What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack Log Submitted

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Could someone please tell me if anything within the below log file could be causing any havoc on my pc, and which ones I can check to remove?

I have turned off most all non-essential programs & services but the erratic behavior persists.

Also I have turned system restore off and run a full scan with AVG 7.5 and Adaware & rebooted before creating this Hijack file for viewing.

Thanks for any replys.

Logfile of HijackThis v1.99.1
Scan saved at 5:22:35 PM, on 7/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PROMon.exe
C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\runservice.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\AOL\ACS\acsd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AbsoluteShield Track Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Track Eraser\cseraser.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/bcd48c1…all/xscan53.cab
O16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/antivirus/PCPAV.CAB
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} - http://de.trendmicro-europe.com/file_downl…eCallButton.CAB
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} - http://www.pulse3d.com/players/english/5.2…yer5.2AxWin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://www.creative.com/su/ocx/15016/CTPID.cab
O16 - DPF: {F8F88D0D-E455-11D6-B547-00400555C7FB} (DiskHealth2 Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNT\runservice.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
Post #2
Howdy Harley11407, Welcome to Tom Coyote. No infection showing here - an unusual log in appearance though. Almost looks like many legitimate items have been partly removed or non-existent there. What methods did you do to reduce items on your system like you mention? Also, what type of "havoc" are you experiencing? If alerts or BSOD's, what error messages are you receiving?
Post #3
Jintan, Thanks for the reply. I simply went into msconfig and prevented various programs from starting with windows and also went into services and stopped non essential items.

I have been having problems with both shutdowns & startups with windows hanging in both.

I d\l and installed the utility called uphclean that will automatically unload any registry strings that may have been holding the process from terminating thus not allowing windows to properly shutdown. I only found one process which was one of the creative soundblaster programs so I simply terminated it from running in windows. This still did not rectify the problem.

I also uninstalled the latest Nvidia video drivers, rebooted in Safe mode and ran the driver cleaner program to remove all traces of nvidia and then re-installed the latest Nvidia drivers 93.71.

Still having problems.

I have been having to start windows up in VGA mode to get windows to load successfully and sometimes it hangs even attempting to load windows using the VGA mode for startup.

I have no artifacts or high temps in the pc cpu or the video card, no low P.S. voltages, ran memtest on the ram, and the pc is dust free and clean.

I even removed the secondary HD I had in it and am currently running just one 120gb and pinned it for CS [cable select]

But the shutdown & startup issues persist.

My display is a LCD 18" VGA\DVI and I have tried both the vga & dvi cable.

Intel P4 2.4 GHZ
1 gig ram
Antec 480 watt PS
I was using an ATI AIW X800XT but switched it out with a nominal load old Nvidia MX440 vid card.

All of windows updates are current with the latest.

I am just about ready to copy my wanted software files & pictures and just junk this pc and buy another, but I have always in the past been able to fix problems with help but this time it is getting the best of me !

I guess I could start uninstalling software programs and running CCleaner afterwards but havent tried that yet.

I havent replaced or reset the CMOS since the battery seems fine since the time is not lagging and I checked the bios and it is still the same from over two years ago when I had written it down.

I have no way of knowing what is causing the freezes during shutdown & startup. I know of no programs I could install that would tell me.

The event viewer in application nor system shows anything that is hanging or not loading causing this scenario.

Anyways sorry for the long reply, but was just wanting you to know all the remedys I have tried.

Regards,

Logfile of HijackThis v1.99.1
Scan saved at 3:49:21 PM, on 7/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\runservice.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\PROMon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AbsoluteShield Track Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Track Eraser\cseraser.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/bcd48c1…all/xscan53.cab
O16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/antivirus/PCPAV.CAB
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} - http://de.trendmicro-europe.com/file_downl…eCallButton.CAB
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} - http://www.pulse3d.com/players/english/5.2…yer5.2AxWin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://www.creative.com/su/ocx/15016/CTPID.cab
O16 - DPF: {F8F88D0D-E455-11D6-B547-00400555C7FB} (DiskHealth2 Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNT\runservice.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
Post #4
Quite a few changes, and sounds like you have been doing some realistic assessment there. Again this log is pretty limited for info - let's take an additional look for now. If nothing shows amiss and no malware indicated might be something to take up at our Other Computer Problems, but let's see.


Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.


1. Close all applications and windows.
2. Double-click on dss.exe to run it, and follow the prompts.
3. When the scan is complete, it will create two text files - main.txt <- this one will be maximized and extra.txt<-this one will be minimized on your Taskbar.
4. Copy/paste both logs back here please (they will also be located at C:\Deckard\System Scanner).

Make sure you notice the extra.txt second log that will show as minimized on your Task Bar, "Maximize" that and be sure to paste those contents here as well.
Post #5 last edited
Jintan, I d\l the program you suggested and will run it and paste the two results in the next reply. In the meantime I d\l the SpeedFan 4.32 utility just to recheck my voltages & temps and everything is still O.K. but after d\l this from a site called filehippo I noticed two additional processes began running in the pc called DLL.HOST.exe/System and MSDTC.exe/ NetworkService and I had not noticed them running in task manager before. Are these valid programs as googling them indicates?

Here is another HiJack log before I paste the other scanner results you need in the next reply:

Logfile of HijackThis v1.99.1
Scan saved at 8:30:47 AM, on 7/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\runservice.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\PROMon.exe
C:\WINNT\System32\dllhost.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\AOL\ACS\acsd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AbsoluteShield Track Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Track Eraser\cseraser.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/bcd48c1…all/xscan53.cab
O16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/antivirus/PCPAV.CAB
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} - http://de.trendmicro-europe.com/file_downl…eCallButton.CAB
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} - http://www.pulse3d.com/players/english/5.2…yer5.2AxWin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://www.creative.com/su/ocx/15016/CTPID.cab
O16 - DPF: {F8F88D0D-E455-11D6-B547-00400555C7FB} (DiskHealth2 Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNT\runservice.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
Post #6
Jintan below are the results from the Scanner you requested:


Deckard's System Scanner v20070729.57
Run by [removed] on 2007-07-30 at 08:35:38
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
16: 2007-07-30 13:35:44 UTC - RP240 - Deckard's System Scanner Restore Point
15: 2007-07-29 19:42:28 UTC - RP239 - System Checkpoint
14: 2007-07-28 19:36:17 UTC - RP238 - After Secondary HD F: removed from pc
13: 2007-07-28 18:51:43 UTC - RP237 - Restore Operation
12: 2007-07-28 15:40:25 UTC - RP236 - Latest with new net 2.0 updates Use this one


– First Restore Point –
1: 2007-07-24 00:03:53 UTC - RP225 - System Checkpoint


Backed up registry hives.

Performed disk cleanup.


– HijackThis (run as Owner.exe) ———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 8:37:02 AM, on 7/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\runservice.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\PROMon.exe
C:\WINNT\System32\dllhost.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\AOL\ACS\acsd.exe
C:\Documents and Settings\Owner\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AbsoluteShield Track Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Track Eraser\cseraser.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/bcd48c1…all/xscan53.cab
O16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} - http://www.pcpitstop.com/antivirus/PCPAV.CAB
O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} - http://de.trendmicro-europe.com/file_downl…eCallButton.CAB
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} - http://www.pulse3d.com/players/english/5.2…yer5.2AxWin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://www.creative.com/su/ocx/15016/CTPID.cab
O16 - DPF: {F8F88D0D-E455-11D6-B547-00400555C7FB} (DiskHealth2 Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINNT\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNT\runservice.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe


– HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) ——————–

backup-20070723-141842-155 O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
backup-20070723-141842-852 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

– File Associations ———————————————————–

.bat - batfile - DefaultIcon - C:\WINNT\System32\shell32.dll,71
.ini - inifile - DefaultIcon - C:\WINNT\System32\shell32.dll,69
.txt - txtfile - DefaultIcon - C:\WINNT\System32\shell32.dll,70
.txt - txtfile - shell\open\command - NOTEPAD.EXE %1


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R0 giveio - c:\winnt\system32\giveio.sys
R0 snapman (Acronis Snapshots Manager) - c:\winnt\system32\drivers\snapman.sys
Post #7
Jintan, just curious but since I have switched out the video card from the ATI AIW X800xt to the Nominal load Nvidia MX440 and ran the Drivercleaner pro program to remove presumably traces of any ATI data do you think because of these trace ATI programs found with the Deckard Scanner that these traces could be causing a conflict in the bootup & shutdown process:

I noticed these and would like to remove them if possible. These actual programs are not installed in the pc but these traces are still in the system:

S1 ATITool (ATITool Overclocking Utility) - c:\winnt\system32\drivers\atitool.sys
Post #8 last edited
Jintan, I did take a closer look at the procedure outlined here in this link I mentioned in my last reply:

http://www.compphix.com/windowsfileprotection.html

I did go to the folder options/view and unchecked hide operating systems folders.

Then went to C:windows/system folder and it is empty. I could not find any folder on the system called C:WINDOWSSystem32Dllcache I have no clue where the 32Dllcache folder is ?
Even hit start and did a search/files or folders for 32Dllcache and it came up with nothing.

The I386 folder is in the C:drive and its contents is 327mb. I would assume that when I upgraded thru windows updates to SP2 a year ago that any sp2 files are now included in this I386 folder right?

I also went in regedit to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSetup
and found the SourcePath registry string and it is pointing to D:

Do you suggest I change this to C: and then attempt to run the sfc/ scannow if you assume maybe it will find any files missing or corrupted and replace them with ones from the I386 folder?

If I do change this SourcePath from D: to C: will I have to reboot the pc as the author indicates?

The only reason Im asking is I hate to shutdown the PC due to the fact it is so darn hard to get it back up & running even in VGA mode as it is now.

But I will if I have to, so the registry change will be recognized by the system.

I will wait until I hear back from you before attempting anything !

Regards
Post #9
The logs are showing you have quite a practice of adding and using different downloaded software, as well as torrent/ripping/burning software that too often show on infected systems. Right off I would ask that you give this procedure of us reviewing here a chance before adding even more. Providing you with details on each service/driver/file you either select as unfamiliar or no longer necessary is, very honestly, beyond the scope of what I might assist with here. But we can see if malware is at fault and make those repairs, and if I do see other issues I recognize as corrections to be made I will surely address those as well.

There are some signature firewall changes often seen brought by infection, and it looks like some altering of some core file associations as well, so let's correct that and get a decent scan in now.


The following show as installed. Each of these can bring "havoc" blocking functions and processes, and all on one system, if active, can bring about changes over time that would be hard to unravel. Disable any of these and any prtections they cause to keep them out of the way while we do repairs please.

Folder Guard
WinGuard Pro
Lock Folder XP
Lock My PC


Right click Here and select Save Target As (Firefox Save Link As) and save UnHookExec.inf to your Desktop.

Then right-click on UnHookExec.inf and select Install.



Then Go to Start - Run, type firewall.cpl (and Enter). Click the Exceptions tab. If the following item(s) is present on that list click to hilight it, and select "Delete", and OK to close the Windows Firewall display. One for the Voice test is only questionable, but if needed you can add this again later, but the other two do not require this exception access.

"C:\WINNT\system32\dpvsetup.exe"
"C:\WINNT\system32\rundll32.exe"
"C:\Program Files\Internet Explorer\iexplore.exe"



Then make sure any active monitoring protective software is disabled, and Download ComboFix.exe from here to your desktop, and click the downloaded file to run the repair.

When the command window opens, select 1 (and Enter). Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Please post the combofix.txt log back here.
Post #10 last edited
Jintan, I did exactly as you stated in your last reply and as the combofix.exe was running I walked away from the pc so as not to accidently touch the keyboard or mouse, and when I came back the PC was attempting to shutdown and was froze at the savings your settings phase. I went ahead and manually shutdown with the power button on the pc and rebooted in F8/ VGA Mode and the combofix program window came up and commenced creating the log file which is below:

I did check the exceptions tab in the firewall and the only exceptions listed now are these:

FILE AND PRINTER SHARING =Has a check by it.
UPNP FRAMEWORK = Has a check by it.
Remote Desktop= Does not have a check by it.

Also I have NOT been installing or uninstalling software applications for around a yr. now. I used to be involved in torrent sharing but havent done that in over a year now. And when I did I was a member of a private club that made sure ALL torrents were virus, spyware,& malware clean before even allowing the file to be shared as it was also screened by the admins before being posted for sharing.

BTW, I did uninstall three of the four Folder guard apps you suggested could cause a problem before doing these last tests for you. I only left the Lock Folder 3.2 installed.

Here is the combofix log:

ComboFix 07-07-30.2 - "Owner" 2007-07-31 8:03:14.1 [GMT -5:00] - NTFS
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINNT\DOWNLO~1.\ODCTOOLS


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_NM
——-\LEGACY_NPF


((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-31 )))))))))))))))))))))))))))))))


2007-07-31 08:02 51,200 –a—— C:\WINNT\nircmd.exe
2007-07-30 08:35 d——– C:\Deckard
2007-07-30 08:04 d——– C:\Program Files\SpeedFan
2007-07-28 20:04 23,600 –a—— C:\WINNT\system32\drivers\TVICHW32.SYS
2007-07-28 19:48 d——– C:\WINNT\LastGood.Tmp
2007-07-28 13:52 d——– C:\WINNT\nview
2007-07-28 13:51 d——– C:\NVIDIA
2007-07-28 13:42 d——– C:\NVIDIA(2)
2007-07-28 13:23 d——– C:\WINNT\nview(2)
2007-07-28 10:40 7,864,320 –a—— C:\DOCUME~1\Owner\ntuser.dat
2007-07-28 09:02 d——– C:\Program Files\Lavasoft
2007-07-22 22:59 d——– C:\Program Files\Windows Installer Clean Up
2007-07-21 21:39 d——– C:\Program Files\MSECACHE
2007-07-21 21:37 d——– C:\WINNT\SxsCaPendDel
2007-07-20 19:20 d——– C:\Program Files\UPHClean
2007-07-20 18:52 d——– C:\DOCUME~1\ADMINI~1.SIL\APPLIC~1\MSN6
2007-06-26 11:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
2007-06-26 10:57 208,896 –a—— C:\WINNT\system32\NVUNINST.EXE
2007-06-26 10:57 208,896 –a—— C:\WINNT\system32\nvudisp.exe


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-31 08:11 1121 –ahs—- C:\WINNT\system32\mmf.sys
2007-07-31 08:05 384 –a—— C:\WINNT\system32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10021102}.dat
2007-07-31 08:05 384 –a—— C:\WINNT\system32\DVCState-{00000002-00000000-00000002-00001102-00000004-10021102}.dat
2007-07-30 20:46 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-07-30 20:45 ——— d——– C:\Program Files\Recover My Photos
2007-07-30 20:39 ——— d——– C:\Program Files\LMPC3
2007-07-30 20:36 ——— d——– C:\Program Files\Video-AVI to GIF Converter
2007-07-20 15:43 ——— d——– C:\Program Files\PCBugDoctor
2007-07-20 13:03 1324 –a—— C:\WINNT\system32\d3d9caps.dat
2007-07-18 12:11 38567 –a—— C:\WINNT\system32\pcpbios.exe
2007-06-29 10:07 ——— d——– C:\Program Files\FaceOnBody
2007-06-28 12:20 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\uTorrent
2007-06-28 09:51 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\MSN6
2007-06-26 10:11 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\ATI
2007-06-03 09:39 ——— d——– C:\Program Files\Ontrack
2007-06-03 08:01 ——— d——– C:\Program Files\AimOne_AlltoMP3
2007-06-03 07:57 ——— d——– C:\Program Files\Canon
2007-06-03 07:47 ——— d——– C:\Program Files\GetSmile
2007-05-31 11:23 ——— d——– C:\DOCUME~1\Owner\APPLIC~1\LimeWire
2006-12-08 14:16 1940 –a—— C:\DOCUME~1\Owner\APPLIC~1\ViewerApp.dat
2006-08-11 11:19 64512 –ah—– C:\DOCUME~1\Owner\APPLIC~1\dach100.dll
2004-12-02 12:44 2352 –a—— C:\DOCUME~1\Owner\APPLIC~1\mpauth.dat
2004-05-20 00:13 1815 –a—— C:\DOCUME~1\Owner\APPLIC~1\D - LITE-ON - DVDRW LDW-411S - FS0J.dat
2004-05-20 00:13 1622 –a—— C:\DOCUME~1\Owner\APPLIC~1\E - MATSHITA - DVD-ROM SR-8588 - 7Z11.dat
2004-05-20 00:13 1613 –a—— C:\DOCUME~1\Owner\APPLIC~1\G - AXV - CD-DVD-ROM - 2.2a.dat
2003-06-01 13:46 8224 –a—— C:\DOCUME~1\Owner\APPLIC~1\GDIPFONTCACHEV1.DAT
2003-01-09 13:10 30081 –ah—– C:\Program Files\fiz20
2003-01-09 12:13 30020 –ah—– C:\Program Files\fiz19
2003-01-09 10:52 30099 –ah—– C:\Program Files\fiz18
2003-01-07 23:57 30039 –ah—– C:\Program Files\fiz17
2003-01-07 17:54 30034 –ah—– C:\Program Files\fiz16
2003-01-07 02:32 30069 –ah—– C:\Program Files\fiz15
2003-01-06 11:16 30004 –ah—– C:\Program Files\fiz14
2003-01-05 17:25 30019 –ah—– C:\Program Files\fiz13
2003-01-05 16:53 30087 –ah—– C:\Program Files\fiz12
2003-01-05 01:11 30099 –ah—– C:\Program Files\fiz11
2003-01-04 14:28 30040 –ah—– C:\Program Files\fiz10
2003-01-04 13:50 30004 –ah—– C:\Program Files\fiz9
2003-01-04 13:07 30015 –ah—– C:\Program Files\fiz8
2003-01-03 17:42 30044 –ah—– C:\Program Files\fiz7
2003-01-03 12:08 30095 –ah—– C:\Program Files\fiz6
2003-01-01 20:29 30077 –ah—– C:\Program Files\fiz5
2002-12-19 16:58 30064 –ah—– C:\Program Files\fiz4
2002-12-18 23:10 30088 –ah—– C:\Program Files\fiz3
2002-12-17 01:01 30154 –ah—– C:\Program Files\fiz2
2002-12-16 16:59 30130 –ah—– C:\Program Files\fiz1
2002-07-26 18:02 153088 –a—— C:\Program Files\UNWISE.EXE
2005-04-08 05:41:04 1,121 –sha-w C:\WINNT\system32\mmf(10).sys
2005-04-08 03:01:51 1,121 –sha-w C:\WINNT\system32\mmf(11).sys
2005-04-08 05:55:45 1,121 –sha-w C:\WINNT\system32\mmf(12).sys
2005-04-08 06:00:48 1,121 –sha-w C:\WINNT\system32\mmf(13).sys
2005-11-02 23:12:03 1,121 –sha-w C:\WINNT\system32\mmf(14)(2).sys
2006-01-10 01:29:21 1,121 –sha-w C:\WINNT\system32\mmf(14)(3).sys
2005-10-31 19:21:04 1,121 –sha-w C:\WINNT\system32\mmf(15)(4).sys
2006-01-07 14:35:32 1,121 –sha-w C:\WINNT\system32\mmf(15)(5).sys
2004-04-02 18:37:52 1,121 –sha-w C:\WINNT\system32\mmf(7)(17).sys
2004-03-31 01:42:17 1,121 –sha-w C:\WINNT\system32\mmf(7)(18).sys
2004-03-30 23:15:59 1,121 –sha-w C:\WINNT\system32\mmf(7)(19).sys
2004-05-28 14:16:11 1,121 –sha-w C:\WINNT\system32\mmf(7)(20).sys
2005-03-18 19:06:41 1,121 –sha-w C:\WINNT\system32\mmf(7).sys
2004-04-02 18:26:58 1,121 –sha-w C:\WINNT\system32\mmf(8)(10).sys
2004-03-29 23:44:10 1,121 –sha-w C:\WINNT\system32\mmf(8)(11).sys
2005-03-18 14:44:31 1,121 –sha-w C:\WINNT\system32\mmf(8).sys
2005-04-08 05:49:00 1,121 –sha-w C:\WINNT\system32\mmf(9)(11).sys
2005-04-08 05:49:00 1,121 –sha-w C:\WINNT\system32\mmf(9).sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PROMon.exe"="PROMon.exe" [2002-04-18 19:32 C:\WINNT\system32\PROMon.exe]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINNT\system32\nwiz.exe]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-07-23 14:40]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSAppLogo5ChannelNotify"=1 (0x1)
"NoToolbarCustomize"=0 (0x0)
"NoBandCustomize"=0 (0x0)
@=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"Btn_Back"=0 (0x0)
"Btn_Forward"=0 (0x0)
"Btn_Stop"=0 (0x0)
"Btn_Refresh"=0 (0x0)
"Btn_Home"=0 (0x0)
"Btn_Search"=0 (0x0)
"Btn_History"=0 (0x0)
"Btn_Favorites"=0 (0x0)
"Btn_Media"=0 (0x0)
"Btn_Folders"=0 (0x0)
"Btn_Fullscreen"=0 (0x0)
"Btn_Tools"=0 (0x0)
"Btn_MailNews"=0 (0x0)
"Btn_Size"=0 (0x0)
"Btn_Print"=0 (0x0)
"Btn_Edit"=0 (0x0)
"Btn_Discussions"=0 (0x0)
"Btn_Cut"=0 (0x0)
"Btn_Copy"=0 (0x0)
"Btn_Paste"=0 (0x0)
"Btn_Encoding"=0 (0x0)
"Btn_PrintPreview"=0 (0x0)
"NoFavoritesMenu"=0 (0x0)
"NoSetActiveDesktop"=0 (0x0)
"NoChangeStartMenu"=0 (0x0)
"NoRecentDocsHistory"=0 (0x0)
"ClearRecentDocsOnExit"=0 (0x0)
"NoLogoff"=0 (0x0)
"NoClose"=0 (0x0)
"NoSetFolders"=0 (0x0)
"NoSetTaskbar"=0 (0x0)
"NoTrayContextMenu"=0 (0x0)
"NoFileMenu"=0 (0x0)
"NoViewContextMenu"=0 (0x0)
"EnforceShellExtensionSecurity"=0 (0x0)
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoNetConnectDisconnect"=0 (0x0)
"NoDeletePrinter"=0 (0x0)
"NoAddPrinter"=0 (0x0)
"NoPrinterTabs"=0 (0x0)
"NoLowDiskSpaceChecks"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINNT\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
backup=C:\WINNT\pss\hp psc 2000 Series.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDet]
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DU Meter]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrustPPAP]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HomeAlarm]
C:\Program Files\Chameleon Clock\ChamClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAVPersonal50]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteCenter]
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search and Recover Disk Image Service]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Speaking Clock Deluxe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyStopper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperCleaner]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tray Temperature]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tukati:1]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer]
C:\Program Files\Webroot\Washer\wwDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wwSecSvc"=2 (0x2)
"svcWRSSSDK"=2 (0x2)
"McDetect.exe"=2 (0x2)
"AOL ACS"=2 (0x2)
"AcrSch2Svc"=2 (0x2)

R0 IdeBusDr;IdeBusDr;C:\WINNT\system32\DRIVERS\IdeBusDr.sys
R0 IdeChnDr;Intel® Ultra ATA Controller;C:\WINNT\system32\DRIVERS\IdeChnDr.sys
R0 snapman;Acronis Snapshots Manager;C:\WINNT\system32\DRIVERS\snapman.sys
R0 speedfan;speedfan;C:\WINNT\system32\speedfan.sys
R0 SSI;SSI;C:\WINNT\system32\Drivers\SSI.SYS
R0 timounter;Acronis TrueImage Backup Archive Explorer;C:\WINNT\system32\DRIVERS\timntr.sys
R1 cdrbsdrv;cdrbsdrv;C:\WINNT\system32\drivers\cdrbsdrv.sys
R1 MBMIoDrvr;mbmiodrvr;\??\C:\WINNT\System32\mbmiodrvr.sys
R1 PCLEPCI;PCLEPCI;\??\C:\WINNT\System32\drivers\pclepci.sys
R1 Sk9920nt;PS/2 Keyboard Filter Driver for NT 4.0;C:\WINNT\system32\DRIVERS\Sk9920nt.sys
R2 ElbyCDIO;ElbyCDIO Driver;C:\WINNT\system32\Drivers\ElbyCDIO.sys
R2 hmonitor;hmonitor;\??\C:\WINNT\system32\drivers\hmonitor.sys
R2 lf;lf;\??\C:\Program Files\Lock Folder XP 3.2\UniShieldXP.sys
R2 LicCtrlService;LicCtrl Service;C:\WINNT\runservice.exe
R2 NMSSvc;Intel® NMS;C:\WINNT\System32\NMSSvc.exe
R2 RioPNP;RioPNP;C:\WINNT\system32\drivers\RioPNP.sys
R2 Sentinel;Sentinel;C:\WINNT\system32\Drivers\SENTINEL.SYS
R2 tifsfilter;Acronis TrueImage FS Filter;C:\WINNT\system32\DRIVERS\tifsfilt.sys
R2 xinstall;xinstall;\??\C:\WINNT\System32\drivers\xinstall.sys
R3 ctgame;Game Port;C:\WINNT\system32\DRIVERS\ctgame.sys
R3 E100B;Intel® PRO Network Connection Driver;C:\WINNT\system32\DRIVERS\e100b325.sys
R3 GTWModem;GTW V.92 Voicemodem;C:\WINNT\system32\DRIVERS\GWMDM.sys
R3 LMPC2;LMPC2;C:\WINNT\system32\drivers\LMPC2.sys
R3 MarvinBus;Pinnacle Marvin Bus;C:\WINNT\system32\DRIVERS\MarvinBus.sys
R3 NMSCFG;NIC Management Service Configuration Driver;\??\C:\WINNT\system32\drivers\NMSCFG.SYS
R3 Pcouffin;Low level access layer for CD devices;C:\WINNT\system32\Drivers\Pcouffin.sys
R3 Sk99202k;PS/2 Keyboard Filter Driver for Win2000;C:\WINNT\system32\DRIVERS\Sk99202k.sys
R3 wanatw;WAN Miniport (ATW);C:\WINNT\system32\DRIVERS\wanatw4.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINNT\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINNT\system32\drivers\WmXlCore.sys
S1 ATITool;ATITool Overclocking Utility;C:\WINNT\system32\DRIVERS\ATITool.sys
S2 CDRPDACC;Arrowkey Device Access;\??\F:\Program Files\321Studios\Shared\CDRPDACC.SYS
S2 DVR2INS;ADS Instant DVD 2.0;C:\WINNT\system32\Drivers\dvr2ins.sys
S3 AGBFMON;AGBFMON;C:\WINNT\system32\drivers\AGBFMON.sys
S3 AnyDVD;AnyDVD;C:\WINNT\system32\Drivers\AnyDVD.sys
S3 ASAPIW2k;ASAPIW2K;C:\WINNT\system32\drivers\ASAPIW2k.sys
S3 ATIAVAIW;ATI T200 Unified AVStream service;C:\WINNT\system32\DRIVERS\atinavt2.sys
S3 BCMModem;BCM V.90 56K Modem;C:\WINNT\system32\DRIVERS\BCMDM.sys
S3 C-Dilla;C-Dilla;\??\C:\WINNT\System32\drivers\CDANT.SYS
S3 MPE;BDA MPE Filter;C:\WINNT\system32\DRIVERS\MPE.sys
S3 MxlW2k;MxlW2k;C:\WINNT\system32\drivers\MxlW2k.sys
S3 PcdrNt;PcdrNt;C:\WINNT\system32\drivers\PcdrNt.sys
S3 RadProbe;Radeon Probe Driver;C:\WINNT\system32\DRIVERS\RadProbe.sys
S3 SaiNtHid;SaiNtHid;C:\WINNT\system32\DRIVERS\SaiNtHid.sys
S3 Sntnlusb;Rainbow USB SuperPro;C:\WINNT\system32\DRIVERS\SNTNLUSB.SYS
S3 TVICHW32;TVICHW32;\??\C:\WINNT\system32\DRIVERS\TVICHW32.SYS
S3 usbcm;USB Cable Modem 351000 NDIS Driver;C:\WINNT\system32\DRIVERS\usbcm.sys
S3 usbprint;Microsoft USB PRINTER Class;C:\WINNT\system32\DRIVERS\usbprint.sys
S3 VNUSB;VN Series Device;C:\WINNT\system32\DRIVERS\VNUSB.sys
S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINNT\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINNT\system32\drivers\WmVirHid.sys

*Newly Created Service* - NMSCFG
*Newly Created Service* - NMSSVC

Contents of the 'Scheduled Tasks' folder
2006-11-29 02:58:19 C:\WINNT\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1156800542.job - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-31 08:10:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\TP\23]
"DisplayName"="\x3e94\23\x40cc\23"
"DeviceDesc"="\x3e94\23\x40cc\23"
"ProviderName"=""
"MFG"="\x435c\x616c\x7373\"
"ReinstallString"="C:\WINNT\System32\ReinstallBackups\\x5054\23\DriverFiles\.INF"
"DeviceInstanceIds"=str(7):"7-88-030430m-008946c-efg\2kxp_inf\cx_08946.inf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall\XP\23]
"DisplayName"="\x3e98\23\x40d0\23"
"DeviceDesc"="\x3e98\23\x40d0\23"
"ProviderName"=""
"MFG"="\x435c\x616c\x7373\"
"ReinstallString"="C:\WINNT\System32\ReinstallBackups\\x5058\23\DriverFiles\.INF"
"DeviceInstanceIds"=str(7):"7-88-030430m-008946c-efg\2kxp_inf\cx_08946.inf"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG06.00.00.01WORKSTATION"="B76C2AAB48686E974AB8EF4601CF755A50D5CEBF9ECB88E24994E780A71E640B0D4A9EA8C03
E84DD930FE79FDE97F9669922888C3F4926021514BC63DF8941DC8353852594997F5D5080218E4BE
FD6C70B27CE24FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEB
9E127BECC74CFEBC9E127BECC74C9DB7CE019D40AA5CA9C6AECB7A5D1407A9C6AECB7A5D14078EDD
E5BE2F6E667385314D8F77FFBCF28CC19849F0CB9FCAAF62DB07FCE9A0988AF7F76F0D879A84EDA3
41DDE34F0F178C97ACAC7E201420B6B17304CBC367B078B961D8527C505B6EF0E5CED955037C9F75
96AD75BFD186ADBB891F3A10680952142598E159BCE5F63DD29661E1BAD286D67AC401AD46EA4956
0EAE1F44F4AAEC9B8E550B54EB01B3E460D1ED2AD24B2EFBD9A1BD12517BBB94F7A6586961DEC491
AB35926CBACF8D5F8A93E66E733DA1D6E29DB16400B1B655ECB221C6C5E45ECF2F8B0A3D73FBDB48
403BEA400E8BA5F8C8BDA391707A33665102E89158011940B974435198FD26CDA9C434FD8C4B941D
7E0E1F0CE1274C62D33401E807AA901CD3BDBCC1DAD757A3F70A61BE3170C127076DCD9CC0B44CD1
A3F6378E2E5235D1D12DB0B6B18F6B1E060764CF64D32230E404201588645A1BF5C4D03E06EBF126
6D6B9D1E48689288281798B18D62EF845AAE7D69CB7616F0046B7CF6574616D9D5F765E151052819
A351DA8E232891E587AA44D046699F4E7D0A851F0BC012EEB0CB5183855A13A55FB202966C1904C5
6389220BB12F61DCBB9A87DF4613E441771236767470B498ABBCAF2899A9E1E3830FE7A680983607
10033E9B27E2EFC3F25169D4D15A4D615C03DBF5DBF255ED0B47C340131A3E3925E5908C0E34F24C
05CA894C9B53381597DF9CE22D68A218F2DD55A0951111468249A77A0AA86AADBC737901196AEECC
0EED59C2660FFA5DF77A74578367021E95F532810115BD009C1BD61EB9A98AA18FCBF9297DE70DE4
2726CFDD005595A96AE34E5393FC3F5E74D19F921BEA499DE97BDD4404E48ED6B72C6109B5E590B8
C59C161756636F3BBC2EC4123FE9C95E4FD15A13310790B5222C388A1FA06CC531A9F12264A66F29
B8EB014AFEB1A72E08A5FA03203BAA61E67308BA53292C159C2E727A4F9CC4C4F5982F4C821C7862
5E9FD7A45B2F99F3E94ACA057964619AEF7EB485B034C012CE14C6F665638710E76AE9939403EEAA
5E83C82C11C9747DDCE21AAFD2725525756DE5A75D2E6CF66244EBC15A006B8B3869719BA48D4A35
8603EB7C76A1C1FAC954C8F4CD99AE3BC23D91A844C80B10AD58F779CC146863E53755A8CA5C0667
5864968DF9B5E70D037377E809E0159FE3C0175DE4F4309445EA5652103396F331619BCEC68052E6
7B072ABB79EDB5AFC64C8D8A8555"
"OODLED02.00.00.02WSSV"="B3F6CB623FD1C252A37E5A3DC711B9322845C484103A719CB1667C23A6E2145B0AF9C6179D0
D81F1FC4B787663347B655B2B823AC400E926FA6A64F422DDBA68511FDAB9D14DB0A8B628F5F6C83
3F26842503C2E9B15831723B0AD6688E0D9E71588F856475E7F3D7C93D04F38751D6406F4308E028
07FE795B922EC8CF13F8D1A3EA2434D4438AAC17FCCB3DEB3A530435F7895BCE09803D0F6B787337
48106AD02269A966B4FFE9499E232D827C135439C2245B24BF8F6D4B565BF09B1FEBC9E127BECC74
FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C
EDD5E5BE2F6E667A2D97226D213B555BA7FD869164D6794BA7FD869164D6794C492C8C81F8B53869
EF24EA56C56412BC6C1E946C55A6C6C704A4D514F766A400E74E5707626460E051F40977EEB7BF8D
8E0A68FA5BC3BCEA2017FFA121E7EB4A035220C64E32A36972B42E3E61272E8C0C78235C56501C7B
A0FD921D88B20AEC89AAC964721D897F2A0ED41FC26A39D2AD3659E0347C2A7878903524A1E9A673
8881BEC18C5523E78F548BDF5B7652D12613A5D22627116A00F02E7CB9EB8CDD26524393D059079C
1C011BBFC0DF2498B75B4E0BBE9EADD6E0DEDB4B22EE0B900047BA320E44CDD3B184C6183F19800B
1038030EF33587A04F326CA9600AC4A2AAE15296BF347237D1D7FD9BF077D531DBDF136A8B89B918
ACA3D7F42329BDC947213779A96BC45DD9BDC5A627CA82F759D3A370B8F6C416396362091669CD59
36CD669F131743F0C28FCA7F40D4C196A0FE5214559E1E38D2941F1184C00E817B5683FDD0312A5C
9E08CC74DC0996C73CCEE9EF29D741E26CAC236F237D977B72AC5306BF9E28EC3153F42D45339C0B
A10CDD13F3D8DB4D7C265E335941EEDCA4B53803AC2739326AD51A946EB6D94DCC4228668C9BEC2C
845542BBB646301CCC406E39C74522F5C866F655F55B8789E794AC65DB5D905CD7605BE3FB6DC676
0EEED799EF03CCF3E9028D83B514B1AD821E76CF288685007CA83D19B867A9E198728A958DE4C150
FAD42D45488B2F5E9BE1A5B4EF55A2BC2E931AF497D88BEC07C36A2C898159872997A34652B4189F
BC32D6A5927040CF367C609BB34EBB63DEFD57500CC687EEE0EFE90137DDF29CA3F15001E72D76BD
6156FEA01F9FF350DD74B365663E14F85CF69BC3DABC6BC786E207AB1034327E65BA2008753A08B8
4C78872C50ED3C227B805AF089F3AC6510FB3021BE69FBE5B59D8C8D185B7C35BC0BBF1AA3B2E201
E30CB7852ACE3DDB07DF38F2ED53D9B08DBDCC18FD3010E1C6B7C197E075B4650C145094B3C47666
B87773DFC545ED52483936B527D9518358B56D24B617A3AB9A481BD451D1133D04CFB62FB8B313F5
832E3569131A45DB6BB6E47D8DC0"
"OODEFRAG08.00.00.01WORKSTATION"="1943D3C849F34F4FF05EBB134FE73D7B0013A05D7EAD6446657FC2129D6ECB8BB2EFA8D901B
11F6E58AA18B436277D2E2BF6168138683AF8F1CA4A68A97AC5BED5A66529B0E9A20D5CDA5F30A00
45DB09D3E91F4FB3E6B52485079F04046CC55FDB35EB635A6B794CC7E44594052E7A5941FBF11E4B
C0F24FFE7C17B65747D82E3B9D91923462DA7EE96B09BAEFFEBC9E127BECC74CFEBC9E127BECC74C
EBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A
D97226D213B555BA7FD869164D6794BA7FD869164D67946B4128179938DD58B1EACB25EB757F040A
18089FBD184D463D703E7C227226B0F5E4B03F6DE65320CD2F77C3A7243B19802052F9871F8E9171
D11450A0B841C2A1803A72213006323894CA4BA8D5FCB0CFF420A1D3897A5D9FAEF145F8829623CF
07FE59517EAFC2C8FE3C2CA46DB87E283E2AAE2990168DBAFD53FF0D7868317181A9C79863A7BA1A
213CAA348C0A19BA0037AB9E3923B9C499D1F0A36FE8840BD3562C7D1470F2FE5CC244D48E5733F3
34360A42627042B1D8402E4F20B8D2FFBC831905CD1DA7676D732F2A543D8DF7D3DD7C70BC8E87AB
D1552F77D9881CE41A30E8B94A79CE53F0B66BD955108103058ABBF209FB1967A8BC2927F5B0C165
676C19739D41C5976362EF64948332DF297462A22B146FE6CAE0E6F35A4E058BFF16CA3AE544475C
B9418F0DD29D1850BF42410065907274C52E0320E98F1C28394D5375C40316AFEDBEF3466442E4D9
A1D8E43565E368A426CD7F4E6B7931802DADB8356E5AFF9A252404C9674B8C29F59A9C125E73CED8
BF2925E696A4FBA7A3398A1D51BADC4FBFCD28E75CBA320F0DF0025A3A80539933735619BDBAB3AC
62BEB127AB0060CD93D9C39F5183F0A630541DEB580DFA5667A6212144513337733BE11EC9216140
F31C4E8F037A061ACB71808E3EB0FA0DC256C7D2356103001ACBDB86E3A1C95099CCD2CD2D641D83
D35F34E3ED20BED97F3950801DC093B6A1394FBAC32B1BB998B532AD2F48D055865CD520A49EC648
30BB1425B3541BF3484552F74574F1A467C0EC2E14B81BBC8E884AB00CDB5F63B45EAE9F0B19A148
E5AE5D5CA602BAE25F0B87FA025D18F72833CC286B7634160826072F92FE83FC32363D9A8643670B
1D010D6CFBCC8A0400FE569602867DC21687250D129CF475D54F9A3896F3E5D3E20C9F3E8CC02A6D
5C0058F627433A266564143637CC7E4087F36452F594ECFC376024F46F9300A7D02EB39A26B4779A
D15692E45E5AC9399FC9910C702EC3A4B086CD4155A16AF618ADCDB3C0DEF2735377E18028158F48
DFA52AD55CDF54FFD015C37C5C7D2E32B6E7C27D9E27442093A8C3F5822D1F9FB6F30B7BABAE1F1F
4A90845130BCFBB7D9E8B233038F"

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-31 8:14:21 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-07-31 08:13

— E O F —
Post #11 last edited
Very unusual log info showing here. A registry setting new to me - disables notifications when this system gets mass distribution downloads while on a network - is your computer a work computer or part of a network? Also new services related to your NIC card and it's net functions. Related to some of those recent changes you made? And new eLicensing activity as well, though another I am not familiar with when it comes to malware assessment issues. The system does have the LicCtrl Service - often indicates running some game or copyrighted action (CD etc.) Let's allow a solid scan to see if any of this now is actually malware related. We'll have to see if that Lock Folder software doesn't cause problems - it basically loads as a rootkit and so some tools/scans may have issues with it.

I realize some of the wording I am using may come off as a bit harsh, but after seeing thousands of system logs your system's setup shows as one that has undergone more changes/alterations/adds/subtracts of software and files and registry activities than most others I have reviewed. If this were my personal computer I would be considering reinstalling, just to get a fresh start of things (and without all the stealth lock/encrypt/block software interfering). It is most difficult to see through all the change to truly assess which is friend or foe.




Go to Start -> Run -> type regedit (and OK)

Go to File->Export and save the registry somewhere as a backup (not to a temp folder). If the following steps lead to difficulties afterwards you can use this backup to restore the registry.



Still in the Registry Editor, navigate to the following key(s) and perform the actions indicated:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List]

In the right column, locate the following "Name", right click on it, and select "Delete". Repeat this for all items listed. Then close the Registry Editor.

"C:\\WINNT\\system32\\dpvsetup.exe"
"C:\\WINNT\\system32\\rundll32.exe"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"



Then Go here and download the free version of SUPERAntiSpyware and install it.

After installation accept any prompts to allow SUPERAntiSpyware to install the latest infection definition files. Next follow the prompts to complete the installation. For now, uncheck the option to have SUPERAntiSpyware "Automatically check for program and definition updates". Providing an email address and allowing the software to send diagnostic reports to it's research center are up to you. Do NOT allow SUPERAntiSpyware to Protect your Home Page settings.

Once the installation is complete open SUPERAntiSpyware and press the Preferences button. Under the General and Startup tab, uncheck the following (leaving all other settings as is).

Start-up Options:
*Start SUPERAntiSpyware when Windows starts

Automatic Updates:
*Check for program updates when the application starts.

Start-up Scanning:
*Check for updates before scanning on startup.

Then select Close. Don't scan just yet though.


===============================================

Reboot into Safe Mode (at startup tap the F8 key and select Safe Mode). I am not sure what access you have now but Safe Mode is preferred for this scan.


Open SUPERAntiSpyware and click the Scan your Computer button. Making sure that Fixed Drive (NTFS) is checked (typically the C Drive), check "Perform Complete Scan", then click Next. SUPERAntiSpyware will now complete a system scan.


SUPERAntiSpyware will now scan your computer and when its finished it will list all the infections it has found. Make sure that they all have a check next to them and click next. If prompted allow the reboot (or manually reboot at this time), and after the reboot open SUPERAntiSpyware again (double click the bug-shaped Taskbar icon).

Click Preferences, then under the Statistics/Logs tab, click to select the most recent Scan Log, then click View Log. Save the log to your desktop, and copy/paste the text from the log back here please.
Post #12 last edited
Still in the Registry Editor, navigate to the following key(s) and perform the actions indicated: CODE[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List] In the right column, locate the following "Name", right click on it, and select "Delete". Repeat this for all items listed. Then close the Registry Editor. "C:\\WINNT\\system32\\dpvsetup.exe" "C:\\WINNT\\system32\\rundll32.exe" "C:\\Program Files\\Internet Explorer\\iexplore.exe" Jintan, Can I just simply export the registry backup to the desktop? Also will deleteing these strings in the registry prevent me from accessing the internet and running any apps before I go to your next step of d\l and installing the antispyware program? The pc is simply a single home desktop setup on a broadband connection thru Roadrunner at this time fixing to be switched over to the Comcast server soon. Comcast may have done something in the network getting ready for this transition from Roadrunner to the Comcast server that your seeing. I have no clue. I also do use the free AOL 9.0 as my primary e-mail client but it still runs thru the Roadrunner client server at this time before the switch to Comcast. Running the free version of AVG 7.5 with resident shield and using the SP2 Firewall. I should be able to boot up in Safe mode with networking as I have done this recently and it worked. Regards
Post #13
You don't want to save anything you need for recovery on your desktop - even a simple scheduled desktop cleanup tool can remove it. Also your desktop is more an interactive user's console, and storing large files there bogs down functions 9reason for only using desktop shortcuts). Internet Explorer (browsers in general) has a net access independent of the firewall, so when it shows as an exception it is not supposed to need that - often a method used by infection. Same with the other files - the speech one is suspect, and you can return that if needed, and the other is used to run .dll's as executables, and is highly suspect when it has firewall permissions. Infection, if active in Safe Mode, would also like you to boot into Safe Mode with Networking. We won't make progress unless you go along with the steps as suggested. If you question and ask for details for each step I really am not sure how much I will be able to assist you here.
Post #14
No problem, I will export the total registry backup to the documents section and do or attempt to perform the steps you have outlined. The only reason I mentioned booting up in Safe Mode with networking is the fact that a few months back the pc would not bootup in normal safeboot but only safemode with networking. So I always just disconnected my modem when booting up in safemode with networking just in case there was an infection. Regards
Post #15
I had never thought of it that way doing Networking but disconnecting. But /w Networking adds services that infection may take advantage of - we really want to keep Safe Mode simple, so we can catch infection during idle time.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI