What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Switching off and starting over again

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi.
Happy new year to you all, hope this new year will bring you peace and joy.

I wonder if there is a reason why my computer suddenly switches off and start over again 2 or 3 times a day?

Here is my log:

Logfile of HijackThis v1.99.1
Scan saved at 13:53:47, on 19-01-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programas\ewido anti-spyware 4.0\guard.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programas\iTunes\iTunesHelper.exe
C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
C:\Programas\nwsp\pf\Pf.exe
C:\Programas\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\Programas\nwsp\pf\PfNetwork.exe
C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Google\Web Accelerator\googlewebaccclient.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Programas\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programas\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programas\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Programas\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKLM\..\Run: [ParentalFilter] C:\Programas\nwsp\pf\Pf.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://images.autodesk.com/adsk/files/mgaxctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programas\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programas\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


thank you.
Post #2
Hello Rui and Welcome to TomCoyote,

Happy New Year to you too. I do not see anything in your hijackthis log.

Let's run a few scans please.

Now run this online scan using Internet Explorer:

Please turn off the real time scanner of any existing antivirus program while performing the online scan

Next Click on Launch Kaspersky Online Scanner
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Standard
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
  • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
Copy and paste that information from Kapersky in your next post.

======
GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.
  • Download GMER and extract it to the C:\program files\GMER folder.
  • Please rename the GMER file
    Note: You can rename gmer.exe to anything you like as long as you keep the .exe ending.
    Run the Gmer.exe renamed program by double-clicking the executable file (gmer.exe) in Windows Explorer.
    You may be prompted to scan immediately if GMER detects rootkit activity.
  • If you are prompted to scan your system click "yes" to begin the scan.
  • If you are not prompted, Click the "Rootkit" tab, then click "Scan".
At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply.

Please post (reply) with the results from Kapersky, the GMER scan, and a fresh hijackthis log.
Post #3
Hi. Thank you for the answer.
I did all the scans, and when starting to do a new hijackthis scan, the computer switched off again to reboot right after.

Here are the reports:

>>>>The first one, i did two scans as the first one stopped at the 38%.


——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Friday, January 19, 2007 9:03:36 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 19/01/2007
Kaspersky Anti-Virus database records: 245461
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 44964
Number of viruses found: 0
Number of infected objects: 0 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:27:47

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\Jose Pereira\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Histórico\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Histórico\History.IE5\MSHist012007011920070120\index.dat Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\googlewebaccclient.exe.log Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\GoogleWebAccelerator.pac Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\GoogleWebAcceleratorCache Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\GoogleWebAccWarden.exe.log Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\Perflib_Perfdata_67c.dat Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\~DF683E.tmp Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\~DF963E.tmp Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temp\~DFE2F8.tmp Object is locked skipped
C:\Documents and Settings\Jose Pereira\Definições locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Jose Pereira\ntuser.dat Object is locked skipped
C:\Documents and Settings\Jose Pereira\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Jose Pereira\Os meus documentos\A minha música\iTunes\iTunes Library.itl Object is locked skipped
C:\Documents and Settings\LocalService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Definições locais\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Definições locais\Histórico\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Definições locais\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan was interrupted by user!


>>>>The second one was on windows and temps:


——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Friday, January 19, 2007 9:51:01 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 19/01/2007
Kaspersky Anti-Virus database records: 245461
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\

Scan Statistics:
Total number of scanned objects: 19757
Number of viruses found: 0
Number of infected objects: 0 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:46:17

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\PEDROPC.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\ZLT05d75.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT05d7b.TMP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\googlewebaccclient.exe.log Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\GoogleWebAccelerator.pac Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\GoogleWebAcceleratorCache Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\GoogleWebAccWarden.exe.log Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\Perflib_Perfdata_67c.dat Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\~DF683E.tmp Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\~DF963E.tmp Object is locked skipped
C:\DOCUME~1\JOSEPE~1\DEFINI~1\Temp\~DFE2F8.tmp Object is locked skipped

Scan process completed.


>>>>The GMER report:


GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-01-19 23:36:54
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.12 —-

SSDT \SystemRoot\System32\vsdatant.sys ZwConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateFile
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys ZwCreatePort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcessEx
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateSection
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateWaitablePort
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteFile
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDuplicateObject
SSDT \SystemRoot\System32\vsdatant.sys ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys ZwMapViewOfSection
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenFile
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenThread
SSDT \SystemRoot\System32\vsdatant.sys ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys ZwRequestWaitReplyPort
SSDT \SystemRoot\System32\vsdatant.sys ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys ZwSecureConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwSetInformationFile
SSDT \SystemRoot\System32\vsdatant.sys ZwSetSystemInformation
SSDT \SystemRoot\System32\vsdatant.sys ZwSetValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwTerminateProcess

—- Kernel code sections - GMER 1.0.12 —-

.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ 60, 1C, EA, F5, E0, 7E, EA, … ]
.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ 60, 1C, EA, F5, E0, 7E, EA, … ]

—- Devices - GMER 1.0.12 —-

Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F9F5185A] avgtdi.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F9F5185A] avgtdi.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F9F5185A] avgtdi.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F9F5185A] avgtdi.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [F5EB32A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F9F5185A] avgtdi.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLEANUP [F5EB32A0] vsdatant.sys

—- EOF - GMER 1.0.12 —-


And the Hijackthis report:


Logfile of HijackThis v1.99.1
Scan saved at 23:44:09, on 19-01-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programas\ewido anti-spyware 4.0\guard.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programas\iTunes\iTunesHelper.exe
C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programas\nwsp\pf\Pf.exe
C:\Programas\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\Programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Programas\nwsp\pf\PfNetwork.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Google\Web Accelerator\googlewebaccclient.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =

http://localhost:9100/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat

7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Programas\Google\Web

Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programas\EPSON\EPSON

Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programas\EPSON\EPSON

Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Programas\Google\Web

Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" /P26

"EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKLM\..\Run: [ParentalFilter] C:\Programas\nwsp\pf\Pf.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot

1
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma

Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -

http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) -

http://images.autodesk.com/adsk/files/mgaxctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} -

http://download.games.yahoo.com/games/web_…aploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file

missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programas\ewido anti-spyware

4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros

comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programas\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file

missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #4
STEP 1.
======
PCPitStop

Please register (it's free, don't worry) with PCPitStop and run the full tests here.
When the tests are complete, a results page will pop up. Click "Share these results with TechExpress" on the left-hand side. Then copy the URL provided and post (reply) with it here for me.

STEP 2.
Please repeat the GMER, I want to see if it gives the same results.
======
GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.
  • Download GMER and extract it to the C:\program files\GMER folder.
  • Please rename the GMER file
    Note: You can rename gmer.exe to anything you like as long as you keep the .exe ending.
    Run the Gmer.exe renamed program by double-clicking the executable file (gmer.exe) in Windows Explorer.
    You may be prompted to scan immediately if GMER detects rootkit activity.
  • If you are prompted to scan your system click "yes" to begin the scan.
  • If you are not prompted, Click the "Rootkit" tab, then click "Scan".
At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply.

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !


STEP 3.
Blacklight

Download Blacklight trial from here:
http://www.f-secure.com/blacklight/
  • Hit I accept. It will take you to download page.
  • Download blbeta.exe and save it to the Desktop.
  • Once saved… double click blbeta.exe to install the program.
  • Click accept agreement and Click scan
    This app too may fire off a warning from antivirus. Let the driver load.
    Wait for it to finish.
  • If it displays any items…don't do anything with them yet. Just hit exit (close)
  • It will drop a log on Desktop that starts with fsbl….big number
Please post (reply) with the PCPitstop link, the results from the GMER scan, contents of log that starts with fsbl….big number, and a fresh hijackthis log.
Post #5
ok, here it goes. Today already two times the computer switched off and rebooted again.


The PCPitStop report on http://www.pcpitstop.com/pcpitstop/Summary…?conid=17363700



The GMER report:


GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-01-20 17:44:38
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.12 —-

SSDT \SystemRoot\System32\vsdatant.sys ZwConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateFile
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys ZwCreatePort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcessEx
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateSection
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateWaitablePort
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteFile
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDuplicateObject
SSDT \SystemRoot\System32\vsdatant.sys ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys ZwMapViewOfSection
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenFile
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenThread
SSDT \SystemRoot\System32\vsdatant.sys ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys ZwRequestWaitReplyPort
SSDT \SystemRoot\System32\vsdatant.sys ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys ZwSecureConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwSetInformationFile
SSDT \SystemRoot\System32\vsdatant.sys ZwSetSystemInformation
SSDT \SystemRoot\System32\vsdatant.sys ZwSetValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwTerminateProcess

—- Kernel code sections - GMER 1.0.12 —-

.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ 60, 2C, 6B, F5, E0, 8E, 6B, … ]
.text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ 60, 2C, 6B, F5, E0, 8E, 6B, … ]

—- Devices - GMER 1.0.12 —-

Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F404E85A] avgtdi.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F404E85A] avgtdi.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F404E85A] avgtdi.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F404E85A] avgtdi.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [F56C42A0] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [F404E85A] avgtdi.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLEANUP [F56C42A0] vsdatant.sys



The Blacklight report:


01/20/07 18:01:18 [Info]: BlackLight Engine 1.0.55 initialized
01/20/07 18:01:18 [Info]: OS: 5.1 build 2600 (Service Pack 2)
01/20/07 18:01:18 [Note]: 7019 4
01/20/07 18:01:18 [Note]: 7005 0
01/20/07 18:01:21 [Note]: 7006 0
01/20/07 18:01:21 [Note]: 7011 1192
01/20/07 18:01:22 [Note]: 7026 0
01/20/07 18:01:22 [Note]: 7026 0
01/20/07 18:01:33 [Note]: FSRAW library version 1.7.1021
01/20/07 18:11:04 [Note]: 7007 0



And the new Highjackthis report:


Logfile of HijackThis v1.99.1
Scan saved at 18:11:56, on 20-01-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programas\ewido anti-spyware 4.0\guard.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
C:\Programas\nwsp\pf\Pf.exe
C:\Programas\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\Programas\nwsp\pf\PfNetwork.exe
C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Programas\iPod\bin\iPodService.exe
C:\Programas\Google\Web Accelerator\googlewebaccclient.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\freecell.exe
C:\Programas\Windows NT\Acessórios\wordpad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Programas\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programas\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programas\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Programas\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKLM\..\Run: [ParentalFilter] C:\Programas\nwsp\pf\Pf.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programas\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://images.autodesk.com/adsk/files/mgaxctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programas\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programas\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #6
Hi Rui,

So far I do not see anything. Unfortunately you did not provide the url necessary for viewing the PCPitstop results. It just took me to the following:
http://www.pcpitstop.com/pcpitstop/default…eason=not_owner


Were there any problems detected by PCPitstop?
=========

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

If you are taken to the internet page, just close the page.

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Results from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.
Post #7
Hi. The PCPitStop report was allright, only suggesting a defragmentation of the C: drive. I´m going to do your Spy Sweeper scan suggestion tomorrow. Today the computer switched off 3 times. Thank you, Regards, Rui
Post #8
Hi.
Here goes the SpySweeper report:

22:50: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST1AC.tmp". Reason: O sistema não

conseguiu localizar o ficheiro especificado
22:50: Warning: Failed to delete profile shadow file ".log". Reason: O sistema não conseguiu localizar o

ficheiro especificado
22:50: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST1AC.tmp". Reason: O sistema não

conseguiu localizar o ficheiro especificado
22:50: Warning: Failed to delete profile shadow file ".log". Reason: O sistema não conseguiu localizar o

ficheiro especificado
22:50: Warning: Failed to delete profile shadow file "C:\WINDOWS\Temp\SST1AC.tmp". Reason: O sistema não

conseguiu localizar o ficheiro especificado
22:50: Warning: Failed to delete profile shadow file ".log". Reason: O sistema não conseguiu localizar o

ficheiro especificado
22:50: Quarantining All Traces: avenuea cookie
22:50: Quarantining All Traces: hotbar cookie
22:50: Quarantining All Traces: seeq cookie
22:50: Quarantining All Traces: rxgenericdrugs cookie
22:50: Quarantining All Traces: myaffiliateprogram.com cookie
22:50: Quarantining All Traces: webpower cookie
22:50: Quarantining All Traces: weborama cookie
22:50: Quarantining All Traces: toplist cookie
22:50: Quarantining All Traces: adjuggler cookie
22:50: Quarantining All Traces: imlive.com cookie
22:50: Quarantining All Traces: webtrends cookie
22:50: Quarantining All Traces: touchclarity cookie
22:50: Quarantining All Traces: clickzs cookie
22:50: Quarantining All Traces: ccbill cookie
22:50: Quarantining All Traces: goclick cookie
22:50: Quarantining All Traces: enhance cookie
22:50: Quarantining All Traces: azjmp cookie
22:50: Quarantining All Traces: tacoda cookie
22:50: Quarantining All Traces: ads.oneplace cookie
22:50: Quarantining All Traces: 66.246.209 cookie
22:49: Quarantining All Traces: hotbar/zango
22:49: Quarantining All Traces: esd adware
22:49: Quarantining All Traces: iprotectyou
22:49: Removal process initiated
22:48: Sweep Status: 23 Items Found
22:48: Traces Found: 232
22:48: File Sweep Complete, Elapsed Time: 01:46:18
22:48: Sweep Canceled
22:42: Warning: Failed to open file "c:\documents and settings\jose pereira\definições locais\temporary

internet files\content.ie5\863ohaif\login[1].htm". A operação foi concluída com êxito
22:42: Warning: Failed to open file "c:\documents and settings\jose pereira\definições locais\temporary

internet files\content.ie5\xgzijb3i\login[2].aspx". A operação foi concluída com êxito
22:42: Warning: Failed to open file "c:\documents and settings\jose pereira\definições locais\temporary

internet files\content.ie5\bnoo2pas\caxpxfbq.xml". A operação foi concluída com êxito
22:42: Warning: Failed to open file "c:\documents and settings\jose pereira\definições locais\temporary

internet files\content.ie5\863ohaif\sbox-h4[1].gif". A operação foi concluída com êxito
22:42: Warning: Failed to open file "c:\documents and settings\jose pereira\definições locais\temporary

internet files\content.ie5\xgzijb3i\user[1].gif". A operação foi concluída com êxito
22:41: Warning: Failed to open file "c:\documents and settings\jose pereira\definições locais\temporary

internet files\content.ie5\bnoo2pas\tt[1].gif". A operação foi concluída com êxito
22:41: Warning: Failed to open file "c:\documents and settings\jose pereira\definições locais\temporary

internet files\content.ie5\xgzijb3i\st-dart[1].gif". A operação foi concluída com êxito
22:38: Warning: Failed to open file "c:\documents and settings\jose pereira\cookies\jose

[removed][1].txt". A operação foi concluída com êxito
22:12: C:\Documents and Settings\Rui\Definições locais\Temporary Internet

Files\Content.IE5\8DM3GHEZ\icons2[1].xip (ID = 121862)
22:11: C:\WINDOWS\WindowsIE.dll_tobedeleted (ID = 306446)
21:58: Warning: AntiVirus engine returned [File Encrypted] on [c:\programas\adobe\acrobat

7.0\reader\messages\enu\rdrmsgenu.pdf]
21:52: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_3000.res

(ID = 121824)
21:45: Warning: AntiVirus engine returned [File Encrypted] on [c:\programas\adobe\acrobat

7.0\reader\websearch\websearchenu.pdf]
21:40: C:\WINDOWS\system32\ipsp.dll (ID = 352850)
21:40: Found System Monitor: iprotectyou
21:40: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_2000.res

(ID = 121823)
21:39: Warning: AntiVirus engine returned [Access Denied] on [c:\pagefile.sys]
21:33: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\DownLoad\top7.xip (ID =

162956)
21:33: C:\Documents and Settings\Rui\Definições locais\Temporary Internet

Files\Content.IE5\870FGHIJ\top7[1].xip (ID = 162956)
21:33: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\Default_hotbarcom.mnu (ID

= 121820)
21:31: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\DownLoad\country.xip (ID =

121857)
21:31: C:\Documents and Settings\Rui\Definições locais\Temporary Internet

Files\Content.IE5\870FGHIJ\country[1].xip (ID = 121857)
21:30: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\t2_bg.res (ID = 121851)
21:30: C:\Documents and Settings\Rui\Definições locais\Temporary Internet

Files\Content.IE5\WN49E5AT\s_icons_buttons[1].xip (ID = 130929)
21:30: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\DownLoad\s_icons_buttons.xip

(ID = 130929)
21:27: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_buttons_bbar1.res

(ID = 121825)
21:27: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\DownLoad\icons2.xip (ID =

121862)
21:22: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\country.exe (ID = 121818)
21:22: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\d_icons_weather.res (ID =

121840)
21:18: C:\Documents and Settings\Rui\Definições locais\Temporary Internet

Files\Content.IE5\WN49E5AT\d_icons_weather[1].xip (ID = 121860)
21:18: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\DownLoad\d_icons_weather.xip

(ID = 121860)
21:18: C:\Documents and Settings\Rui\Definições locais\Temporary Internet

Files\Content.IE5\C1M7CDMJ\tsd_bg[1].xip (ID = 62383)
21:18: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\DownLoad\tsd_bg.xip (ID =

62383)
21:18: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\tsd_bg.res (ID = 62382)
21:18: C:\Documents and Settings\Rui\Definições locais\Temporary Internet

Files\Content.IE5\870FGHIJ\t2_bg[1].xip (ID = 121869)
21:18: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\DownLoad\t2_bg.xip (ID =

121869)
21:18: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\progress.res (ID = 62367)
21:18: C:\Program Files\MM052002\Install.exe (ID = 70098)
21:15: Warning: AntiVirus engine returned [File Encrypted] on [c:\programas\adobe\acrobat

7.0\reader\messages\enu\read0600win_enuyhoo0010.pdf]
21:10: C:\Program Files\MM052002\WindowsIE.dll (ID = 306446)
21:08: Warning: AntiVirus engine returned [File Encrypted] on [c:\programas\adobe\acrobat

7.0\reader\messages\rdrmsgsplash.pdf]
21:07: C:\Documents and Settings\Rui\Application Data\HbTools\v3.0\HbTools\static\1\icons2.res (ID = 121846)
21:03: C:\Documents and Settings\Rui\Application Data\HbTools (164 subtraces) (ID = 2147486417)
21:02: Starting File Sweep
21:02: Cookie Sweep Complete, Elapsed Time: 00:00:07
21:02: c:\documents and settings\rui\cookies\rui@www.1stairfare[2].txt (ID = 2258)
21:02: Found Spy Cookie: avenuea cookie
21:02: c:\documents and settings\rui\cookies\[removed][1].txt (ID = 2798)
21:02: c:\documents and settings\rui\cookies\rui@hotbar[2].txt (ID = 2797)
21:02: c:\documents and settings\rui\cookies\[removed][1].txt (ID = 4207)
21:02: Found Spy Cookie: hotbar cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 3332)
21:02: Found Spy Cookie: seeq cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 3272)
21:02: Found Spy Cookie: rxgenericdrugs cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2124)
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 3032)
21:02: Found Spy Cookie: myaffiliateprogram.com cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2772)
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][1].txt (ID = 2707)
21:02: Found Spy Cookie: frenchcum cookie
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@webpower[2].txt (ID = 3660)
21:02: Found Spy Cookie: webpower cookie
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@weborama[1].txt (ID = 3658)
21:02: Found Spy Cookie: weborama cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2413)
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@toplist[1].txt (ID = 3557)
21:02: Found Spy Cookie: toplist cookie
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@tacoda[2].txt (ID = 6444)
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2071)
21:02: Found Spy Cookie: adjuggler cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2844)
21:02: Found Spy Cookie: imlive.com cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][1].txt (ID = 3669)
21:02: Found Spy Cookie: webtrends cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][1].txt (ID = 3566)
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@herfirstlesbiansex[1].txt (ID = 2771)
21:02: Found Spy Cookie: herfirstlesbiansex cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][1].txt (ID = 3566)
21:02: Found Spy Cookie: touchclarity cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2413)
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2413)
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2413)
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2413)
21:02: Found Spy Cookie: clickzs cookie
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@ccbill[2].txt (ID = 2369)
21:02: Found Spy Cookie: ccbill cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 2733)
21:02: Found Spy Cookie: goclick cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][1].txt (ID = 2614)
21:02: Found Spy Cookie: enhance cookie
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@azjmp[1].txt (ID = 2270)
21:02: Found Spy Cookie: azjmp cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][2].txt (ID = 6445)
21:02: Found Spy Cookie: tacoda cookie
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@adultfriendfinder[2].txt (ID = 2165)
21:02: Found Spy Cookie: adultfriendfinder cookie
21:02: c:\documents and settings\jose pereira\cookies\jose [removed][1].txt (ID = 2122)
21:02: Found Spy Cookie: ads.oneplace cookie
21:02: c:\documents and settings\jose pereira\cookies\jose pereira@66.246.209[2].txt (ID = 1997)
21:02: Found Spy Cookie: 66.246.209 cookie
21:02: Starting Cookie Sweep
21:01: Registry Sweep Complete, Elapsed Time:00:01:54
21:01:

HKU\WRSS_Profile_S-1-5-21-1123561945-813497703-854245398-1004\software\microsoft\installer\products\d493500bd4a5

4ea6bc805fc9cda952c5\ (ID = 788008)
21:01:

HKU\WRSS_Profile_S-1-5-21-1123561945-813497703-854245398-1004\software\microsoft\installer\features\10b0642b3613

4f8f914ea8e11ee5b503\ (ID = 788006)
21:01: HKU\WRSS_Profile_S-1-5-21-1123561945-813497703-854245398-1004\software\microsoft\internet

explorer\toolbar\shellbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 685412)
21:01: HKU\WRSS_Profile_S-1-5-21-1123561945-813497703-854245398-1004\software\microsoft\internet

explorer\toolbar\webbrowser\ || {74cc49f7-eb32-4a08-b204-948962a6e3db} (ID = 127586)
21:01: HKU\WRSS_Profile_S-1-5-21-1123561945-813497703-854245398-1004\software\hbtools\ (ID = 127563)
21:01: Found Adware: hotbar/zango
21:00: HKLM\software\microsoft\windows\currentversion\uninstall\windowsie\ (ID = 135223)
21:00: Found Adware: esd adware
20:59: Starting Registry Sweep
20:59: Memory Sweep Complete, Elapsed Time: 00:19:04
20:40: Starting Memory Sweep
20:40: Warning: TVolume.Read: read past end of volume size: 0 reading cluster: 0
20:40: Start Full Sweep
20:40: Sweep initiated using definitions version 843
20:40: Spy Sweeper 5.2.3.2138 started
20:40: | Start of Session, segunda-feira, 22 de Janeiro de 2007 |

ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
20:38: Shield States
20:37: Spyware Definitions: 843
20:37: Informational: Loaded AntiVirus Engine: 2.41.0; SDK Version: 4.13; Virus Definitions: 18-01-2007 7:34:56

(GMT)
20:36: Spy Sweeper 5.2.3.2138 started
20:30: Spyware Definitions: 843
20:30: Informational: Loaded AntiVirus Engine: 2.41.0; SDK Version: 4.13; Virus Definitions: 18-01-2007 7:34:56

(GMT)
20:29: Spy Sweeper 5.2.3.2138 started
20:29: Spy Sweeper 5.2.3.2138 started
20:29: | Start of Session, segunda-feira, 22 de Janeiro de 2007 |
********



And the Highjackthis report goes in the next post


Logfile of HijackThis v1.99.1
Scan saved at 22:56:09, on 22-01-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programas\ewido anti-spyware 4.0\guard.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7Debug\mdm.exe
C:\Programas\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
C:\Programas\nwsp\pf\Pf.exe
C:\Programas\iTunes\iTunesHelper.exe
C:\Programas\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Programas\iPod\bin\iPodService.exe
C:\Programas\nwsp\pf\PfNetwork.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
C:\Programas\Google\Web Accelerator\googlewebaccclient.exe
C:\Programas\MSN Messenger\msnmsgr.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Programas\Internet Explorer\iexplore.exe
C:\Programas\VoipCheapCom\VoipCheapCom.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\freecell.exe
C:\Programas\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Programas\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programas\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programas\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Programas\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programas\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programas\Java\jre1.5.0_10\bin\jusched.exe
O4 - HKLM\..\Run: [ParentalFilter] C:\Programas\nwsp\pf\Pf.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programas\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Programas\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programas\Ficheiros comuns\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Programas\Google\Web Accelerator\GoogleWebAccWarden.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://images.autodesk.com/adsk/files/mgaxctrl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Programas\Ficheiros comuns\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programas\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programas\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\VIRUSfighter\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Programas\Webroot\Spy Sweeper\SpySweeper.exe
Post #10
Yesterday I noticed that the "iprotectyou" cookie was an high risk one. It was sent to quarantine. Today the computer has switched off once so far (it´s middle of the afternoon). Rui
Post #11
You ran a test at PCPitstop and said that suggestion was to defragment the drive. Go ahead and run the test for drivers. Out-dated or bad drivers can cause computer to shut-down.

Get Updated Drivers (Touchstone Driver Agent)
http://www.pcpitstop.com/driverscan.asp
Please click the link and follow the instructions to run the scan.
Let me know if any bad drivers were found.
Post #12
Hi. It´s been some days since the last switching off so it seems that the computer is working fine . Just one thing is still bothering me which has nothing to do with the last problem. It has to do with internet connection…that although everything seems to work allright with no problems with the connection, when I open the Outlook Express, it opens a window that says that the server ended unexpectatly the connection but the connection is still on. It might have to do with the ports, but I can´t understand why just this application has problem with the server. Do you have an idea of what could be? Thank you. Rui
Post #13
Hi Rui,

Are you referring to Outlook or Outlook Express?

This is a link to the Outlook (part of Office) newsgroup where you can post the problem (after you register of course) and obtain an answer.
http://www.microsoft.com/office/community/…ng=en&cr=US

This is the newsgroup for Outlook Express (part of Internet Explorer)
http://www.microsoft.com/communities/newsg…ng=en&cr=us

I recommend the Microsoft newsgroups to find answers for particular Microsoft product related problems. I have used the Outlook one in the past myself.
Post #14
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI