What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Delayed Pc Response On Commands And I.e Performance

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Did you have another go at uploading that file? LDTate provided a username and password to use?

Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
  • Close ALL OTHER PROGRAMS.
  • Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
  • Now click the Run Scan button on the toolbar.
  • The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Save the log on your desktop.
Now post that log in your next reply.
Post #32
Scotty

Please note that the scan only took approx 12 mins to complete…..is this normal….should I click on Run fix ?
Anyway, the result is below

Also, until my pc is protected I am keeping its online time to a bare minimum, ie;- retrieving your instructions, downloads and replying. So I will attempt to upload that other file once im protected again.

As mentioned before, there is nothing in the compressed file to upload anyway.

A.T


WinPFind3 logfile created on: 19/09/2007 15:21:38
WinPFind3U by OldTimer - Version 1.0.42 Folder = C:\Documents and Settings\Andreas\Desktop\WinPFind3u\
Microsoft Windows XP Service Pack 1 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2800.1106)

511.01 Mb Total Physical Memory | 284.02 Mb Available Physical Memory | 55.58% Memory free
1.22 Gb Paging File | 0.98 Gb Available in Paging File | 80.38% Paging File free
Paging file location(s): C:\pagefile.sys 0 0;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.69 Gb Total Space | 58.42 Gb Free Space | 76.18% Space Free
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: HOME-EL12ACTDJT
Current User Name: Andreas
Logged in as Administrator.
Current Boot Mode: Normal


[Processes - Non-Microsoft Only]
avgamsvr.exe -> %ProgramFiles%\Grisoft\AVG7\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.453 | Size = 353280 bytes | Modified Date = 12/09/2007 18:19:22 | Attr = ]
avgcc.exe -> %ProgramFiles%\Grisoft\AVG7\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.480 | Size = 416256 bytes | Modified Date = 12/09/2007 18:19:22 | Attr = ]
avgemc.exe -> %ProgramFiles%\Grisoft\AVG7\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.482 | Size = 353280 bytes | Modified Date = 12/09/2007 18:19:22 | Attr = ]
avgupsvc.exe -> %ProgramFiles%\Grisoft\AVG7\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/09/2007 18:19:26 | Attr = ]
dragdiag.exe -> %ProgramFiles%\Thomson\SpeedTouch USB\dragdiag.exe -> THOMSON Telecom Belgium [Ver = 301.0.0.12 | Size = 866816 bytes | Modified Date = 26/01/2004 11:38:38 | Attr = ]
googletoolbarnotifier.exe -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 18/06/2007 14:55:00 | Attr = ]
guard.exe -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 28/09/2006 15:13:20 | Attr = ]
lexbces.exe -> %System32%\LEXBCES.EXE -> Lexmark International, Inc. [Ver = 8.16 | Size = 303104 bytes | Modified Date = 28/03/2003 14:12:10 | Attr = ]
lexpps.exe -> %System32%\LEXPPS.EXE -> Lexmark International, Inc. [Ver = 8.16 | Size = 174592 bytes | Modified Date = 28/03/2003 14:09:32 | Attr = ]
lxbkbmgr.exe -> %ProgramFiles%\Lexmark X1100 Series\lxbkbmgr.exe -> Lexmark International, Inc. [Ver = 0.1.1.1 | Size = 57344 bytes | Modified Date = 28/03/2003 14:18:46 | Attr = ]
lxbkbmon.exe -> %ProgramFiles%\Lexmark X1100 Series\lxbkbmon.exe -> Lexmark International, Inc. [Ver = 0.1.1.1 | Size = 53248 bytes | Modified Date = 28/03/2003 14:39:32 | Attr = ]
nvsvc32.exe -> %System32%\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 159810 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
realsched.exe -> %CommonProgramFiles%\Real\Update_OB\realsched.exe -> RealNetworks, Inc. [Ver = 0.1.0.3959 | Size = 185896 bytes | Modified Date = 21/06/2007 11:10:52 | Attr = ]
winpfind3u.exe -> %UserDesktop%\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.42.0 | Size = 322560 bytes | Modified Date = 04/09/2007 10:47:26 | Attr = ]

[Win32 Services - Non-Microsoft Only]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\guard.exe -> Anti-Malware Development a.s. [Ver = 7, 5, 0, 47 | Size = 204800 bytes | Modified Date = 28/09/2006 15:13:20 | Attr = ]
(Avg7Alrt) AVG7 Alert Manager Server [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgamsvr.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.453 | Size = 353280 bytes | Modified Date = 12/09/2007 18:19:22 | Attr = ]
(Avg7UpdSvc) AVG7 Update Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgupsvc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Modified Date = 12/09/2007 18:19:26 | Attr = ]
(AVGEMS) AVG E-mail Scanner [Win32_Own | Auto | Running] -> %ProgramFiles%\Grisoft\AVG7\avgemc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.482 | Size = 353280 bytes | Modified Date = 12/09/2007 18:19:22 | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.0.503.0 | Size = 204800 bytes | Modified Date = 23/08/2001 22:00:00 | Attr = ]
(gusvc) Google Updater Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe -> Google [Ver = 2.0.734.29932.beta | Size = 138168 bytes | Modified Date = 24/04/2007 13:00:22 | Attr = ]
(LexBceS) LexBce Server [Win32_Own | Auto | Running] -> %System32%\LEXBCES.EXE -> Lexmark International, Inc. [Ver = 8.16 | Size = 303104 bytes | Modified Date = 28/03/2003 14:12:10 | Attr = ]
(NVSvc) NVIDIA Display Driver Service [Win32_Own | Auto | Running] -> %System32%\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 159810 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
(SmcService) Sygate Personal Firewall [Win32_Own | Disabled | Stopped] -> %ProgramFiles%\Sygate\SPF\Smc.exe -> Sygate Technologies, Inc. [Ver = 5.6.00.2808 | Size = 2577632 bytes | Modified Date = 15/10/2004 20:40:56 | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
AVG7_CC -> %ProgramFiles%\Grisoft\AVG7\avgcc.exe -> GRISOFT, s.r.o. [Ver = 7.5.0.480 | Size = 416256 bytes | Modified Date = 12/09/2007 18:19:22 | Attr = ]
KernelFaultCheck -> -> File not found
Lexmark X1100 Series -> %ProgramFiles%\Lexmark X1100 Series\lxbkbmgr.exe -> Lexmark International, Inc. [Ver = 0.1.1.1 | Size = 57344 bytes | Modified Date = 28/03/2003 14:18:46 | Attr = ]
LogMeIn GUI -> %ProgramFiles%\LogMeIn\x86\LogMeInSystray.exe -> File not found
msennger -> %ProgramFiles%\My App\tmt.com -> File not found
NeroFilterCheck -> %System32%\NeroCheck.exe -> Ahead Software Gmbh [Ver = 1, 0, 0, 2 | Size = 155648 bytes | Modified Date = 09/07/2001 12:50:42 | Attr = ]
NvCplDaemon -> %System32%\nvcpl.dll [RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup] -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 7700480 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
NvMediaCenter -> %System32%\nvmctray.dll [RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit] -> NVIDIA Corporation [Ver = 6.14.10.9371 | Size = 86016 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
nwiz -> %System32%\nwiz.exe -> [Ver = | Size = 1622016 bytes | Modified Date = 22/10/2006 12:22:00 | Attr = ]
QuickTime Task -> %ProgramFiles%\QuickTime\qttask.exe -> Apple Inc. [Ver = 7.2 | Size = 286720 bytes | Modified Date = 23/08/2007 13:18:44 | Attr = ]
SmcService -> %ProgramFiles%\Sygate\SPF\Smc.exe -> Sygate Technologies, Inc. [Ver = 5.6.00.2808 | Size = 2577632 bytes | Modified Date = 15/10/2004 20:40:56 | Attr = ]
SpeedTouch USB Diagnostics -> %ProgramFiles%\Thomson\SpeedTouch USB\dragdiag.exe -> THOMSON Telecom Belgium [Ver = 301.0.0.12 | Size = 866816 bytes | Modified Date = 26/01/2004 11:38:38 | Attr = ]
TkBellExe -> %CommonProgramFiles%\Real\Update_OB\realsched.exe -> RealNetworks, Inc. [Ver = 0.1.0.3959 | Size = 185896 bytes | Modified Date = 21/06/2007 11:10:52 | Attr = ]
WinReg -> %ProgramFiles%\My App\tmt.com -> File not found
< OptionalComponents [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\ ->
IMAIL -> Installed = 1 ->
MAPI -> Installed = 1 ->
MSFS -> Installed = 1 ->
< Run [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
hohohhaha -> %ProgramFiles%\My App\tmt.com -> File not found
SpeedItUpEX -> %ProgramFiles%\SpeedItUpFree\SpeedItUp.exe -> File not found
swg -> %ProgramFiles%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -> Google Inc. [Ver = 2, 0, 301, 1654 | Size = 68856 bytes | Modified Date = 18/06/2007 14:55:00 | Attr = ]
< AppInit_DLLs [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs ->
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls ->
NVDESK32.DLL -> NVDESK32.DLL -> File not found
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks ->
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> %ProgramFiles%\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> GRISOFT s.r.o. [Ver = 7, 5, 1, 36 | Size = 79408 bytes | Modified Date = 12/09/2007 18:37:38 | Attr = ]
{AF1CC022-0228-42AE-912D-0CE89CD6559D} [HKLM] -> Reg Data - Key not found [] -> File not found
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders ->
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->
LMIinit -> %System32%\LMIinit.dll -> LogMeIn, Inc. [Ver = 3.0.606 | Size = 63040 bytes | Modified Date = 25/05/2007 15:22:04 | Attr = ]
< CurrentVersion Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 ->
< CurrentVersion Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ -> ->
< HOSTS File > (686 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts ->
127.0.0.1 localhost -> ->
< Internet Explorer Settings > -> ->
HKLM: Default_Page_URL -> http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome ->
HKLM: Main\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Search Page -> http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch ->
HKLM: Start Page -> http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: SearchAssistant -> http://www.google.com/ie ->
HKCU: Local Page -> C:\WINDOWS\System32\blank.htm ->
HKCU: Search Bar -> http://www.google.com/ie ->
HKCU: Search Page -> http://www.google.com ->
HKCU: Start Page -> http://www.google.co.uk/ ->
HKCU: SearchAssistant -> http://www.google.com/ie ->
HKCU: ProxyEnable -> 0 ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ->
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 8.0.0.2006102200 | Size = 62080 bytes | Modified Date = 23/10/2006 00:08:42 | Attr = ]
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] -> %ProgramFiles%\Google\googletoolbar4.dll [Google Toolbar Helper] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 19/01/2007 23:55:54 | Attr = R ]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} [HKLM] -> %ProgramFiles%\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [Google Toolbar Notifier BHO] -> Google Inc. [Ver = 2, 0, 301, 7164 | Size = 325048 bytes | Modified Date = 18/06/2007 14:55:00 | Attr = ]
< Internet Explorer ToolBars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar ->
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKLM] -> %ProgramFiles%\Google\googletoolbar4.dll [&Google] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 19/01/2007 23:55:54 | Attr = R ]
{8E718888-423F-11D2-876E-00A0C9082467} [HKLM] -> %System32%\msdxm.ocx [&Radio] -> [Ver = | Size = 842268 bytes | Modified Date = 29/08/2002 04:40:12 | Attr = ]
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> %ProgramFiles%\Google\googletoolbar4.dll [&Google] -> Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 19/01/2007 23:55:54 | Attr = R ]
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ ->
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -> Reg Data - Value does not exist [ButtonText: Real.com] -> File not found
< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ ->
E&xport to Microsoft Excel -> -> File not found
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ ->
{EC78686D-1BAB-4911-A5C8-860B42E09BEE} -> (Realtek RTL8139 Family PCI Fast Ethernet NIC) ->
< Default Protocols [HKLM] - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults ->
shell -> shell protocol not assigned ->
< Default Protocols [HKCU] - Select to Repair > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults ->
shell -> shell protocol not assigned ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ ->
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found
vnd.ms.radio -> %System32%\msdxm.ocx -> [Ver = | Size = 842268 bytes | Modified Date = 29/08/2002 04:40:12 | Attr = ]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ ->
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -> QuickTime Object - CodeBase = http://www.apple.com/qtactivex/qtplugin.cab ->
{FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} -> Performance Viewer Activex Control - CodeBase = https://secure.logmein.com/activex/RACtrl.cab ->
DirectAnimation Java Classes -> - CodeBase = file://C:\WINDOWS\Java\classes\dajava.cab ->
Microsoft XML Parser for Java -> - CodeBase = file://C:\WINDOWS\Java\classes\xmldso.cab ->


[Files/Folders - Created Within 30 days]
.rnd -> %SystemDrive%\.rnd -> [Ver = | Size = 1024 bytes | Created Date = 04/09/2007 13:22:26 | Attr = ]
ALTIMG32 -> %SystemDrive%\ALTIMG32 -> [Folder | Created Date = 06/09/2007 13:23:33 | Attr = ]
Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Created Date = 12/09/2007 16:34:21 | Attr = HS]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 535904256 bytes | Created Date = 01/01/1601 | Attr = HS]
qoobox -> %SystemDrive%\qoobox -> [Folder | Created Date = 09/09/2007 11:44:47 | Attr = ]
SDFix -> %SystemDrive%\SDFix -> [Folder | Created Date = 12/09/2007 18:26:00 | Attr = ]
altimg2.ini -> %SystemRoot%\altimg2.ini -> [Ver = | Size = 56 bytes | Created Date = 06/09/2007 13:23:46 | Attr = ]
erdnt -> %SystemRoot%\erdnt -> [Folder | Created Date = 09/09/2007 11:47:24 | Attr = ]
ERUNT -> %SystemRoot%\ERUNT -> [Folder | Created Date = 12/09/2007 18:34:07 | Attr = ]
iun6002.exe -> %SystemRoot%\iun6002.exe -> Indigo Rose Corporation [Ver = 6.0.1.2 | Size = 724992 bytes | Created Date = 04/09/2007 13:56:44 | Attr = ]
pss -> %SystemRoot%\pss -> [Folder | Created Date = 04/09/2007 12:32:12 | Attr = ]
temp -> %SystemRoot%\temp -> [Folder | Created Date = 09/09/2007 11:49:27 | Attr = ]
uninstyler.exe -> %SystemRoot%\uninstyler.exe -> instyler installation software [Ver = 2.0 | Size = 50176 bytes | Created Date = 05/09/2007 00:09:16 | Attr = ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job -> [Ver = | Size = 284 bytes | Created Date = 23/08/2007 12:22:30 | Attr = ]
.exe -> %System32%\.exe -> [Ver = | Size = 0 bytes | Created Date = 12/09/2007 19:49:15 | Attr = HS]
LMIinit.dll -> %System32%\LMIinit.dll -> LogMeIn, Inc. [Ver = 3.0.606 | Size = 63040 bytes | Created Date = 04/09/2007 13:22:32 | Attr = ]
LMIport.dll -> %System32%\LMIport.dll -> LogMeIn, Inc. [Ver = 0.2.0.0 built by: WinDDK | Size = 26176 bytes | Created Date = 04/09/2007 13:23:09 | Attr = ]
LMIRfsClientNP.dll -> %System32%\LMIRfsClientNP.dll -> LogMeIn, Inc. [Ver = 2.1.3.0 | Size = 83552 bytes | Created Date = 04/09/2007 13:23:08 | Attr = ]
NtmsData -> %System32%\NtmsData -> [Folder | Created Date = 04/09/2007 12:28:32 | Attr = ]
avg7core.sys -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.484 | Size = 821536 bytes | Created Date = 12/09/2007 17:19:30 | Attr = ]
avg7rsw.sys -> %System32%\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Created Date = 12/09/2007 17:19:34 | Attr = ]
avg7rsxp.sys -> %System32%\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.442 | Size = 27776 bytes | Created Date = 12/09/2007 17:19:34 | Attr = ]
AvgAsCln.sys -> %System32%\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/09/2007 17:34:17 | Attr = ]
avgclean.sys -> %System32%\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 12/09/2007 17:19:36 | Attr = ]
avgmfx86.sys -> %System32%\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.473 | Size = 19904 bytes | Created Date = 12/09/2007 17:19:36 | Attr = ]
avgtdi.sys -> %System32%\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Created Date = 12/09/2007 17:19:36 | Attr = ]
LMIRfsDriver.sys -> %System32%\drivers\LMIRfsDriver.sys -> LogMeIn, Inc. [Ver = 2.4.2.0 | Size = 46112 bytes | Created Date = 04/09/2007 13:23:08 | Attr = ]

[Files/Folders - Modified Within 30 days]
$VAULT$.AVG -> %SystemDrive%\$VAULT$.AVG -> [Folder | Modified Date = 12/09/2007 19:49:56 | Attr = RH ]
.rnd -> %SystemDrive%\.rnd -> [Ver = | Size = 1024 bytes | Modified Date = 04/09/2007 14:22:30 | Attr = ]
ALTIMG32 -> %SystemDrive%\ALTIMG32 -> [Folder | Modified Date = 06/09/2007 14:23:44 | Attr = ]
boot.ini -> %SystemDrive%\boot.ini -> [Ver = | Size = 194 bytes | Modified Date = 12/09/2007 19:30:02 | Attr = HS]
Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Modified Date = 12/09/2007 17:41:44 | Attr = HS]
Documents and Settings -> %SystemDrive%\Documents and Settings -> [Folder | Modified Date = 04/09/2007 14:36:54 | Attr = ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 535904256 bytes | Modified Date = 18/09/2007 11:06:20 | Attr = HS]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 18/09/2007 11:05:14 | Attr = R ]
qoobox -> %SystemDrive%\qoobox -> [Folder | Modified Date = 09/09/2007 14:26:52 | Attr = ]
SDFix -> %SystemDrive%\SDFix -> [Folder | Modified Date = 12/09/2007 19:41:06 | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 12/09/2007 19:34:08 | Attr = ]
altimg2.ini -> %SystemRoot%\altimg2.ini -> [Ver = | Size = 56 bytes | Modified Date = 06/09/2007 14:23:48 | Attr = ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Modified Date = 18/09/2007 11:06:22 | Attr = S]
Debug -> %SystemRoot%\Debug -> [Folder | Modified Date = 18/09/2007 11:06:46 | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 04/09/2007 14:38:34 | Attr = S]
erdnt -> %SystemRoot%\erdnt -> [Folder | Modified Date = 09/09/2007 12:47:26 | Attr = ]
ERUNT -> %SystemRoot%\ERUNT -> [Folder | Modified Date = 12/09/2007 19:34:16 | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 04/09/2007 14:23:02 | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 12/09/2007 17:34:22 | Attr = HS]
iun6002.exe -> %SystemRoot%\iun6002.exe -> Indigo Rose Corporation [Ver = 6.0.1.2 | Size = 724992 bytes | Modified Date = 04/09/2007 14:56:08 | Attr = ]
java -> %SystemRoot%\java -> [Folder | Modified Date = 04/09/2007 14:32:48 | Attr = ]
lexstat.ini -> %SystemRoot%\lexstat.ini -> [Ver = | Size = 325 bytes | Modified Date = 16/09/2007 14:28:02 | Attr = ]
Minidump -> %SystemRoot%\Minidump -> [Folder | Modified Date = 07/09/2007 02:18:44 | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 19/09/2007 15:21:08 | Attr = ]
pss -> %SystemRoot%\pss -> [Folder | Modified Date = 08/09/2007 14:10:24 | Attr = ]
Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 09/09/2007 14:27:10 | Attr = ]
system -> %SystemRoot%\system -> [Folder | Modified Date = 12/09/2007 18:22:40 | Attr = ]
system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 227 bytes | Modified Date = 12/09/2007 19:30:00 | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 12/09/2007 23:28:38 | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 04/09/2007 15:07:32 | Attr = S]
temp -> %SystemRoot%\temp -> [Folder | Modified Date = 16/09/2007 14:28:08 | Attr = ]
uninstyler.exe -> %SystemRoot%\uninstyler.exe -> instyler installation software [Ver = 2.0 | Size = 50176 bytes | Modified Date = 23/08/2007 06:37:02 | Attr = ]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 568 bytes | Modified Date = 12/09/2007 19:30:00 | Attr = ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job -> [Ver = | Size = 284 bytes | Modified Date = 15/09/2007 14:05:02 | Attr = ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 18/09/2007 11:06:30 | Attr = H ]
.exe -> %System32%\.exe -> [Ver = | Size = 0 bytes | Modified Date = 12/09/2007 20:50:08 | Attr = HS]
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 09/09/2007 13:20:46 | Attr = ]
config -> %System32%\config -> [Folder | Modified Date = 09/09/2007 14:27:42 | Attr = ]
drivers -> %System32%\drivers -> [Folder | Modified Date = 12/09/2007 18:34:18 | Attr = ]
NtmsData -> %System32%\NtmsData -> [Folder | Modified Date = 04/09/2007 13:31:12 | Attr = ]
nvapps.xml -> %System32%\nvapps.xml -> [Ver = | Size = 88566 bytes | Modified Date = 18/09/2007 11:06:52 | Attr = ]
perfc009.dat -> %System32%\perfc009.dat -> [Ver = | Size = 39992 bytes | Modified Date = 12/09/2007 19:41:18 | Attr = ]
perfh009.dat -> %System32%\perfh009.dat -> [Ver = | Size = 311604 bytes | Modified Date = 12/09/2007 19:41:18 | Attr = ]
PerfStringBackup.INI -> %System32%\PerfStringBackup.INI -> [Ver = | Size = 356120 bytes | Modified Date = 12/09/2007 19:41:18 | Attr = ]
wbem -> %System32%\wbem -> [Folder | Modified Date = 09/09/2007 14:27:12 | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 2206 bytes | Modified Date = 17/09/2007 19:38:08 | Attr = ]
avg7core.sys -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.484 | Size = 821536 bytes | Modified Date = 12/09/2007 18:19:32 | Attr = ]
avg7rsw.sys -> %System32%\drivers\avg7rsw.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,340 | Size = 4224 bytes | Modified Date = 12/09/2007 18:19:36 | Attr = ]
avg7rsxp.sys -> %System32%\drivers\avg7rsxp.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.442 | Size = 27776 bytes | Modified Date = 12/09/2007 18:19:36 | Attr = ]
avgclean.sys -> %System32%\drivers\avgclean.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Modified Date = 12/09/2007 18:19:38 | Attr = ]
avgmfx86.sys -> %System32%\drivers\avgmfx86.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.473 | Size = 19904 bytes | Modified Date = 12/09/2007 18:19:38 | Attr = ]
avgtdi.sys -> %System32%\drivers\avgtdi.sys -> GRISOFT, s.r.o. [Ver = 7,0,0,346 | Size = 4960 bytes | Modified Date = 12/09/2007 18:19:38 | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Modified Date = 12/09/2007 19:35:18 | Attr = ]

[File String Scan - Non-Microsoft Only]
PEC2 , -> %System32%\dfrg.msc -> [Ver = | Size = 41397 bytes | Modified Date = 23/08/2001 22:00:00 | Attr = ]
Thawte Consulting , -> %System32%\rmoc3260.dll -> RealNetworks, Inc. [Ver = 6.0.9.2764 | Size = 185952 bytes | Modified Date = 21/06/2007 11:11:24 | Attr = ]
winsync , -> %System32%\wbdbase.deu -> [Ver = | Size = 1309184 bytes | Modified Date = 23/08/2001 22:00:00 | Attr = ]
WSUD , UPX0 , -> %System32%\dllcache\hwxjpn.dll -> [Ver = | Size = 13463552 bytes | Modified Date = 23/08/2001 22:00:00 | Attr = ]
UPX! , FSG! , PEC2 , aspack , -> %System32%\drivers\avg7core.sys -> GRISOFT, s.r.o. [Ver = 7.5.0.484 | Size = 821536 bytes | Modified Date = 12/09/2007 18:19:32 | Attr = ]

< End of report >
Post #33 last edited
Hi

Sorry for the delay. We will try cleaning up a little manually. Ideally, so I can properly see what is on your pc, I would like to run Combofix, but if you are not willing, I will understand. If you look around the forum, you will see it is used a lot without any problems.

Firstly, go to that compressed folder, right-click it and select Properties Make a note of the filesize and put it in your next reply. Dont delete it yet. We shall delete the uncompressed folder if it is still present.


Reboot into SAFE MODEBy pressing the F8 key right when Windows starts, usually right after you hear your computer
beep when you reboot it (some versions of windows will display 'Starting Windows' with a grey progress bar)
you will be brought to a menu where you can choose to boot into safe mode.

If it does not work on the first try, reboot and try again, as you have to be quick when you press it.

I have found that during boot up, right after the computer displays the equipment , memory, etc
installed on your computer, if you start lightly tapping the F8 key, the system will usually display the menu.
To enable the viewing of Hidden files follow these steps:
  • Close all programs so that you are at your desktop.
  • Double-click on the My Computer icon (or click Start, then select My Computer)
  • Select the Tools menu and click Folder Options.
  • After the new window appears select the View tab.
  • Put a checkmark in the checkbox labeled Display the contents of system folders.
  • Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
  • Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
  • Remove the checkmark from the checkbox labeled Hide protected operating system files.
  • Press the Apply button and then the OK button and shutdown My Computer.
    Now your computer is configured to show all hidden files.
Now navigate to and delete this folder.

C:\Program Files\My App

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
Reboot into Normal Mode

Download and Run ComboFix
  • Download this file from below:

    Here
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Then double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.
Post #34
Scotty I note that you have asked me to delete the MY APPS file again…. However, it is still in my wastebasket so I could retrieve the folder back again. The compressed file you asked for was in my apps folder, which was one of the folders that you instructed me to delete last time. I dont mind trying combofix again, but maybe theres something on my pc that clashes with it. Please advise A
Post #36
Scotty
If I activate Hide protected operating system files.there is a response that tells me my operating system may not function properly or start at all……should I still go ahead with that?
All the others are done.
results below
combo worked ok this time.

SDFix: Version 1.104

Run by [removed] on 20/09/2007 at 16:25

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

No Trojan Files Found




Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
——————




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"h"="h:*:Enabled:Microsoft Windows Update"

Remaining Files:
—————


Files with Hidden Attributes:

C:\Documents and Settings\Andreas\Desktop\All Andreas docs\misc docs from floppy\mums files\DAD\~WRL0656.TMP
C:\WINDOWS\system32\ijjlm.tmp

Finished!


ComboFix

07-09-19.8 - "Andreas" 2007-09-20 16:48:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.294 [GMT 1:00]
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Andreas\APPLIC~1\macromedia\Flash Player\#SharedObjects\GL3ETYHV\www.broadcaster.com
C:\DOCUME~1\Andreas\APPLIC~1\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com

.
((((((((((((((((((((((((( Files Created from 2007-08-20 to 2007-09-20 )))))))))))))))))))))))))))))))
.

2007-09-20 16:46 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-12 19:34 d——– C:\WINDOWS\ERUNT
2007-09-12 18:34 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-07 02:32 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-09-07 02:14 d——– C:\Program Files\Yahoo!
2007-09-07 02:14 d——– C:\Program Files\CCleaner
2007-09-06 14:23 21,648 –a—— C:\WINDOWS\system\ctl3dv2.dll
2007-09-06 14:23 d——– C:\ALTIMG32
2007-09-05 01:09 50,176 –a—— C:\WINDOWS\uninstyler.exe
2007-09-05 01:08 1,281,060 –a—— C:\DOCUME~1\Andreas\az.exe
2007-09-04 14:56 724,992 –a—— C:\WINDOWS\iun6002.exe
2007-09-04 14:23 83,552 –a—— C:\WINDOWS\system32\LMIRfsClientNP.dll
2007-09-04 14:23 46,112 –a—— C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2007-09-04 14:23 26,176 –a—— C:\WINDOWS\system32\LMIport.dll
2007-09-04 14:22 63,040 –a—— C:\WINDOWS\system32\LMIinit.dll
2007-09-04 13:32 d——– C:\WINDOWS\pss
2007-09-04 13:28 d——– C:\WINDOWS\system32\NtmsData
2007-09-03 11:26 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-23 13:22 d——– C:\Program Files\Apple Software Update
2007-08-23 13:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-23 13:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-23 13:18 d——– C:\Program Files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 20:40]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 14:18]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-21 11:10]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-08-23 13:18]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-10-22 12:22]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"msennger"="C:\Program Files\My App\tmt.com" []
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-12 18:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 14:54]
"SpeedItUpEX"="C:\Program Files\SpeedItUpFree\SpeedItUp.exe" []
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 04:41]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 16:08]
"hohohhaha"="C:\Program Files\My App\tmt.com" []

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Microsoft Lsass Center"=telecomes.exe
"Windows Servicers FEnR"=iwqofmzjn.exe
"Microsoft Windows Update"=gztucqp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-25 15:22 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=NVDESK32.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SmcService"=2 (0x2)

R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\System32\drivers\LMIRfsDriver.sys
R3 lmimirr;lmimirr;C:\WINDOWS\System32\DRIVERS\lmimirr.sys
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
S3 Intels51;Intel® 536EP Modem;C:\WINDOWS\System32\DRIVERS\Intels51.sys
S3 SiS300i;SiS300i;C:\WINDOWS\System32\DRIVERS\sis300ip.sys

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-09-15 13:05:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-20 16:49:32
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-20 16:50:25
C:\ComboFix-quarantined-files.txt … 2007-09-20 16:50
C:\ComboFix2.txt … 2007-09-09 12:49
.
— E O F —
Post #37
Hi

Lets try and kill as much as this as we can in one go.

Upload a File to Virustotal
Please visit Virustotal
  • Click the Browse… button
  • Navigate to the file C:\DOCUME~1\Andreas\az.exe
  • Click the Open button
  • Click the Send button
  • Copy and paste the results back here please.
Open Notepad and Copy/Paste the text in the codebox below into it: 

File::
C:\WINDOWS\uninstyler.exe
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\ijjlm.tmp

Folder::
C:\Program Files\My App

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msennger"=- 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hohohhaha"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Microsoft Lsass Center"=-
"Windows Servicers FEnR"=-
"Microsoft Windows Update"=-

Save this as "CFScript"

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Download ATF (Atribune Temp File) Cleaner� by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

*Note* If you do not have Firefox or Opera, those options will be greyed out.

Download Superantispyware (SAS) free home version.

SAS Free

Install it and double-click the icon on your desktop to run it.
� It will ask if you want to update the program definitions, click Yes.
� Under Configuration and Preferences, click the Preferences button.
� Click the Scanning Control tab.
� Under Scanner Options make sure the following are checked:
  • Close browsers before scanning
  • Scan for tracking cookies
  • Terminate memory threats before quarantining.
  • Please leave the others unchecked.
  • Click the Close button to leave the control center screen.
� On the main screen, under Scan for Harmful Software click Scan your computer.
� On the left check C:\Fixed Drive.
� On the right, under Complete Scan, choose Perform Complete Scan.
� Click Next to start the scan. Please be patient while it scans your computer.
� After the scan is complete a summary box will appear. Click OK.
� Make sure everything in the white box has a check next to it, then click Next.
� It will quarantine what it found and if it asks if you want to reboot, click Yes.
� To retrieve the removal information for me please do the following:
  • After reboot, double-click the SUPERAntispyware icon on your desktop.
  • Click Preferences. Click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • It will open in your default text editor (such as Notepad/Wordpad).
  • Please highlight everything in the notepad, then right-click and choose copy.
� Click close and close again to exit the program.
� Please paste that information here for me with a new HijackThis log.

So, post back with
  • Virustotal results
  • Combofix log
  • SuperAntiSpyware log
  • new HijackThis log.
And maybe it's time to try removing, and reinstalling Sygate?
Post #38
Scotty

It seems like that lot will take some time, at least for me anyway,

so ILL do it in the morning when Im less likely to make any mistakes.

In the meantime here is the hijack log that I forgot to send to you last time.

A


Logfile of HijackThis v1.99.1
Scan saved at 01:16:49, on 21/09/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Andreas\Desktop\Hijack This\HijackThis2.exe

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msennger] C:\Program Files\My App\tmt.com
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpeedItUpEX] C:\Program Files\SpeedItUpFree\SpeedItUp.exe -MINI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [hohohhaha] C:\Program Files\My App\tmt.com
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
Post #39
Ok Scotty

All done……..4 results below.

As I still have no active anti-spyware or anti-virus programms working at present,
perhaps I should just remove them (AVG and Sygate) and maybe download some alternative ones.

Could you recommend an effective anti-spyware or anti-virus programm that is free and will not cause any problems?….for instance should I continue to use the Superantispyware as my antispyware? ….Please advise on this.




ComboFix 07-09-19.8 - "Andreas" 2007-09-21 13:08:42.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.250 [GMT 1:00]
Command switches used :: C:\Documents and Settings\Andreas\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\uninstyler.exe
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\ijjlm.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\ijjlm.tmp
C:\WINDOWS\uninstyler.exe

.
((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 )))))))))))))))))))))))))))))))
.

2007-09-20 16:46 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-12 19:34 d——– C:\WINDOWS\ERUNT
2007-09-12 18:34 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-07 02:32 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-09-07 02:14 d——– C:\Program Files\Yahoo!
2007-09-07 02:14 d——– C:\Program Files\CCleaner
2007-09-06 14:23 21,648 –a—— C:\WINDOWS\system\ctl3dv2.dll
2007-09-06 14:23 d——– C:\ALTIMG32
2007-09-05 01:08 1,281,060 –a—— C:\DOCUME~1\Andreas\az.exe
2007-09-04 14:23 83,552 –a—— C:\WINDOWS\system32\LMIRfsClientNP.dll
2007-09-04 14:23 46,112 –a—— C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2007-09-04 14:23 26,176 –a—— C:\WINDOWS\system32\LMIport.dll
2007-09-04 14:22 63,040 –a—— C:\WINDOWS\system32\LMIinit.dll
2007-09-04 13:32 d——– C:\WINDOWS\pss
2007-09-04 13:28 d——– C:\WINDOWS\system32\NtmsData
2007-09-03 11:26 d-a—— C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-08-23 13:22 d——– C:\Program Files\Apple Software Update
2007-08-23 13:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2007-08-23 13:22 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-23 13:18 d——– C:\Program Files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((( snapshot_2007-09-20_164951.98 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 245,760 2007-09-21 12:05:34 C:\WINDOWS\system32\config\systemprofile\ntuser.dat
.
—-a-w 245,760 2007-09-20 15:46:36 C:\WINDOWS\system32\config\systemprofile\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 20:40]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 14:18]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-21 11:10]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-08-23 13:18]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-10-22 12:22]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-12 18:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 14:54]
"SpeedItUpEX"="C:\Program Files\SpeedItUpFree\SpeedItUp.exe" []
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2002-08-29 04:41]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 16:08]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-25 15:22 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=NVDESK32.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SmcService"=2 (0x2)

R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\System32\drivers\LMIRfsDriver.sys
R3 lmimirr;lmimirr;C:\WINDOWS\System32\DRIVERS\lmimirr.sys
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
S3 Intels51;Intel® 536EP Modem;C:\WINDOWS\System32\DRIVERS\Intels51.sys
S3 SiS300i;SiS300i;C:\WINDOWS\System32\DRIVERS\sis300ip.sys

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-09-15 13:05:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-21 13:09:38
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-21 13:10:36
C:\ComboFix-quarantined-files.txt … 2007-09-21 13:10
C:\ComboFix2.txt … 2007-09-20 16:50
C:\ComboFix3.txt … 2007-09-09 12:49
.
— E O F —



CFScript RESULTS

File::
C:\WINDOWS\uninstyler.exe
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\ijjlm.tmp

Folder::
C:\Program Files\My App

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msennger"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hohohhaha"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Microsoft Lsass Center"=-
"Windows Servicers FEnR"=-
"Microsoft Windows Update"=-




ANTIVIRUS RESULTS

File az.exe received on 09.21.2007 13:58:57 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED


Result: 7/32 (21.88%)
Loading server information…
Your file is queued in position: 1.
Estimated start time is between 39 and 56 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2007.9.21.0 2007.09.20 -
AntiVir 7.6.0.15 2007.09.21 -
Authentium 4.93.8 2007.09.20 -
Avast 4.7.1043.0 2007.09.20 Win32:IRCZapchast-C
AVG 7.5.0.485 2007.09.20 -
BitDefender 7.2 2007.09.21 Application.Motherboardmonitor.E
CAT-QuickHeal 9.00 2007.09.20 -
ClamAV 0.91.2 2007.09.21 -
DrWeb 4.33 2007.09.21 IRC.Virus
eSafe 7.0.15.0 2007.09.19 -
eTrust-Vet 31.2.5153 2007.09.21 -
Ewido 4.0 2007.09.20 -
FileAdvisor 1 2007.09.21 -
Fortinet 3.11.0.0 2007.09.21 -
F-Prot 4.3.2.48 2007.09.20 -
F-Secure 6.70.13030.0 2007.09.21 not-a-virus:NetTool.Win32.Sniffer.c
Ikarus T3.1.1.12 2007.09.21 -
Kaspersky 4.0.2.24 2007.09.21 Backdoor.IRC.Small.p
McAfee 5124 2007.09.20 -
Microsoft 1.2803 2007.09.21 -
NOD32v2 2543 2007.09.21 -
Norman 5.80.02 2007.09.21 -
Panda 9.0.0.4 2007.09.21 Generic Malware
Prevx1 V2 2007.09.21 Heuristic: Suspicious Self Modifying File
Rising 19.41.42.00 2007.09.21 -
Sophos 4.21.0 2007.09.21 -
Sunbelt 2.2.907.0 2007.09.20 -
Symantec 10 2007.09.21 -
TheHacker 6.2.5.064 2007.09.21 -
VBA32 3.12.2.4 2007.09.20 -
VirusBuster 4.3.26:9 2007.09.20 -
Webwasher-Gateway 6.0.1 2007.09.21 -
Additional information
File size: 1281060 bytes
MD5: b7ef42c04ac1142522b42b8e34b035d5
SHA1: dac8a21c5c91ec85c5725c8e0dab6fc551b4075d
packers: BINARYRES, UPX, PECOMPACT, UPX, PECOMPACT, MOLEBOX, UPX
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5…E933E00A7EC9066



SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 09/21/2007 at 03:10 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type : Complete Scan
Total Scan Time : 01:37:55

Memory items scanned : 381
Memory threats detected : 0
Registry items scanned : 4716
Registry threats detected : 0
File items scanned : 57727
File threats detected : 17

Adware.Tracking Cookie
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\[removed][1].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\andreas@azjmp[2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\andreas@banner.32vegas[2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\andreas@clickwwwsearch[1].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\andreas@drivecleaner[1].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\andreas@mywebsearch[2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\[removed][2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\andreas@winantivirus[2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\[removed][1].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\[removed][2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\[removed][2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\[removed][2].txt
C:\Documents and Settings\Andreas\Desktop\SavedData\Documents and Settings\Andreas\Cookies\[removed][2].txt

Unclassified.Unknown Origin/System
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2999B770-DD7D-4748-BB91-16AB925DDDB9}\RP30\A0006861.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2999B770-DD7D-4748-BB91-16AB925DDDB9}\RP32\A0011149.INS
C:\SYSTEM VOLUME INFORMATION\_RESTORE{2999B770-DD7D-4748-BB91-16AB925DDDB9}\RP32\A0012251.EXE

Trojan.Downloader-Gen/LIB
C:\SYSTEM VOLUME INFORMATION\_RESTORE{DA9D83E7-B924-40E5-B134-533F745A486A}\RP350\A0246794.DLL
Post #40
Hi andreas

Looking better now. I can sugeest alternatives, the anti-virus and firewall I use on my XP, both light on resources.

Avast

Comodo

The best way to do this is Save the downloads first disconnect from the internet, then remove the old programs first. Go to where you saved the downloads, enter the folders and click on the setup icons. (There may not be a folder, just the set up icons.)

Once you have done that post a new HijackThis log and let me know how it went.
Post #41
Scotty

All my old anti firewall/Virus progs have been removed.

The comodo firewall seems to be activated, does this block popups too?
Is it now safe to stay online from my pc?

The Avast anti virus is asking for a reg no. or will only allow a demo….
….is there an alternative that does not require a reg/licence no?

A



Logfile of HijackThis v1.99.1
Scan saved at 13:43:10, on 22/09/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Andreas\Desktop\Hijack This\HijackThis2.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [SpeedItUpEX] C:\Program Files\SpeedItUpFree\SpeedItUp.exe -MINI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
Post #42
Hi andreas

Getting the regkey is no problem. You should now have two blue globes in the Notification Area (right corner of Taskbar). One with an a the other with an i. First thing to do is right-click the i ball and select the option to merge it with the a ball.

Go here and select I am a new user and I need a….etc. All that is required is you fill in your email address, your name and City and country, then put in the letters below. A registration key will be emailed immediately.

Then you right-click the a icon in your notification area, select about Avast and at the bottom you will see a butoon that says Licence key. Click on that and copy/paste the number in the email into that box, and you are done.

Looking at your HijackThis log, you are now halfway safe to browsing. Before we proceed, are you still having any problems?
Post #43
Havent noticed any obvious problems offline…….. several popups flashed when i was briefly online, so the sooner i get properly protected the better. Will follow your instructions re reg no when I get home (appx 1hr) Did you also mention upgrading to SP2….is this important, can i do it online? A
Post #44
Hi Dont upgrade to SP2 until you are properly clean, and yes, I will provide a link for that. It's a pretty big download so I hope you are on broadband. Could you try and make a note of what the popups contain, so I can have an idea as to what problems are still lurking? i believe the worst has gone now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI