What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Baseline RuBotted warns me of bots

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hey gang.
me thinks my room mate is whacking out my comp.
loves the youtube and my space pages and ? what else.
now im getting bot notices from trend micros rubotted.
im also getting tons of spam were most of my acc were
realativly free before. getting pop ups and connection problems
when on the net. some wierd programm issues also w corlel graphics
suite open office and a couple of outhers. mostly out of memory
thanks for any help

here are the system specs from belarc
will put a line break between belarc and hijack this log

Operating System System Model
Windows XP Home Edition Service Pack 3 (build 2600)
Processor a Main Circuit Board b
2.40 gigahertz Intel Pentium 4
16 kilobyte primary memory cache
1024 kilobyte secondary memory cache Board: ASUSTeK Computer INC. P4VP-MX Rev 1.xx
Bus Clock: 133 megahertz
BIOS: American Megatrends Inc. 1007.002 05/04/2004
Drives Memory Modules c,d
410.09 Gigabytes Usable Hard Drive Capacity
289.12 Gigabytes Hard Drive Free Space

HL-DT-ST CD-RW GCE-8526B [CD-ROM drive]
LITE-ON DVDRW SHM-165P6S [CD-ROM drive]
3.5" format removeable media [Floppy drive]

ST3160812A [Hard drive] (160.04 GB) – drive 1, s/n 5LSBB1D8, rev 3.AAJ, SMART Status: Healthy
WDC WD2500JB-00REA0 [Hard drive] (250.06 GB) – drive 0, s/n WD-WMANK4852311, rev 20.00K20, SMART Status: Healthy 2032 Megabytes Installed Memory

Slot 'DIMM0' has 1024 MB
Slot 'DIMM1' has 1024 MB
Local Drive Volumes

c: (NTFS on drive 0) 250.06 GB 191.16 GB free
d: (NTFS on drive 1) 160.03 GB 97.96 GB free

Network Drives
None detected
Users (mouse over user name for details) Printers
local user accounts last logon
Administrator 11/2/2008 2:49:33 PM (admin)
Brian 11/21/2008 5:48:26 PM (admin)
local system accounts
Guest never
HelpAssistant never
SUPPORT_388945a0 never

Marks a disabled account; Marks a locked account HP Deskjet D1400 series on USB001
Roland CAMM-1 PNC-1210 on COM1:

Controllers Display
Standard floppy disk controller
Primary IDE Channel [Controller]
Secondary IDE Channel [Controller]
VIA Bus Master IDE Controller S3 Graphics ProSavageDDR [Display adapter]
COMPAQ V700 [Monitor] (15.7"vis, s/n 933CF03TJ703, August 1999)
Bus Adapters Multimedia
VIA Rev 5 or later USB Universal Host Controller (3x)
VIA USB Enhanced Host Controller Realtek AC'97 Audio for VIA ® Audio Controller
Communications Other Devices
PCTEL Platinum V.90 Modem


VIA Rhine II Fast Ethernet Adapter
primary
Dhcp Server:
Physical Address:

Networking Dns Servers: [removed]
ScanMaker 3630
Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Microsoft PS/2 Mouse
Multimedia Card Reader
USB Printing Support
USB Root Hub (4x)
Virus Protection [Back to Top]
ThreatFire Version 3.5.0.21
Realtime File Scanning On
Avira AntiVir PersonalEdition Version 8.0.1.30
Realtime File Scanning On

All required security hotfixes (using the 11/11/2008 Microsoft Security Bulletin Summary) have been installed.

Installed Microsoft Hotfixes [Back to Top]
DataAccess
Q832483 on 9/11/2008 (details…)
Internet Explorer 6
SP1
KB918439-IE6SP1-20060530.145346 on 9/12/2008 (details…)
KB918899-IE6SP1-20060725.123917 on 9/12/2008 (details…)
KB925486-IE6SP1-20060918.120000 on 9/12/2008 (details…)
MSXML4SP2
KB936181 on 9/12/2008 (details…)
KB954430 on 11/11/2008 (details…)
Outlook Express 6
SP1
KB911567-OE6SP1-20060316.165634 on 9/12/2008 (details…)
WGA
SP0
KB892130 on 9/11/2008 (details…)
Windows Media Format 11 SDK
KB929399 (details…)
SP0
KB929399 on 9/13/2008 (details…)
Windows Media Player 11
KB936782_WMP11 (details…)
KB939683 (details…)
KB954154_WM11 (details…)
SP0
KB939683 on 9/13/2008 (details…)
KB954154_WM11 on 9/13/2008 (details…)
SP2
KB936782_WMP11 on 9/13/2008 (details…)
Windows Media Player 8
KB917734_WMP8 (details…)
SP0
KB917734_WMP8 on 9/12/2008 (details…)
Windows Media Player
WM817787 (details…)
Q828026 (details…)
SP0
Q828026 on 9/12/2008 (details…)
Windows Media Player
SP0 (continued)
KB911564 on 9/12/2008 (details…)
Windows XP
KB941569 (details…)
SP0
KB938127-V2-IE7 on 9/12/2008 (details…)
KB941569 on 9/13/2008 (details…)
KB953838-IE7 on 9/12/2008 (details…)
KB956390-IE7 on 10/16/2008 (details…)
SP2
KB811113[SP] on 9/12/2008 (details…)
SP3
KB936929[SP] on 9/12/2008 (details…)
SP4
KB938464 on 9/12/2008 (details…)
KB946648 on 9/12/2008 (details…)
KB950762 on 9/12/2008 (details…)
KB950974 on 9/12/2008 (details…)
KB951066 on 9/12/2008 (details…)
KB951072-V2 on 9/12/2008 (details…)
KB951376-V2 on 9/12/2008 (details…)
KB951698 on 9/12/2008 (details…)
KB951748 on 9/12/2008 (details…)
KB951978 on 9/12/2008 (details…)
KB952287 on 9/12/2008 (details…)
KB952954 on 9/12/2008 (details…)
KB953839 on 9/12/2008 (details…)
KB954211 on 10/16/2008 (details…)
KB954459 on 11/12/2008 (details…)
KB955069 on 11/11/2008 (details…)
KB956391 on 10/16/2008 (details…)
KB956803 on 10/16/2008 (details…)
KB956841 on 10/16/2008 (details…)
KB957095 on 10/16/2008 (details…)
KB957097 on 11/11/2008 (details…)
KB958644 on 10/24/2008 (details…)
Windows
SP1
IDNMITIGATIONAPIS on 9/12/2008 (Microsoft Internationalized Domain Names Mitigation APIs)
NLSDOWNLEVELMAPPING on 9/12/2008 (Microsoft National Language Support Downlevel APIs)

Software Licenses [Back to Top]

Ahead - NeroMediaPlayer 1A20-0218-0370-2363-8674-1140
Ahead - NeroVision 1A20-0218-0370-2363-8674-1140
Avira - AntiVir PersonalEdition Classic 73e172ba18793e696385097f2f0d54bf7a882044
Belarc - Advisor 06180f56
Corel - CorelDRAW DR13WRX-1711462-YQH
Corel - Setup DR13WRX-1711462-YQH
Microsoft - Internet Explorer 92318-600-0056476-89332
Microsoft - WebFldrs XP 12345-111-1111111-81768
Microsoft - Windows XP Home Edition 55277-OEM-0056476-89332 (Key: HXYPW-WWGT4-8BVVY-K8VM2-VFJTM)e

Software Versions (mouse over * for details, click * for location) [Back to Top]
Acrobat.com *
Adobe AIR 1.0.1 Version 1.0.1 *
Adobe Reader Version 9.0.0.2008061200 *
Ahead software - NeroMediaPlayer Version 1, 4, 0, 32 *
Ahead Software AG - Nero Photosnap image editor Version 1.1.0.5 *
Ahead Software AG - Nero Photosnap Viewer Version 1.1.0.5 *
Apple Inc. - QuickTime QuickTime 7.5.5 (990.7) *
Auslogics - Disk Defrag Version 1.x *
Auslogics - Registry Defrag Version 4.x *
Avira GmbH - AntiVir Workstation Version 8.00.70.08 *
Belarc, Inc. - Advisor Version 7.2x *
Bitstream, Inc. FontNav Version 5, 0, 0, 108 *
Blender *
Cinematronics - 3D Pinball Version 5.1.2600.5512 *
COMODO Internet Security Version 3, 5, 55470, 430 *
Corel Design Collection Application Version 1, 0, 0, 7 *
Corel Graphics Applications Version 13.0.0.739 *
Corel PHOTO-PAINT® Version 13.0.0.739 *
Create and edit drawings, flow charts, and logos by using Draw. *
Create and edit presentations for slideshows, meeting and Web pages by using Impress. *
Create and edit scientific formulas and equations by using Math. *
Create and edit text and graphics in letters, reports, documents and Web pages by using Writer. *
CyberLink Corp. - CLDMA Version 1, 0, 0, 2502 *
CyberLink Corp. - PowerDVD Version 5.00.1307 *
Hewlett-Packard - HP Installer Version 9,0,0,64 *
IDLE (Python GUI) *
Indigo Rose Corporation - Setup Factory 6.0 Runtime Module Version 6.0.0.3 *
Install KingCut USB driver *
Macrovision Corporation - InstallShield Update Service Version 4, 60 *
Malwarebytes' Anti-Malware Version 1.30 *
Manage databases, create queries and reports to track and manage your information by using Base. *
Microsoft ® Windows Script Host Version 5.7.0.18066 *
Microsoft Corporation - Internet Explorer Version 7.00.6000.16735 *
Microsoft Corporation - Messenger Version 4.7.3001 *
Microsoft Corporation - Messenger Version 8.5.1302 *
Microsoft Corporation - Windows Installer - Unicode Version 3.1.4001.5512 *
Microsoft Corporation - Windows Live installer Version 12.0.1471.1025 *
Microsoft Corporation - Windows Live Mail Version 12.0.1606 * Microsoft Corporation - Windows Movie Maker Version 2.1.4026.0 *
Microsoft Corporation - Windows® NetMeeting® Version 3.01 *
Microsoft Corporation - Zone.com Version 1.2.626.1 *
Microsoft Data Access Components Version 3.525.1132.0 *
Microsoft® .NET Framework Version 2.0.50727.1433 *
Microsoft® Windows® Operating System Version 11.0.5721.5145 *
My Zinio Library *
Nero AG - Cover Designer Version 2, 3, 0, 48 *
Nero AG - SpecialOffer Application Version 1, 0, 0, 3 *
NeroVision Version 3,1,0,16 *
OpenOffice.org 3.0 Version 3.00.9357 *
Paramount Software UK Ltd - Macrium Reflect Version 4.2.2021.1 *
PC Tools - ThreatFire Version 3.5.0.21 *
PC Tools Auxiliary Service Version 6, 0, 0, 3 *
PC Tools GUI Application Version 6.0 *
PC Tools Security Service Version 6.0 *
PC Tools Tray Application Version 6.0 *
PCtel, Inc. - PCTSPK.EXE Version 4.00 *
Perform calculation, analyze information and manage lists in spreadsheets by using Calc. *
Piriform Ltd - CCleaner Version 2, 13, 0, 720 *
PituSOFT, Ltd. - FontMatcher Version 1.00.0031 *
Pixmantec ApS - RawShooter essentials 2005 Version 1.1.3.0 *
Python (command line) *
ReflectS Application Version 4, 2, 2020, 1 *
SignCut-X2 *
Sony Corporation - Picture Motion Browser Version 1.1.02.07280 *
Stitch Vista Application Version 1, 97, 16904, 1 *
Sun Microsystems, Inc. - Java™ Platform SE 6 U4 Version 6.0.40.12 *
Sun Microsystems, Inc. - Java™ Platform SE 6 U7 Version 6.0.70.6 *
SuperAdBlocker.com - BootSafe Application Version 2, 0, 0, 1000 *
SUPERAntiSpyware Version 4, 22, 0, 1014 *
sweb.exe *
ThreatExpert Memory Scanner Version 1.0.1 *
Trend Micro RUBotted Version 1.0 *
TuneXP 1.5 *
UpdateIPR.exe *
WinZip Version 12.0 (8252) *
Zinio Reader Version 3.7.0.8016 *
________________________________________________________________________________
_________________________________________________________________________________
_____________________________________________
hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:49:43 PM, on 11/21/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Macrium\Reflect\ReflectService.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Brian\Desktop\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TrendProtect - {E3578B37-6346-4EC1-A82B-38273A100DCF} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O3 - Toolbar: TrendProtect - {F83BE649-1CC3-48EE-B2E2-0826CEF3822A} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1221176657372
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1221176651059
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

–
End of file - 6252 bytes
Post #2
[external image: Posted Image]

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.



Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3
thanks for the help
here are the log files you have asked for

Malwarebytes' Anti-Malware 1.30
Database version: 1419
Windows 5.1.2600 Service Pack 3

11/23/2008 5:42:52 PM
mbam-log-2008-11-23 (17-42-52).txt

Scan type: Quick Scan
Objects scanned: 46388
Time elapsed: 3 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
________________________________________________________________________________
_______________________
________________________________________________________________________________
_______________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:48:21 PM, on 11/23/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Macrium\Reflect\ReflectService.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Brian\Desktop\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TrendProtect - {E3578B37-6346-4EC1-A82B-38273A100DCF} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O3 - Toolbar: TrendProtect - {F83BE649-1CC3-48EE-B2E2-0826CEF3822A} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1221176657372
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1221176651059
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

–
End of file - 6688 bytes
________________________________________________________________________________
_______________________
________________________________________________________________________________
_______________________

i have trend micro's rubotted installed and i keep getting malicious software has just been launched from your computer warnings
from it latley. ive had it installed for quite a while and this is happining just now.
i also will have connection problems sometimes when trying to access the internet.
system seems sluggish at times.
i get out of memory errors at times when using corel draw or photo paint.
raster images corrupt and are unopenable when edited in these programs.
no new updates or hardware has been installed other than security updates and definitions
since the system was stable.
multi card reader wont access card, card has works fine in camera and can access all photos.
can not reboot into safe mode unless i change the boot.ini file in msconfig.
getting spam in email account that were relativly free before
have tried to run trends house call when i get a warning from rubotted but the computer shuts down while
its scanning
thanks for the help
Post #4
You could try System Restore. 1. Click Start. 2. Point to All Programs. 3. Point to Accessories. 4. Point to System Tools. 5. Click System Restore. 6. Follow the instructions on the wizard. See if you can find a date the the PC worked.
Post #5
have a habbit of clearing xp restore points, but have a disk image frome a clean install. has most programms and updates will try that. thanks
Post #6

have a habbit of clearing xp restore points, but have a disk image frome a clean install.
has most programms and updates will try that.
thanks

When was your last restore point? Was it clean then?
Post #7
15th but of no use. as long as the disc image is not corupt shouldnt that work? that is as long as it hasnt propogated across drives and reinfects. i gen reformat and reinstall once a year but its a little early. just thought id shoot it to the board and see if there was somthing that jumped out at you.
Post #8

15th but of no use.
as long as the disc image is not corupt
shouldnt that work? that is as long as it
hasnt propogated across drives and reinfects.
i gen reformat and reinstall once a year but its
a little early. just thought id shoot it to the board and
see if there was somthing that jumped out at you.

The image should work. I don't see anything bad in the scan / logs.
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI