk.SYS [?]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [28.04.2011 07:28 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [28.04.2011 07:28 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [28.04.2011 07:28 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [28.04.2011 07:28 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [28.04.2011 07:28 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [28.04.2011 07:28 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [28.04.2011 07:28 115752]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [02.02.2011 18:40 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [02.02.2011 18:40 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [02.02.2011 18:40 123648]
S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\system32\drivers\tascusb2.sys [27.01.2011 20:00 360448]
S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device;c:\windows\system32\drivers\tscusb2m.sys [27.01.2011 20:00 18944]
S3 TASCAM_US122L_WDM;TASCAM US-122L WDM;c:\windows\system32\drivers\tscusb2a.sys [27.01.2011 20:00 33792]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-31 01:04]
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-31 01:04]
.
2012-11-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-2025429265-839522115-1003Core.job
- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-05-07 12:57]
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-2025429265-839522115-1003UA.job
- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-05-07 12:57]
.
2012-11-01 c:\windows\Tasks\SpeedyPC Pro.job
- c:\program files\SpeedyPC Software\SpeedyPC\SpeedyPC.exe [2012-10-04 20:42]
.
2012-11-02 c:\windows\Tasks\SpeedyPC Registration3.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\UUS3.dll [2012-10-04 20:42]
.
2012-11-03 c:\windows\Tasks\SpeedyPC Update Version3 Startup Task.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2012-10-04 20:42]
.
2012-11-01 c:\windows\Tasks\SpeedyPC Update Version3.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2012-10-04 20:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://startsear.ch/?aff=1&cf;=a1614402-ec3d-11e0-b9e2-00155829778b
mStart Page = hxxp://startsear.ch/?aff=1&cf;=a1614402-ec3d-11e0-b9e2-00155829778b
IE: Add to Evernote 4.0 - c:\program files\Evernote\Evernote\EvernoteIE.dll/204
TCP: DhcpNameServer = [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-d209bc1e - c:\windows\system32\d209bc1e.exe
AddRemove-StartSearch Toolbar - c:\program files\StartSearch plugin\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-03 12:34
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1632)
c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Expat Shield\bin\hsswd.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgemcx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\tcpsvcs.exe
c:\program files\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinSetup.exe
c:\program files\Belkin\Router Setup and Monitor\ndis_events.exe
.
**************************************************************************
.
Completion time: 2012-11-03 12:40:32 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-03 12:40
.
Pre-Run: 1.249.005.568 bytes free
Post-Run: 882.503.680 bytes free
.
- - End Of File - - 01528FC1A09DA8472E6954BCB6827FD5


thanks…
Post #6
Hi,
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:


    ClearJavaCache::

    DDS::
    uStart Page = hxxp://startsear.ch/?aff=1&cf=a1614402-ec3d-11e0-b9e2-00155829778b
    mStart Page = hxxp://startsear.ch/?aff=1&cf=a1614402-ec3d-11e0-b9e2-00155829778b
    BHO: Expat Shield Class: {3706ee7c-3cad-445d-8a43-03ebc3b75908} - c:\program files\expat shield\hssie\ExpatIE.dll
    BHO: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - IE5BarLauncherBHO Class
    uRun: [Advanced SystemCare 5] "c:\program files\iobit\advanced systemcare 5\ASCTray.exe" /AutoStart

    File::
    C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
    C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
    C:\Program Files\IObit\Advanced SystemCare 5\Asc.exe
    c:\program files\iobit\advanced systemcare 5\ASCService.exe

    Driver::
    AdvancedSystemCareService5

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Post the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Please post the new ComboFix log and let me know how your system is running now. :)
Post #7
Hi Jeff, did what you recommended. Below is the new log file. When starting firefox (the troubled browser) it somehow didn't start properly, and when it did at least Startpins was no longer the startpage. I ran a quick upgrade to the newest version of firefox, and now it seems fine. What does the log tell us?

ComboFix 12-11-03.02 - Lewis 03.11.2012 18:28:32.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1526.1133 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Lewis.DAISY-A189183EE\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\program files\IObit\Advanced SystemCare 5\Asc.exe"
"c:\program files\iobit\advanced systemcare 5\ASCService.exe"
"c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_ADVANCEDSYSTEMCARESERVICE5
——-\Service_AdvancedSystemCareService5
.
.
((((((((((((((((((((((((( Files Created from 2012-10-03 to 2012-11-03 )))))))))))))))))))))))))))))))
.
.
2012-11-01 11:18 . 2012-11-01 11:18 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\DriverCure
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\program files\Common Files\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\program files\SpeedyPC Software
2012-10-31 20:08 . 2012-10-31 20:08 ——– d—–w- c:\program files\Browsers Protector
2012-10-31 01:04 . 2012-10-31 01:06 ——– d—–w- c:\program files\Google
2012-10-27 23:09 . 2012-10-27 23:09 ——– d—–w- c:\program files\Avalanche
2012-10-27 22:39 . 2012-10-27 22:39 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-17 08:17 . 2012-10-17 08:23 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\U3
2012-10-11 23:28 . 2012-10-28 21:42 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Spotify
2012-10-11 23:28 . 2012-10-28 21:12 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify
2012-10-09 16:26 . 2012-10-18 10:02 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2012-10-09 16:26 . 2012-10-09 16:26 ——– d—–w- c:\program files\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-27 22:39 . 2011-09-18 14:32 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-24 14:32 . 2012-09-24 23:10 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-09-24 14:32 . 2011-12-08 10:08 473072 —-a-w- c:\windows\system32\deployJava1.dll
2012-09-24 12:51 . 2012-09-24 23:10 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-08-30 20:29 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2012-08-30 20:29 . 2004-08-04 12:00 667136 —-a-w- c:\windows\system32\wininet.dll
2012-08-30 20:29 . 2004-08-04 12:00 61952 —-a-w- c:\windows\system32\tdc.ocx
2012-08-28 13:00 . 2004-08-04 12:00 369664 —-a-w- c:\windows\system32\html.iec
2012-08-24 14:43 . 2011-07-10 23:14 301920 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2012-08-24 13:53 . 2004-08-04 12:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:29 . 2004-08-04 12:00 2192896 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-03 22:59 2069632 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-03-30 09:40 . 2011-03-30 09:40 517976 —-a-w- c:\program files\DXSETUP.exe
2011-03-30 09:40 . 2011-03-30 09:40 95576 —-a-w- c:\program files\DSETUP.dll
2011-03-30 09:40 . 2011-03-30 09:40 1566040 —-a-w- c:\program files\dsetup32.dll
2012-10-27 08:54 . 2012-10-27 08:54 261600 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-10-27 4762496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 561152]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-03-17 1141144]
"Browsers Protector"="c:\program files\Browsers Protector\regmon32.exe" [2012-07-06 207360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2012-10-27 22:36 7901144 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2012-10-27 22:35 1199576 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-09-17 11:41 254896 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Documents and Settings\\Lewis.DAISY-A189183EE\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\SoulseekQt\\SoulseekQt.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Lewis.DAISY-A189183EE\\Application Data\\Spotify\\spotify.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19.04.2012 02:50 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [13.09.2011 04:30 31952]
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [10.10.2011 07:47 14776]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10.07.2011 23:13 237408]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [10.07.2011 23:14 301920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22.07.2011 16:27 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.07.2011 21:55 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [11.07.2012 18:54 116608]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [13.08.2012 02:24 5167736]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [14.02.2012 02:53 193288]
R2 ExpatShieldService;Expat Shield Service;c:\program files\Expat Shield\bin\openvpnas.exe [06.01.2012 18:32 331608]
R2 ExpatSrv;Expat Shield Routing Service;c:\program files\Expat Shield\HssWPR\hsssrv.exe [04.01.2012 23:01 363336]
R2 ExpatWd;Expat Shield Monitoring Service;c:\program files\Expat Shield\bin\hsswd.exe -product Expat –> c:\program files\Expat Shield\bin\hsswd.exe -product Expat [?]
R2 Iprip;RIP Listener;c:\windows\System32\svchost.exe -k netsvcs [04.08.2004 12:00 14336]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23.12.2011 11:32 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [23.12.2011 11:32 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23.12.2011 11:32 17232]
R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [08.07.2010 14:09 606056]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [29.02.2012 06:50 158856]
S3 ExpatTrayService;Expat Shield Tray Service;c:\program files\Expat Shield\bin\ExpatTrayService.exe [06.01.2012 18:39 77520]
S3 FsUsbExDisk;FsUsbExDisk;\??\c:\windows\system32\FsUsbExDisk.SYS –> c:\windows\system32\FsUsbExDisk.SYS [?]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [28.04.2011 07:28 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [28.04.2011 07:28 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [28.04.2011 07:28 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [28.04.2011 07:28 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [28.04.2011 07:28 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [28.04.2011 07:28 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [28.04.2011 07:28 115752]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [02.02.2011 18:40 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [02.02.2011 18:40 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [02.02.2011 18:40 123648]
S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\system32\drivers\tascusb2.sys [27.01.2011 20:00 360448]
S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device;c:\windows\system32\drivers\tscusb2m.sys [27.01.2011 20:00 18944]
S3 TASCAM_US122L_WDM;TASCAM US-122L WDM;c:\windows\system32\drivers\tscusb2a.sys [27.01.2011 20:00 33792]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-31 01:04]
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-31 01:04]
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-2025429265-839522115-1003Core.job
- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-05-07 12:57]
.
2012-11-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-2025429265-839522115-1003UA.job
- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-05-07 12:57]
.
2012-11-01 c:\windows\Tasks\SpeedyPC Pro.job
- c:\program files\SpeedyPC Software\SpeedyPC\SpeedyPC.exe [2012-10-04 20:42]
.
2012-11-03 c:\windows\Tasks\SpeedyPC Registration3.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\UUS3.dll [2012-10-04 20:42]
.
2012-11-03 c:\windows\Tasks\SpeedyPC Update Version3 Startup Task.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2012-10-04 20:42]
.
2012-11-01 c:\windows\Tasks\SpeedyPC Update Version3.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2012-10-04 20:42]
.
.
——- Supplementary Scan ——-
.
IE: Add to Evernote 4.0 - c:\program files\Evernote\Evernote\EvernoteIE.dll/204
TCP: DhcpNameServer = [removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-03 18:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1176)
c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ibmpmsvc.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
c:\program files\Expat Shield\bin\hsswd.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\tcpsvcs.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgemcx.exe
c:\program files\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\program files\Belkin\Router Setup and Monitor\BelkinSetup.exe
c:\program files\Belkin\Router Setup and Monitor\ndis_events.exe
.
**************************************************************************
.
Completion time: 2012-11-03 18:48:58 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-03 18:48
ComboFix2.txt 2012-11-03 12:40
.
Pre-Run: 953.507.840 bytes free
Post-Run: 940.167.168 bytes free
.
- - End Of File - - 35767F57E50A305D4A92D3AE78D5B79A
Post #8
Looking better. :) When you ran DDS the first time there should have been a log created named Attach.txt. Could you post that please? If you don't have it, just run DDS again and there will be a new one created.
Post #9
Yup. . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-10-19.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 27.01.2011 13:50:06 System Uptime: 03.11.2012 18:38:24 (6 hours ago) . Motherboard: IBM | | 1871WMJ Processor: Intel® Pentium® M processor 1.86GHz | None | 797/533mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 52 GiB total, 0,829 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: PCI Modem Device ID: PCI\VEN_8086&DEV;_266D&SUBSYS;_05741014&REV;_03\3&B1BFB68;&0&F3; Manufacturer: Name: PCI Modem PNP Device ID: PCI\VEN_8086&DEV;_266D&SUBSYS;_05741014&REV;_03\3&B1BFB68;&0&F3; Service: . Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Device ID: ACPI\NSC1100\4&3863886D&0 Manufacturer: Name: PNP Device ID: ACPI\NSC1100\4&3863886D&0 Service: . ==== System Restore Points =================== . RP344: 28.09.2012 19:20:21 - Installed %1 %2. RP345: 28.09.2012 19:25:07 - Installed Windows XP KB2492386. RP346: 30.09.2012 03:29:14 - System Checkpoint RP347: 30.09.2012 22:08:48 - Evernote v. 4.5.8 wird installiert RP348: 05.10.2012 11:19:37 - System Checkpoint RP349: 06.10.2012 14:59:54 - System Checkpoint RP350: 08.10.2012 17:19:10 - System Checkpoint RP351: 10.10.2012 15:52:31 - System Checkpoint RP352: 11.10.2012 10:47:00 - Software Distribution Service 3.0 RP353: 12.10.2012 13:12:53 - System Checkpoint RP354: 13.10.2012 13:28:46 - System Checkpoint RP355: 14.10.2012 17:38:03 - System Checkpoint RP356: 16.10.2012 10:27:36 - System Checkpoint RP357: 17.10.2012 16:34:32 - System Checkpoint RP358: 19.10.2012 12:24:32 - System Checkpoint RP359: 20.10.2012 14:06:16 - System Checkpoint RP360: 21.10.2012 14:58:42 - System Checkpoint RP361: 23.10.2012 09:16:08 - System Checkpoint RP362: 24.10.2012 09:28:56 - System Checkpoint RP363: 25.10.2012 09:32:35 - System Checkpoint RP364: 25.10.2012 23:37:16 - Java™ 6 Update 37 wird installiert RP365: 27.10.2012 11:48:46 - System Checkpoint RP366: 28.10.2012 00:10:03 - Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 RP367: 28.10.2012 00:12:27 - OpenOffice.org 3.4.1 wird installiert RP368: 31.10.2012 18:42:04 - System Checkpoint RP369: 01.11.2012 22:12:26 - System Checkpoint RP370: 03.11.2012 11:59:14 - ComboFix created restore point . ==== Installed Programs ====================== . Ableton Live v7.0.2 Adobe AIR Adobe Flash Player 11 Plugin Adobe Reader X (10.1.4) - Deutsch Advanced SystemCare 5 AiO_Scan_CDA AiOSoftwareNPI Auslogics Registry Cleaner Avanquest update AVG 2012 Belkin Setup and Router Monitor Belkin USB Wireless Adaptor Brother's Keeper 6.4 Browsers Protector BufferChm C5100 c5100_Help CP_CalendarTemplates1 cp_OnlineProjectsConfig CP_Package_Basic1 CP_Panorama1Config cp_PosterPrintConfig CueTour CustomerResearchQFolder Defraggler Destinations DeviceManagementQFolder DocProc DocProcQFolder DocumentViewer DocumentViewerQFolder Dropbox eSupportQFolder Evernote v. 4.5.8 Expat Shield 2.24 Facebook Video Calling 1.2.0.159 Fax_CDA Free WAV to MP3 Converter FullDPAppQFolder Google Chrome Google Earth Plug-in Google Update Helper Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB2756822) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB981793) HP Customer Participation Program 7.0 HP Document Viewer 7.0 HP Imaging Device Functions 7.0 HP Photosmart Premier Software 6.5 HP Photosmart, Officejet and Deskjet 7.0.A HP Software Update HP Solution Center 7.0 HPPhotoSmartExpress HPProductAssistant IBM ThinkPad Power Management Driver IBM ThinkPad UltraNav Driver InstantShareDevices InstantShareDevicesMFC Java Auto Updater Java™ 6 Update 37 MarketResearch Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB2656370) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 16.0.2 (x86 en-GB) Mozilla Maintenance Service MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 6 Service Pack 2 (KB973686) NewCopy_CDA OCR Software by I.R.I.S 7.0 OpenOffice.org 3.4.1 PanoStandAlone PDFCreator PhotoGallery ProductContextNPI RandMap Readme SAMSUNG USB Driver for Mobile Phones Scan ScannerCopy Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft Windows (KB2564958) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player (KB979402) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2544521) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2655992) Security Update for Windows XP (KB2659262) Security Update for Windows XP (KB2661637) Security Update for Windows XP (KB2676562) Security Update for Windows XP (KB2686509) Security Update for Windows XP (KB2691442) Security Update for Windows XP (KB2698365) Security Update for Windows XP (KB2705219) Security Update for Windows XP (KB2707511) Security Update for Windows XP (KB2712808) Security Update for Windows XP (KB2719985) Security Update for Windows XP (KB2723135) Security Update for Windows XP (KB2724197) Security Update for Windows XP (KB2731847) Security Update for Windows XP (KB2744842) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982381) Security Update for Windows XP (KB982665) SkinsHP1 Skype™ 5.8 SlideShow Smart Defrag 2 SolutionCenter Sonic_PrimoSDK SopCast 3.2.4 SoulSeek Client 156c SoulseekQt SpeedyPC Pro Spotify Spybot - Search & Destroy Status Streaky SUPERAntiSpyware TeamViewer 7 Toolbox TrayApp Unload Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows XP (KB2345886) Update for Windows XP (KB2492386) Update for Windows XP (KB2661254-v2) Update for Windows XP (KB2718704) Update for Windows XP (KB2736233) Update for Windows XP (KB2749655) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) US-122L / US-144 driver Veetle TV 0.9.18 VLC media player 1.1.7 WebFldrs XP WebReg Winamp Windows Driver Package - Intel hdc (02/05/2007 8.3.0.1016) Windows Driver Package - Intel hdc (02/25/2008 9.0.0.1005) Windows Driver Package - Intel hdc (06/28/2008 9.1.1.1003) Windows Driver Package - Intel hdc (09/25/2007 8.3.0.1016) Windows Driver Package - Intel hdc (11/15/2006 8.2.0.1011) Windows Driver Package - Intel System (01/10/2005 7.0.0.1011) Windows Driver Package - Intel System (01/13/2007 8.3.0.1008) Windows Driver Package - Intel System (01/15/2008 1.3.00.0) Windows Driver Package - Intel System (02/06/2007 8.3.0.1011) Windows Driver Package - Intel System (02/20/2008 8.6.0.1002) Windows Driver Package - Intel System (02/20/2008 8.6.1.1002) Windows Driver Package - Intel System (02/22/2006 8.1.0.1002) Windows Driver Package - Intel System (02/25/2008 9.0.0.1005) Windows Driver Package - Intel System (03/09/2006 7.3.0.1013) Windows Driver Package - Intel System (03/10/2005 7.0.0.1019) Windows Driver Package - Intel System (03/25/2004 5.1.0.1009) Windows Driver Package - Intel System (04/10/2006 8.0.0.1008) Windows Driver Package - Intel System (04/16/2007 8.4.0.1011) Windows Driver Package - Intel System (04/30/2008 8.6.1.1002) Windows Driver Package - Intel System (05/01/2007 8.4.0.1013) Windows Driver Package - Intel System (05/18/2007 8.3.1.1005) Windows Driver Package - Intel System (05/23/2005 7.1.0.1011) Windows Driver Package - Intel System (05/26/2004 6.1.0.1008) Windows Driver Package - Intel System (05/27/2008 9.0.0.1009) Windows Driver Package - Intel System (06/28/2008 9.1.0.1003) Windows Driver Package - Intel System (07/30/2008 9.1.0.1005) Windows Driver Package - Intel System (08/14/2008 1.2.67.0) Windows Driver Package - Intel System (08/25/2003 5.1.0.1006) Windows Driver Package - Intel System (08/31/2007 8.3.0.1016) Windows Driver Package - Intel System (09/13/2005 7.2.2.1001) Windows Driver Package - Intel System (10/11/2002 4.20.1007) Windows Driver Package - Intel System (10/19/2007 8.3.1.1005) Windows Driver Package - Intel System (10/19/2007 8.5.0.1007) Windows Driver Package - Intel System (12/11/2007 8.4.0.1018) Windows Driver Package - Intel USB (02/05/2007 8.3.0.1011) Windows Driver Package - Intel USB (02/25/2008 9.0.0.1005) Windows Driver Package - Intel USB (05/15/2006 7.4.0.1005) Windows Driver Package - Intel USB (09/13/2006 8.2.0.1008) Windows Driver Package - Intel USB (09/15/2006 8.0.0.1008) Windows Imaging Component Windows Management Framework Core Windows Media Format 11 runtime Windows Presentation Foundation Windows XP Service Pack 3 WinRAR XML Paper Specification Shared Components Pack 1.0 XP Codec Pack Zattoo4 4.0.5 . ==== Event Viewer Messages From Past Week ======== . 31.10.2012 16:09:54, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 30.10.2012 10:32:00, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 08863B425932. The following error occurred: The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. 29.10.2012 20:21:45, error: PSched [14103] - QoS [Adapter {A862C055-3297-4986-BBCE-9A1F87042A27}]: The netcard driver failed the query for OID_GEN_LINK_SPEED. 03.11.2012 22:17:48, error: Dhcp [1002] - The IP address lease 10.197.24.15 for the Network Card with network address 00FF60B813B8 has been denied by the DHCP server 10.196.39.254 (The DHCP Server sent a DHCPNACK message). 03.11.2012 18:46:46, error: IPRIP [29053] - IPRIP could not join the multicast group [removed] on the local interface with IP address 169.254.138.211. The data is the error code. 03.11.2012 18:46:46, error: IPRIP [29052] - IPRIP could not request multicasting on the local interface with IP address 169.254.138.211. The data is the error code. 03.11.2012 12:37:29, error: IPRIP [29053] - IPRIP could not join the multicast group [removed] on the local interface with IP address [removed]. The data is the error code. 03.11.2012 12:33:23, error: Service Control Manager [7000] - The Remote Packet Capture Protocol v.0 (experimental) service failed to start due to the following error: The system cannot find the path specified. 03.11.2012 12:31:31, error: PlugPlayManager [11] - The device Root\LEGACY_NPF\0000 disappeared from the system without first being prepared for removal. 03.11.2012 12:30:38, error: Service Control Manager [7034] - The Remote Packet Capture Protocol v.0 (experimental) service terminated unexpectedly. It has done this 1 time(s). 03.11.2012 12:16:37, error: System Error [1003] - Error code 000000ca, parameter1 00000004, parameter2 87d30030, parameter3 00000000, parameter4 00000000. 01.11.2012 11:57:30, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the rpcapd service. . ==== End Of File ===========================
Post #10
Hi,

I see that your Java software is out of date. Please go to Start >> Control Panel >> Programs and Features >> uninstall all versions of Java.

Now download and install the newest version from here >> http://java.com/en/download/index.jsp
————-

Clear Java Cache

See this page for instructions on how to clear java's cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • Under Temporary Internet Files, click the Delete Files button.
  • There are three options in the window to clear the cache - Leave ALL 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Java Control Panel.
———-

Please download Malwarebytes Anti-Malware to your desktop.

  • Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.


The log can also be found here:

Windows 2000 & Windows XP:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs

Windows Vista & Win7:
C:\Users\\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
———-
Post #12
Hi sorry for the delay. Here is the log of Malwarebytes: Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.11.05.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 6.0.2900.5512 Lewis :: DAISY-A189183EE [administrator] 05.11.2012 10:33:31 mbam-log-2012-11-05 (10-33-31).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 261921 Time elapsed: 8 minute(s), 25 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCR\CLSID\{dedbb410-30bd-5eb4-8555-c0ee0936e592} (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ——————————————————————– And here for ESET: C:\ableton\Program\cpv.dll probably a variant of Win32/Agent.FGDSVNW trojan C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\asc-setup42.exe multiple threats C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\gb3-setup.exe a variant of Win32/ELEX application C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\SoftonicDownloader_fuer_free-wav-to-mp3-converter.exe a variant of Win32/SoftonicDownloader.A application C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (1).exe multiple threats C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (2).exe multiple threats C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\Ableton Live 7.0.2\setup.exe probably a variant of Win32/Agent.HKWXFKN trojan C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Eigene Musik\Ableton.Live.v7.0.2.WORKING-AiR\a-l702w\setup.exe probably a variant of Win32/Agent.FGDSVNW trojan C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Eigene Videos\Veoh\VeohWebPlayerSetup_eng.exe Win32/OpenCandy application C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Important.documents\asc-setup.exe a variant of Win32/ELEX application C:\Program Files\Browsers Protector\regmon32.exe a variant of Win32/TopMedia application Operating memory a variant of Win32/TopMedia application …..best, Lewis
Post #13
Hi,

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:


    ClearJavaCache::

    File::
    C:\ableton\Program\cpv.dll
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\asc-setup42.exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\gb3-setup.exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\SoftonicDownloader_fuer_free-wav-to-mp3-converter.exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (1).exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (2).exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Downloads\Ableton Live 7.0.2\setup.exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Eigene Musik\Ableton.Live.v7.0.2.WORKING-AiR\a-l702w\setup.exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Eigene Videos\Veoh\VeohWebPlayerSetup_eng.exe
    C:\Documents and Settings\Lewis.DAISY-A189183EE\My Documents\Important.documents\asc-setup.exe
    C:\Program Files\Browsers Protector\regmon32.exe

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Post the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-

Please post the new ComboFix log and let me know what remaining malware problems you are having. :)
Post #14
Hi Jeff, here is the new ComboFix log:

ComboFix 12-11-06.03 - Lewis 06.11.2012 15:59:25.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1526.1033 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Lewis.DAISY-A189183EE\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\ableton\Program\cpv.dll"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\Ableton Live 7.0.2\setup.exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\asc-setup42.exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\gb3-setup.exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\SoftonicDownloader_fuer_free-wav-to-mp3-converter.exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (1).exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (2).exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Eigene Musik\Ableton.Live.v7.0.2.WORKING-AiR\a-l702w\setup.exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Eigene Videos\Veoh\VeohWebPlayerSetup_eng.exe"
"c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Important.documents\asc-setup.exe"
"c:\program files\Browsers Protector\regmon32.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\ableton\Program\cpv.dll
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\Ableton Live 7.0.2\setup.exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\asc-setup42.exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\gb3-setup.exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\SoftonicDownloader_fuer_free-wav-to-mp3-converter.exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (1).exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Downloads\vshare-plugin (2).exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Eigene Musik\Ableton.Live.v7.0.2.WORKING-AiR\a-l702w\setup.exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Eigene Videos\Veoh\VeohWebPlayerSetup_eng.exe
c:\documents and settings\Lewis.DAISY-A189183EE\My Documents\Important.documents\asc-setup.exe
c:\program files\Browsers Protector\regmon32.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-10-06 to 2012-11-06 )))))))))))))))))))))))))))))))
.
.
2012-11-05 10:44 . 2012-11-05 10:44 ——– d—–w- c:\program files\ESET
2012-11-05 10:32 . 2012-11-05 10:32 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Malwarebytes
2012-11-05 10:31 . 2012-11-05 10:31 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2012-11-05 10:31 . 2012-11-05 10:31 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-11-05 10:31 . 2012-09-29 19:54 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-11-05 10:29 . 2012-11-05 10:29 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Sun
2012-11-05 10:25 . 2012-11-05 10:25 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-11-05 10:25 . 2012-11-05 10:25 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-01 11:18 . 2012-11-01 11:18 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\DriverCure
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\program files\Common Files\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\SpeedyPC Software
2012-11-01 11:17 . 2012-11-01 11:17 ——– d—–w- c:\program files\SpeedyPC Software
2012-10-31 20:08 . 2012-11-06 16:06 ——– d—–w- c:\program files\Browsers Protector
2012-10-31 01:04 . 2012-10-31 01:06 ——– d—–w- c:\program files\Google
2012-10-27 23:09 . 2012-10-27 23:09 ——– d—–w- c:\program files\Avalanche
2012-10-27 22:39 . 2012-10-27 22:39 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-17 08:17 . 2012-10-17 08:23 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\U3
2012-10-11 23:28 . 2012-10-28 21:42 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Spotify
2012-10-11 23:28 . 2012-10-28 21:12 ——– d—–w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify
2012-10-09 16:26 . 2012-10-18 10:02 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2012-10-09 16:26 . 2012-10-09 16:26 ——– d—–w- c:\program files\Spybot - Search & Destroy
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-05 10:25 . 2011-12-08 10:08 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-10-27 22:39 . 2011-09-18 14:32 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-24 14:32 . 2012-09-24 23:10 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-08-30 20:29 . 2004-08-04 12:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2012-08-30 20:29 . 2004-08-04 12:00 667136 —-a-w- c:\windows\system32\wininet.dll
2012-08-30 20:29 . 2004-08-04 12:00 61952 —-a-w- c:\windows\system32\tdc.ocx
2012-08-28 13:00 . 2004-08-04 12:00 369664 —-a-w- c:\windows\system32\html.iec
2012-08-24 14:43 . 2011-07-10 23:14 301920 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2012-08-24 13:53 . 2004-08-04 12:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-08-21 13:29 . 2004-08-04 12:00 2192896 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2004-08-03 22:59 2069632 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-03-30 09:40 . 2011-03-30 09:40 517976 —-a-w- c:\program files\DXSETUP.exe
2011-03-30 09:40 . 2011-03-30 09:40 95576 —-a-w- c:\program files\DSETUP.dll
2011-03-30 09:40 . 2011-03-30 09:40 1566040 —-a-w- c:\program files\dsetup32.dll
2012-10-24 17:50 . 2012-11-03 19:12 261600 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-10-27 4762496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-09-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-09-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-09-15 118784]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 561152]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-07-31 2596984]
"InstaLAN"="c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2010-03-17 1141144]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2012-10-27 22:36 7901144 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2012-10-27 22:35 1199576 —-a-w- c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 09:04 252848 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Documents and Settings\\Lewis.DAISY-A189183EE\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\SoulseekQt\\SoulseekQt.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Lewis.DAISY-A189183EE\\Application Data\\Spotify\\spotify.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19.04.2012 02:50 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [13.09.2011 04:30 31952]
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [10.10.2011 07:47 14776]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10.07.2011 23:13 237408]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [10.07.2011 23:14 301920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22.07.2011 16:27 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.07.2011 21:55 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [11.07.2012 18:54 116608]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [14.02.2012 02:53 193288]
R2 ExpatShieldService;Expat Shield Service;c:\program files\Expat Shield\bin\openvpnas.exe [06.01.2012 18:32 331608]
R2 ExpatSrv;Expat Shield Routing Service;c:\program files\Expat Shield\HssWPR\hsssrv.exe [04.01.2012 23:01 363336]
R2 ExpatWd;Expat Shield Monitoring Service;c:\program files\Expat Shield\bin\hsswd.exe -product Expat –> c:\program files\Expat Shield\bin\hsswd.exe -product Expat [?]
R2 Iprip;RIP Listener;c:\windows\System32\svchost.exe -k netsvcs [04.08.2004 12:00 14336]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23.12.2011 11:32 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [23.12.2011 11:32 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23.12.2011 11:32 17232]
R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [08.07.2010 14:09 606056]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [13.08.2012 02:24 5167736]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [29.02.2012 06:50 158856]
S3 ExpatTrayService;Expat Shield Tray Service;c:\program files\Expat Shield\bin\ExpatTrayService.exe [06.01.2012 18:39 77520]
S3 FsUsbExDisk;FsUsbExDisk;\??\c:\windows\system32\FsUsbExDisk.SYS –> c:\windows\system32\FsUsbExDisk.SYS [?]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [28.04.2011 07:28 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [28.04.2011 07:28 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [28.04.2011 07:28 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [28.04.2011 07:28 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [28.04.2011 07:28 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [28.04.2011 07:28 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [28.04.2011 07:28 115752]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [02.02.2011 18:40 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [02.02.2011 18:40 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [02.02.2011 18:40 123648]
S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\system32\drivers\tascusb2.sys [27.01.2011 20:00 360448]
S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device;c:\windows\system32\drivers\tscusb2m.sys [27.01.2011 20:00 18944]
S3 TASCAM_US122L_WDM;TASCAM US-122L WDM;c:\windows\system32\drivers\tscusb2a.sys [27.01.2011 20:00 33792]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - JAVAQUICKSTARTERSERVICE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-31 01:04]
.
2012-11-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-10-31 01:04]
.
2012-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-2025429265-839522115-1003Core.job
- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-05-07 12:57]
.
2012-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-527237240-2025429265-839522115-1003UA.job
- c:\documents and settings\Lewis.DAISY-A189183EE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-05-07 12:57]
.
2012-11-01 c:\windows\Tasks\SpeedyPC Pro.job
- c:\program files\SpeedyPC Software\SpeedyPC\SpeedyPC.exe [2012-10-04 20:42]
.
2012-11-05 c:\windows\Tasks\SpeedyPC Registration3.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\UUS3.dll [2012-10-04 20:42]
.
2012-11-03 c:\windows\Tasks\SpeedyPC Update Version3 Startup Task.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2012-10-04 20:42]
.
2012-11-01 c:\windows\Tasks\SpeedyPC Update Version3.job
- c:\program files\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2012-10-04 20:42]
.
.
——- Supplementary Scan ——-
.
IE: Add to Evernote 4.0 - c:\program files\Evernote\Evernote\EvernoteIE.dll/204
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\documents and settings\Lewis.DAISY-A189183EE\Application Data\Mozilla\Firefox\Profiles\z5g71hr7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2404617&SearchSource;=3&q;={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.nu.nl/
FF - prefs.js: keyword.URL - hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q;=
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2012-09-25 00:10; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-Browsers Protector - c:\program files\Browsers Protector\regmon32.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-06 16:07
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1952)
c:\windows\system32\igfxdev.dll
.
Completion time: 2012-11-06 16:09:52
ComboFix-quarantined-files.txt 2012-11-06 16:09
ComboFix2.txt 2012-11-03 18:49
ComboFix3.txt 2012-11-03 12:40
.
Pre-Run: 676.229.120 bytes free
Post-Run: 664.969.216 bytes free
.
- - End Of File - - 05F1A48AF745C0A6864D645A62955E65


Anything exciting??

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI