What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow COmputer, please help.

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Here is my Hijackthis log, but I began a search for help because a process named 'nordsys' is taking up a lot of space.

Thanks for your assistance,
Bill

Logfile of HijackThis v1.99.0
Scan saved at 9:50:57 PM, on 2/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE
C:\Program Files\Support.com\bin\tgcmd.exe
C:\WINDOWS\system32\nordsys.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Upgrader.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\IFACE.EXE
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PAVJOBS.EXE
C:\DOCUME~1\Bill\LOCALS~1\Temp\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe"
O4 - HKCU\..\Run: [taskdir] C:\WINDOWS\system32\taskdir.exe
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102…all/xscan53.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BE1710C-E8EF-4367-BBA3-46C8DD71EA8C}: NameServer = 194.7.45.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{A468586A-71FF-42A1-9812-F87D40BECEB8}: NameServer = 194.7.45.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{3BE1710C-E8EF-4367-BBA3-46C8DD71EA8C}: NameServer = 194.7.45.20
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Antispam Server Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
O23 - Service: Panda Firewall Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
O23 - Service: Panda Function Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
O23 - Service: Panda Pavkre - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
O23 - Service: Panda PavProt - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
O23 - Service: Panda Process Protection Service - Unknown - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
O23 - Service: Panda Preventium+ Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
O23 - Service: Panda IManager Service - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
Post #2
Hi Bill and welcome to the forums here at Tom Coyote.

You appear have a rootkit type stealth infection. I believe we have a tool that can help get this cleaned up but with these types of infections we can never guarantee that you are completely clean. The only way that could be done is by completely wiping your hard drive clean and re-installing everything. That is a judgement you will have to make. I do think we have a chance at getting this one so I will give you the instructions to get started anyway. If you decide to go ahead with the fix I may ask you to run several more scans after so be prepared.

Here you go:

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
  • Open the SDFix folder and double click on RunThis.bat to start the script.
  • Type Y and press Enter to begin the script.
  • It will start cleaning your PC and then prompt you to press any key to Reboot.
  • Press any key to restart the PC.
  • Your system will take longer than normal to restart as the fixtool will be removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished.
  • Press any key to end the script and to load your desktop icons.
  • A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log
Regards,
Dave
Post #3
Dave:

Wow! THanks for your help! It took me about a dozen tries to get this to work for me. The computer kept either auto-rebooting in the middle, or would freeze without loading in SAfe mode. BUT, I finally did get it to happen!

Here are the results, plus a new HJT log:


SDFix: Version 1.63

Sat 02/03/2007 - 23:58:58.67

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:

Path:


Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting…

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\system32\zlbw.dll - Deleted



ADS Check:

C:\WINDOWS\system32
No streams found.

Final Check:

Remaining Services:
——————


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\support.com\\bin\\tgcmd.exe"="C:\\Program Files\\support.com\\bin\\tgcmd.exe:*:Disabled:Support.com Scheduler and Command Dispatcher"
"C:\\WINDOWS\\System32\\mshta.exe"="C:\\WINDOWS\\System32\\mshta.exe:*:Enabled:Microsoft ® HTML Application host"
"C:\\WINDOWS\\System32\\mmc.exe"="C:\\WINDOWS\\System32\\mmc.exe:*:Enabled:Microsoft Management Console"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


Remaining Files:
—————

Backups Folder: - C:\SDFix\backups\backups.zip


Checking For Files with Hidden Attributes :

C:\Program Files\Uninstall Information\IE40.Comctl32\AINF0000
C:\Program Files\Uninstall Information\mshtml.DllReg\AINF0000
C:\Program Files\Messenger\msmsgs.exe
C:\System Volume Information\_restore{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198162.exe
C:\WINDOWS\TEMP\DWHD5E9.tmp
C:\WINDOWS\TEMP\DWH5141.tmp
C:\WINDOWS\TEMP\DWH5B3A.tmp
C:\WINDOWS\TEMP\DWH5B4F.tmp
C:\WINDOWS\TEMP\DWH5D9D.tmp
C:\WINDOWS\TEMP\DWH5DC5.tmp
C:\WINDOWS\TEMP\DWH5DD9.tmp
C:\WINDOWS\TEMP\DWH5DED.tmp
C:\WINDOWS\TEMP\DWH5E01.tmp
C:\WINDOWS\TEMP\DWH5E0C.tmp
C:\WINDOWS\TEMP\DWH5E52.tmp
C:\WINDOWS\TEMP\DWH5E7A.tmp
C:\WINDOWS\TEMP\DWH5F9C.tmp
C:\WINDOWS\TEMP\DWH5FE2.tmp
C:\WINDOWS\TEMP\DWH60F1.tmp
C:\WINDOWS\TEMP\DWH61D7.tmp
C:\WINDOWS\TEMP\DWH295F.tmp
C:\WINDOWS\TEMP\DWH53A8.tmp
C:\WINDOWS\TEMP\DWHBFB4.tmp
C:\WINDOWS\TEMP\DWHC904.tmp
C:\WINDOWS\TEMP\DWHC90E.tmp
C:\WINDOWS\TEMP\DWHCA8A.tmp
C:\WINDOWS\TEMP\DWHCADA.tmp
C:\WINDOWS\TEMP\DWHCAE4.tmp
C:\WINDOWS\TEMP\DWHCAF8.tmp
C:\WINDOWS\TEMP\DWHCB02.tmp
C:\WINDOWS\TEMP\DWHCB16.tmp
C:\WINDOWS\TEMP\DWHCB20.tmp
C:\WINDOWS\TEMP\DWHCB7A.tmp
C:\WINDOWS\TEMP\DWHCBAC.tmp
C:\WINDOWS\TEMP\DWHCD0B.tmp
C:\WINDOWS\TEMP\DWHCD83.tmp
C:\WINDOWS\TEMP\DWHCDDD.tmp
C:\WINDOWS\TEMP\DWHCE19.tmp
C:\WINDOWS\TEMP\DWHCE4B.tmp
C:\WINDOWS\TEMP\DWHCE5F.tmp
C:\WINDOWS\TEMP\DWHCE88.tmp
C:\WINDOWS\TEMP\DWHCF00.tmp
C:\WINDOWS\TEMP\DWHCF8C.tmp
C:\WINDOWS\TEMP\DWHE7A6.tmp
C:\WINDOWS\TEMP\DWH47F6.tmp
C:\WINDOWS\TEMP\DWH51BD.tmp
C:\WINDOWS\TEMP\DWH51E5.tmp
C:\WINDOWS\TEMP\DWH53F8.tmp
C:\WINDOWS\TEMP\DWH5402.tmp
C:\WINDOWS\TEMP\DWH540C.tmp
C:\WINDOWS\TEMP\DWH5420.tmp
C:\WINDOWS\TEMP\DWH542A.tmp
C:\WINDOWS\TEMP\DWH5434.tmp
C:\WINDOWS\TEMP\DWH54A2.tmp
C:\WINDOWS\TEMP\DWH54E8.tmp
C:\WINDOWS\TEMP\DWH563D.tmp
C:\WINDOWS\TEMP\DWH56AB.tmp
C:\WINDOWS\TEMP\DWH570F.tmp
C:\WINDOWS\TEMP\DWH5741.tmp
C:\WINDOWS\TEMP\DWH577D.tmp
C:\WINDOWS\TEMP\DWH5787.tmp
C:\WINDOWS\TEMP\DWH57B9.tmp
C:\WINDOWS\TEMP\DWH57FF.tmp
C:\WINDOWS\TEMP\DWH58F0.tmp
C:\WINDOWS\TEMP\DWH400D.tmp
C:\WINDOWS\TEMP\DWHBECC.tmp
C:\WINDOWS\TEMP\DWHC5B8.tmp
C:\WINDOWS\TEMP\DWHC5CC.tmp
C:\WINDOWS\TEMP\DWHC7AD.tmp
C:\WINDOWS\TEMP\DWHC7DF.tmp
C:\WINDOWS\TEMP\DWHC7E9.tmp
C:\WINDOWS\TEMP\DWHC7FD.tmp
C:\WINDOWS\TEMP\DWHC807.tmp
C:\WINDOWS\TEMP\DWHC81B.tmp
C:\WINDOWS\TEMP\DWHC82F.tmp
C:\WINDOWS\TEMP\DWHC857.tmp
C:\WINDOWS\TEMP\DWHC893.tmp
C:\WINDOWS\TEMP\DWHC9C0.tmp
C:\WINDOWS\TEMP\DWHCA24.tmp
C:\WINDOWS\TEMP\DWHCA88.tmp
C:\WINDOWS\TEMP\DWHCABA.tmp
C:\WINDOWS\TEMP\DWHCAE2.tmp
C:\WINDOWS\TEMP\DWHCAF6.tmp
C:\WINDOWS\TEMP\DWHCB28.tmp
C:\WINDOWS\TEMP\DWHCB6F.tmp
C:\WINDOWS\TEMP\DWHCBB5.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\321ca12b9fa3a6e84c5208a19d84f4b9\BIT1F7.tmp
C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp
C:\Documents and Settings\Bill\My Documents\~WRL1677.tmp
C:\Documents and Settings\Bill\My Documents\~WRL0001.tmp

Finished





Logfile of HijackThis v1.99.0
Scan saved at 12:12:42 AM, on 2/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\apvxdwin.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\Bill\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe"
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102…all/xscan53.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BE1710C-E8EF-4367-BBA3-46C8DD71EA8C}: NameServer = 194.7.45.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{A468586A-71FF-42A1-9812-F87D40BECEB8}: NameServer = 194.7.45.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{3BE1710C-E8EF-4367-BBA3-46C8DD71EA8C}: NameServer = 194.7.45.20
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Antispam Server Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
O23 - Service: Panda Firewall Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
O23 - Service: Panda Function Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
O23 - Service: Panda Pavkre - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
O23 - Service: Panda PavProt - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
O23 - Service: Panda Process Protection Service - Unknown - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
O23 - Service: Panda Preventium+ Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
O23 - Service: Panda IManager Service - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
Post #4
Hi Billy,

My apologies for not getting back to you sooner. Things have been crazy and I somehow lost several emails.

Looks like things are much better. How are they running?

Just some cleanup at this point I believe.

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)

Then close all windows except this one and press Fix checked.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main select the following:
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

I also recommend running an online scan as follows:

Please go Here and do an online scan. Let it fix any infections.
Let me know what is found.

After scan, reboot and post a new HijackThis log

Also let me know how the computer is running now.

Dave
Post #5
Thanks, Dave!! I am going away for the weekend right from work today, but will run these fix's when i get back on Sunday night. The computer has been running better since the first post. I'll let you know once I have completed these other tasks how it is responding! Bill
Post #6
Hello Dave!!

THanks for your help. I would have never guessed that there were all the things your online scan reveiled. Here is the result of that scan as well as my newest HJT log

THanks agian, Bill.

Scanning Report
Sunday, February 11, 2007 16:46:09 - 21:19:53
Computer name: BILLXP
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\
________________________________________
Result: 108 malware found
CoolWebSearch (spyware)
• System (Disinfected)
Email-Worm.Win32.Banwarum.f (virus)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP269\A0184979.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP269\A0185970.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP266\A0183850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP266\A0184850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP265\A0181846.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP265\A0182850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP264\A0180850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP262\A0177846.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP262\A0178850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP262\A0179850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP260\A0176850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP259\A0175850.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP258\A0173842.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP258\A0173846.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP258\A0174846.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP257\A0170841.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP257\A0171842.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP257\A0172842.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP256\A0170820.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP255\A0169811.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP255\A0170815.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167802.DLL (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0168811.DLL (Renamed & Submitted)
Email-Worm.Win32.Zhelatin.o (virus)
• C:\WINDOWS\SYSTEM32\NMPDWYGA.EXE (Renamed & Submitted)
HTML/Spywad.A@troj (virus)
• C:\WINDOWS\SKR.HTML (Renamed & Submitted)
• C:\WINDOWS\RIB.HTML (Renamed & Submitted)
• C:\WINDOWS\MJR.HTML (Renamed & Submitted)
• C:\WINDOWS\PHT.HTML (Renamed & Submitted)
• C:\WINDOWS\BGU.HTML (Renamed & Submitted)
• C:\WINDOWS\BGB.HTML (Renamed & Submitted)
• C:\WINDOWS\TOM.HTML (Renamed & Submitted)
• C:\WINDOWS\KAG.HTML (Renamed & Submitted)
• C:\WINDOWS\OCN.HTML (Renamed & Submitted)
• C:\WINDOWS\PCL.HTML (Renamed & Submitted)
• C:\WINDOWS\EPS.HTML (Renamed & Submitted)
• C:\WINDOWS\OBE.HTML (Renamed & Submitted)
• C:\WINDOWS\TSO.HTML (Renamed & Submitted)
• C:\WINDOWS\VDO.HTML (Renamed & Submitted)
• C:\WINDOWS\RCC.HTML (Renamed & Submitted)
• C:\WINDOWS\UGT.HTML (Renamed & Submitted)
• C:\WINDOWS\PMK.HTML (Renamed & Submitted)
• C:\WINDOWS\CBK.HTML (Renamed & Submitted)
• C:\WINDOWS\AFC.HTML (Renamed & Submitted)
• C:\WINDOWS\SFF.HTML (Renamed & Submitted)
• C:\WINDOWS\BGR.HTML (Renamed & Submitted)
• C:\WINDOWS\UHU.HTML (Renamed & Submitted)
• C:\WINDOWS\CPU.HTML (Renamed & Submitted)
• C:\WINDOWS\UUV.HTML (Renamed & Submitted)
• C:\WINDOWS\PSC.HTML (Renamed & Submitted)
• C:\WINDOWS\TKM.HTML (Renamed & Submitted)
• C:\WINDOWS\BSL.HTML (Renamed & Submitted)
• C:\WINDOWS\ETN.HTML (Renamed & Submitted)
• C:\WINDOWS\NKH.HTML (Renamed & Submitted)
• C:\WINDOWS\LSV.HTML (Renamed & Submitted)
• C:\WINDOWS\OFJ.HTML (Renamed & Submitted)
• C:\WINDOWS\KDH.HTML (Renamed & Submitted)
• C:\WINDOWS\LBS.HTML (Renamed & Submitted)
• C:\WINDOWS\GSN.HTML (Renamed & Submitted)
Trojan-Downloader.Win32.Small.dam (virus)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198162.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198163.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198164.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198165.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198166.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198167.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198168.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198169.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198170.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198171.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198172.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198173.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198174.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198175.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198176.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198177.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198178.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198179.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198180.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198181.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198182.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198183.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198184.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198185.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198186.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198187.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198188.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198189.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198190.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198191.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198192.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198193.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198194.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP310\A0198195.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP269\A0185968.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP264\A0180852.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167805.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167806.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167807.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167808.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167817.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167818.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167819.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP250\A0167820.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP74\A0057207.EXE (Renamed)
• C:\WINDOWS\SYSTEM32\NCTIMUTE.EXE (Renamed & Submitted)
Trojan-Downloader.Win32.VB.ajp (virus)
• C:\WINDOWS\SYSTEM32\ZXGTPXWB.EXE (Renamed & Submitted)
Trojan-Proxy.Win32.Lager.bu (virus)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP35\A0043078.EXE (Renamed & Submitted)
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\RP24\A0037168.EXE (Renamed & Submitted)
________________________________________
Statistics
Scanned:
• Files: 34503
• System: 12971
• Not scanned: 3
Actions:
• Disinfected: 1
• Renamed: 107
• Deleted: 0
• None: 0
• Submitted: 106
Files not scanned:
• C:\PAGEFILE.SYS
• C:\SYSTEM VOLUME INFORMATION\_RESTORE{2CD7AAF3-5C36-4462-923E-8220F0F20E45}\FIFOED\A002<829.LNK
• C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
________________________________________
Options
Scanning engines:
• F-Secure Libra: 2.4.2, 2007-02-01
• F-Secure AVP: 7.0.171, 2007-02-11
• F-Secure Orion: 1.2.37, 2007-02-10
• F-Secure Blacklight: 1.0.53, 0000-00-00
• F-Secure Draco: 1.0.35, 0260-02-44
• F-Secure Pegasus: 1.19.0, 2007-01-07
Scanning options:
• Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX
• Use Advanced heuristics
________________________________________
Copyright © 1998-2006 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.



Logfile of HijackThis v1.99.0
Scan saved at 9:47:01 PM, on 2/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Upgrader.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\Bill\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe"
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102…all/xscan53.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BE1710C-E8EF-4367-BBA3-46C8DD71EA8C}: NameServer = 194.7.45.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{A468586A-71FF-42A1-9812-F87D40BECEB8}: NameServer = 194.7.45.20
O17 - HKLM\System\CS1\Services\Tcpip\..\{3BE1710C-E8EF-4367-BBA3-46C8DD71EA8C}: NameServer = 194.7.45.20
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Panda Antispam Server Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
O23 - Service: Panda Firewall Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
O23 - Service: Panda Function Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
O23 - Service: Panda Pavkre - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
O23 - Service: Panda PavProt - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
O23 - Service: Panda Process Protection Service - Unknown - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
O23 - Service: Panda Preventium+ Service - Unknown - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
O23 - Service: Panda IManager Service - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe



THanks again for your help!!
Post #7
Hello Billy,

Looking better now. How are things running. Let's do some cleanup and run an Anti-Spyware tool.

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which may be infected anyway).

Click Start>Help and Support>Undo changes to your computer with System Restore
Select Create A Restore Point then click Next. Give it a name it and then click Create

Click Start>Run and type Cleanmgr
Click the More Options Tab.
Click Clean Up in the System Restore section.

Download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program. The program can still be used after 30 days but loses some of the features such as real time scanning.
  • Load AVG Anti-Spyware and then click the Update tab at the top. Under Manual Update click Start update.
  • After the update finishes (the status bar at the bottom will display "Update successful")
  • Then click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.
  • AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
  • Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).
  • Close AVG Anti-Spyware and reboot!
Post the AVG report and a new HJT log and let me know how things are running.

Dave
Post #8
Dave: I will do these things tonight before going to bed, but bad news. I have been unable to connect to the internet from home since last post! Every time I reboot I get a warning message that says, registry error-system had to reset… (Something along those lines anyway, i didn't write it down). If you read ths before 8pm EST, let me know if I should make a change or continue with these directions! Thanks, Bill
Post #10
Hi Dave, I got your reply, so I haven't done anything yet, but I did reboot last night to get the massage for you. It is as follows: A grey box pops up and reads: Windows Registry Recovery: One of the files containing the system's registry data had to be recovered by use of a log or alternate copy. The recovery was successful. Then there was a box with "OK". HOWEVER…. I then tried to open the calculator function and the following box popped up: Windows is shutting down because of an error in NT AUTHORITY\SYSTEM The Remote Procedure Call (RPC) service terminated unexpectedly. and there were a couple bright red boxes with black X's on them and a timer was counting down from about 45 seconds!!! Let me know what to do next. Billy
Post #12
Dave: Doesn't look like that fix found anything. Here is the result of the log: The file "CAF2GN3H.com%2F&kw_type=exact&ad_type=text®ion=topstory_537700&feedback_link=off&cc=175&u_h=768&u_w=1024&u_ah=704&u_aw=1024&u_cd=24&u_tz=-240&u_his=12&u_java=true" in the folder "C:\Documents and Settings\Bill\Local Settings\Temp\Temporary Internet Files\Content.IE5\8GAGB1L7" was not scanned. The file "CAJA4BZD.com%2F&kw_type=exact&ad_type=text®ion=topstory_537700&feedback_link=off&cc=185&u_h=768&u_w=1024&u_ah=734&u_aw=1024&u_cd=24&u_tz=-240&u_his=1&u_java=true" in the folder "C:\Documents and Settings\Bill\Local Settings\Temp\Temporary Internet Files\Content.IE5\E09EU2G0" was not scanned. The file "CA41Y5PQ.com%2F&kw_type=exact&ad_type=text®ion=topstory_537700&feedback_link=off&cc=163&u_h=768&u_w=1024&u_ah=704&u_aw=1024&u_cd=24&u_tz=-240&u_his=10&u_java=true" in the folder "C:\Documents and Settings\Bill\Local Settings\Temp\Temporary Internet Files\Content.IE5\M4KWU42C" was not scanned. The file "CA23ALUX.com%2F&kw_type=exact&ad_type=text®ion=topstory_537700&feedback_link=off&cc=102&u_h=768&u_w=1024&u_ah=704&u_aw=1024&u_cd=24&u_tz=-240&u_his=10&u_java=true" in the folder "C:\Documents and Settings\Bill\Local Settings\Temp\Temporary Internet Files\Content.IE5\SE9H4KEG" was not scanned. The file "CAEBO5AN.com%2F&kw_type=exact&ad_type=text®ion=topstory_537700&feedback_link=off&cc=102&u_h=768&u_w=1024&u_ah=704&u_aw=1024&u_cd=24&u_tz=-240&u_his=1&u_java=true" in the folder "C:\Documents and Settings\Bill\Local Settings\Temp\Temporary Internet Files\Content.IE5\F3XMBZQT" was not scanned. W32.Blaster.Worm has not been found on your computer. In addition, when I boot up the computer, it takes forever to load, then I invariably get the following Error message from Windows: "Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience." If I click on either the Send, or Don't Send Report buttons or close the window, then I get the previously mentioned "Windows is shutting down" message with the countdown clock. If I leave it open, I can continue to utilize the computer (Although it is in an extremely limited role now!). I was able to click on the link to receive more information about the error and found this: Error Signature: szAppname: svchost.exe szAppver: 5.1.2600.2180 szModname: ntdll.dll szModver: 5.1.2600.2180 offset: 00010a77 Further, i then clicked on the "detail" link and found this: The Following files will be included in the report: C:\DOCUME~1\Bill\LOCALS~1\Temp\WER0d8f.dir00\svchost.exe.mdmp C:\DOCUME~1\Bill\LOCALS~1\Temp\WER0d8f.dir00\appcompat.txt None of this means much of anything to me, but I thought it may be helpful to you!! Thanks, Billy
Post #13
Hi Billy,

Please run AVG Anti-Spyware as I had advised in an earlier post but run it in safe mode. Please also provide a log:

Download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop
and double-click it to launch the set up program.
Run AVG Anti-Spyware and update the definition files.
On the main screen select the icon Update then select the Start Update Button. The progress bar will show the updates being installed.
Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
In the Settings screen click on Recommended actions and then select Quarantine.
Under Reports:
*Select Automatically generate report after every scan
*Un-Select Only if threats were found
Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.Reboot your computer into SafeMode. You can do this by restarting
your computer and tap the F8 key just before the loading Windows screen appears. Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the Scanner icon at the top and then the Scan tab
then click on Complete System Scan.
AVG will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following:
*If you have any infections you will prompted, then select Apply all
actions
*Next select the Reports icon at the top.
*Select the Save report as button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
results of the AVG Anti-Spyware report scan along with a new HijackThis log.
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main select the following:
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Please post the logs. I'll look into the latest error message you received in a little more detail later. Is your internet still not working?

Thanks,
Dave
Post #14
Still no internet at home. I will do the smae thing I did with the Worm Fix…. Download the AVG to a travel drive at work and take it home to run the program. I will then save the logs to the same drive and bring it back to work to attach the results to this post for you to review! Thanks for all your help, Bill

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI