What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

very slow comp and odd invalid web addresses popping up

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
ComboFix 09-02-05.02 - kc 2009-02-06 7:35:56.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.894.280 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Autorun.inf
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-04 14:27 . 2009-02-04 14:27 d——– c:\program files\Panda Security
2009-02-04 14:27 . 2008-06-19 16:24 28,544 –a—— c:\windows\System32\drivers\pavboot.sys
2009-02-04 07:35 . 2009-02-04 09:45 250 –a—— c:\windows\gmer.ini
2009-02-03 14:03 . 2009-02-03 14:03 d——– c:\users\kc\AppData\Roaming\Template
2009-02-03 14:03 . 2009-02-03 14:03 0 –a—— c:\users\kc\AppData\Roaming\wklnhst.dat
2009-02-03 11:13 . 2009-02-03 11:13 d——– c:\users\kc\AppData\Roaming\Malwarebytes
2009-02-03 11:13 . 2009-02-03 11:13 d——– c:\users\All Users\Malwarebytes
2009-02-03 11:13 . 2009-02-03 11:13 d——– c:\programdata\Malwarebytes
2009-02-03 11:13 . 2009-02-03 11:13 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-03 11:13 . 2009-01-14 16:11 38,496 –a—— c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-03 11:13 . 2009-01-14 16:11 15,504 –a—— c:\windows\System32\drivers\mbam.sys
2009-01-29 20:47 . 2009-02-06 00:37 d–h—– C:\$AVG8.VAULT$
2009-01-29 19:35 . 2009-01-29 19:35 107,272 –a—— c:\windows\System32\drivers\avgtdix.sys
2009-01-29 19:35 . 2009-01-29 19:35 10,520 –a—— c:\windows\System32\avgrsstx.dll
2009-01-29 19:34 . 2009-02-05 09:46 d——– c:\windows\System32\drivers\Avg
2009-01-29 19:34 . 2009-01-29 19:34 325,128 –a—— c:\windows\System32\drivers\avgldx86.sys
2009-01-29 19:33 . 2009-01-29 19:33 d——– c:\program files\AVG
2009-01-29 18:24 . 2009-01-29 18:24 d–hs—- C:\found.000
2009-01-28 19:02 . 2009-02-06 00:58 d——– c:\program files\a-squared Anti-Malware
2009-01-27 19:47 . 2009-01-27 19:47 d——– c:\program files\Earth Viewpoint
2009-01-27 19:39 . 2009-02-06 05:51 d——– c:\users\All Users\Google Updater
2009-01-27 19:39 . 2009-02-06 05:51 d——– c:\programdata\Google Updater
2009-01-21 20:48 . 2009-01-21 20:48 d——– c:\program files\Trend Micro
2009-01-21 07:31 . 2009-01-29 12:19 3,153 –a—— C:\rollback.ini
2009-01-20 19:22 . 2009-01-29 18:20 14,997,280 –ahs—- c:\windows\System32\drivers\fidbox.dat
2009-01-20 19:22 . 2009-01-20 19:23 32 –ahs—- c:\windows\System32\drivers\fidbox.idx
2009-01-20 19:16 . 2009-01-20 19:17 d——– c:\users\All Users\ParetoLogic Anti-Virus PLUS
2009-01-20 19:16 . 2009-01-20 19:17 d——– c:\programdata\ParetoLogic Anti-Virus PLUS
2009-01-20 19:09 . 2009-01-29 18:32 d——– c:\program files\ParetoLogic
2009-01-20 19:09 . 2009-01-29 18:32 d——– c:\program files\Common Files\ParetoLogic
2009-01-20 18:18 . 2009-01-20 18:18 d——– c:\users\kc\AppData\Roaming\ParetoLogic
2009-01-20 18:17 . 2009-01-29 18:32 d——– c:\users\All Users\ParetoLogic
2009-01-20 18:17 . 2009-01-29 18:32 d——– c:\programdata\ParetoLogic
2009-01-20 18:16 . 2009-01-20 19:08 d——– c:\users\All Users\Downloaded Installations
2009-01-20 18:16 . 2009-01-20 19:08 d——– c:\programdata\Downloaded Installations
2009-01-20 18:10 . 2009-01-29 19:33 d——– c:\users\All Users\Avg8
2009-01-20 18:10 . 2009-01-29 19:33 d——– c:\programdata\Avg8
2009-01-18 21:05 . 2002-01-05 06:48 974,848 –a—— c:\windows\System32\mfc70.dll
2009-01-18 21:05 . 2002-01-05 05:40 487,424 –a—— c:\windows\System32\msvcp70.dll
2009-01-18 21:05 . 2002-01-05 11:37 344,064 –a—— c:\windows\System32\msvcr70.dll
2009-01-18 21:00 . 2009-01-18 21:00 d——– c:\users\kc\AppData\Roaming\GlarySoft
2009-01-18 20:47 . 2009-01-18 21:02 d——– c:\program files\Free Window Registry Repair
2009-01-18 20:33 . 2006-09-28 16:05 2,414,360 –a—— c:\windows\System32\d3dx9_31.dll
2009-01-15 19:24 . 2009-01-18 19:16 d——– c:\users\All Users\Spybot - Search & Destroy
2009-01-15 19:24 . 2009-01-18 19:16 d——– c:\programdata\Spybot - Search & Destroy
2009-01-15 19:22 . 2009-01-29 18:33 d——– c:\users\All Users\Lavasoft
2009-01-15 19:22 . 2009-01-29 18:33 d——– c:\programdata\Lavasoft
2009-01-15 19:15 . 2008-12-15 19:42 288,768 –a—— c:\windows\System32\drivers\srv.sys
2009-01-13 19:03 . 2009-01-15 18:57 d-a—— c:\users\All Users\TEMP
2009-01-13 19:03 . 2009-01-15 18:57 d-a—— c:\programdata\TEMP
2009-01-09 12:22 . 2009-01-09 12:22 d——– c:\users\kc\AppData\Roaming\AVS4YOU
2009-01-09 12:22 . 2009-01-09 12:22 d——– c:\users\All Users\AVS4YOU
2009-01-09 12:22 . 2009-01-09 12:22 d——– c:\programdata\AVS4YOU
2009-01-09 12:21 . 2009-01-13 17:53 d——– c:\program files\Common Files\AVSMedia
2009-01-09 12:21 . 2009-01-13 17:53 d——– c:\program files\AVS4YOU
2009-01-08 12:19 . 2009-01-09 12:22 d——– c:\users\kc\AppData\Roaming\DivX
2009-01-08 12:16 . 2009-01-13 17:54 d——– c:\program files\Common Files\PX Storage Engine
2009-01-07 17:20 . 2009-01-07 17:20 d——– c:\program files\Bonjour
2009-01-06 18:46 . 2009-01-20 19:17 d——– c:\users\kc\AppData\Roaming\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-30 01:40 ——— d—–w c:\program files\Common Files\Adobe
2009-01-28 02:49 ——— d—–w c:\program files\Google
2009-01-16 10:02 ——— d—–w c:\program files\Windows Mail
2009-01-11 18:21 ——— d—–w c:\users\kc\AppData\Roaming\MP3Rocket
2009-01-01 23:31 ——— d—–w c:\users\kc\AppData\Roaming\Apple Computer
2009-01-01 23:30 ——— d—–w c:\programdata\Apple Computer
2009-01-01 23:30 ——— d—–w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-01 23:30 ——— d—–w c:\program files\iTunes
2009-01-01 23:30 ——— d—–w c:\program files\iPod
2009-01-01 23:30 ——— d—–w c:\program files\Common Files\Apple
2009-01-01 23:27 ——— d—–w c:\program files\QuickTime
2009-01-01 23:25 ——— d—–w c:\program files\Apple Software Update
2009-01-01 23:24 ——— d—–w c:\programdata\Apple
2008-12-26 02:58 0 —ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2008-12-21 16:23 0 —ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-12-21 06:06 0 —ha-w c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-12-18 01:23 174 –sha-w c:\program files\desktop.ini
2008-12-18 01:15 ——— d—–w c:\program files\Windows Sidebar
2008-12-18 01:15 ——— d—–w c:\program files\Windows Photo Gallery
2008-12-18 01:15 ——— d—–w c:\program files\Windows Journal
2008-12-18 01:15 ——— d—–w c:\program files\Windows Defender
2008-12-18 01:15 ——— d—–w c:\program files\Windows Collaboration
2008-12-18 01:15 ——— d—–w c:\program files\Windows Calendar
2008-12-17 18:35 82,432 —-a-w c:\windows\System32\axaltocm.dll
2008-12-17 18:35 101,888 —-a-w c:\windows\System32\ifxcardm.dll
2008-12-17 16:58 ——— d—–w c:\program files\Windows Live Toolbar
2008-12-17 16:56 ——— d—–w c:\program files\eMachines Games
2008-12-12 18:18 87,336 —-a-w c:\windows\System32\dns-sd.exe
2008-12-12 18:11 61,440 —-a-w c:\windows\System32\dnssd.dll
2008-12-12 10:08 ——— d—–w c:\programdata\Microsoft Help
2008-11-04 03:33 726,008 —-a-w c:\users\kc\gotomypc_437.exe
2008-09-28 04:34 16,384 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-09-28 04:34 32,768 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-09-28 04:34 16,384 –sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WeatherEye"="c:\program files\TheWeatherNetwork\WeatherEye\WeatherEye.exe" [2009-01-16 4519832]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-23 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\System32\msconfig.exe" [2008-01-19 227840]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-20 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-20 92704]
"a-squared"="c:\program files\A-SQUARED ANTI-MALWARE\a2guard.exe" [2009-01-27 2784912]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-29 1601304]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM
path=
backup=

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigFix]
–a—— 2006-11-16 17:04 2348584 c:\program files\BigFix\bigfix.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
–a—— 2007-10-18 10:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9CCA9104-B509-48A3-B6E9-DAC270DC0C64}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{FC662692-F118-4429-B594-497971FE51C9}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{19C0E128-CC4E-44B7-89F2-D9D34E72B45D}"= UDP:c:\program files\MP3 Rocket\MP3Rocket.exe:MP3 Rocket 5.1.4
"{CC9EE90B-7FF5-4002-900E-8F400F7EBE9F}"= TCP:c:\program files\MP3 Rocket\MP3Rocket.exe:MP3 Rocket 5.1.4
"{03EC06A2-F3A6-40E8-AD07-122810911EB8}"= Profile=Private|c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{38C63BB7-D41A-4BE4-9A6E-C6C750709010}c:\\westwood\\ra2\\game.exe"= UDP:c:\westwood\ra2\game.exe:Main executable for Red Alert 2
"UDP Query User{76CBF90F-7ACB-477B-88F3-2B59FFB27854}c:\\westwood\\ra2\\game.exe"= TCP:c:\westwood\ra2\game.exe:Main executable for Red Alert 2
"{8260EB54-1A97-4E67-B7F3-1BC95CFABEB3}"= UDP:c:\westwood\RA2\Ra2.exe:Red Alert 2
"{EF7795B6-6049-4B94-817C-A944885A0AE7}"= TCP:c:\westwood\RA2\Ra2.exe:Red Alert 2
"TCP Query User{826FD630-0812-4FB5-B2A9-FF3A5C99EF14}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{A9AE7748-236F-4C83-A135-789E935CEC22}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{5D722992-8819-4ABE-B926-D1E400D3C219}"= UDP:c:\program files\MP3 Rocket\MP3Rocket.exe:MP3 Rocket 5.1.7
"{2CDE0719-5D57-43BA-AB9E-8BE7FD0F4268}"= TCP:c:\program files\MP3 Rocket\MP3Rocket.exe:MP3 Rocket 5.1.7
"{40B8D32C-3A44-4A16-845F-D0D6C75D793B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{83ACAA52-050C-4FEE-9139-3A373FD694BF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{E03248B2-9BB5-458F-978C-F31D055F4EF5}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{70A92A74-05A7-4FC9-B40F-AB8ADA349718}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{8B014187-1DA8-4886-BAAF-66D265AE07AD}c:\\program files\\java\\jre1.6.0_01\\bin\\javaw.exe"= UDP:c:\program files\java\jre1.6.0_01\bin\javaw.exe:Java™ Platform SE binary
"UDP Query User{55A66F47-757E-4E27-9B33-B9B18C734D44}c:\\program files\\java\\jre1.6.0_01\\bin\\javaw.exe"= TCP:c:\program files\java\jre1.6.0_01\bin\javaw.exe:Java™ Platform SE binary
"TCP Query User{C4746A8B-B18A-4ACF-B380-44AB487172AF}c:\\program files\\windows live\\messenger\\msnmsgr.exe"= UDP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"UDP Query User{DB549CA6-8F25-458E-8C09-5C19A0B69933}c:\\program files\\windows live\\messenger\\msnmsgr.exe"= TCP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"{45644CA7-6DA4-4662-BB22-A63D22A14975}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{F4FB582D-3791-45EE-ADBD-FE2B42000896}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{E89DF057-EE77-449E-98C2-13F6FFE6138A}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{03B9621A-A0D9-4843-9A82-0FA8C6CBD77C}"= Profile=Private|c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6C795C3A-DBA9-445C-894A-0C1BABC59DE6}"= Disabled:c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{D7E5D52F-E7D0-4020-905D-4FF249674F18}"= Disabled:c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-01-29 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-01-29 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-29 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-29 298264]
S2 gupdate1c980f2ca0647e0;Google Update Service (gupdate1c980f2ca0647e0);c:\program files\Google\Update\GoogleUpdate.exe [2009-01-27 119280]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-01-31 29744]
S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\System32\drivers\NETw2v32.sys [2006-11-02 2589184]
S3 SaiH075C;SaiH075C;c:\windows\System32\drivers\SaiH075C.sys [2007-05-01 132232]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7006874a-8d7c-11dd-9ca5-806e6f6e6963}]
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder

2009-02-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-27 19:39]

2009-02-04 c:\windows\Tasks\GoogleUpdateTask.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-01-27 19:47]

2009-02-06 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll []
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=nofound&Br=EM&Loc=ENG_US&Sys=DTP&M=T5234
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: eset.eu\www
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 07:40:41
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-06 7:43:40
ComboFix-quarantined-files.txt 2009-02-06 14:43:36

Pre-Run: 213,288,841,216 bytes free
Post-Run: 213,333,438,464 bytes free

215 — E O F — 2009-02-06 04:26:53


We did put Go To My PC on here. My husband uses it to access his work computer and do paperwork from home. I ran that program and posted the log. Thank-you again for all you have done so far.
Post #17
Hi,

Let's check your Firewall is functioning correctly.

Please download LeakTest.
  • Ensure that you are connected to the Internet
  • Right-click on LeakTest and select Run As Administrator…
  • Click Ok at the prompt.
  • Click Test For Leaks.
  • Click Ok at the prompt.
  • If your Firewall asks reports that LeakTest is trying to access the Internet, please click No or Block.
Please report whether LeakTest reports Firewall Penetrated or Unable To Connect.


Download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.
  • Open the OTScanIt2 folder and double-click on OTScanIt.exe to start the program. Make sure you close all other programs and don't use the PC while the scan runs.
  • Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Use the Add Reply button and post the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report.

Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way.

Thanks.
Post #18
firewall was penetrated….i do not have the red shield that usually pops up when your settings are wrong so as far as I knew my firewall was working maybe that is a clue…..and here is the attachment

Attachments:

Post #19
Thanks for that. I am sorry about all these scans, its just that nothing is showing up as using your ports. If you don't mind, I have one more scan suggested to me to look for this issue.

Download avz4.zip from here
  • Unzip it to your desktop to a folder named avz4
  • Double click on AVZ.exe to run it.
  • Run an update by clicking the Auto Update button on the Right of the Log window: [external image: Posted Image]
  • Click Start to begin the update
Note: If you recieve an error message, chose a different source, then click Start again
  • After the update, from the "File" menu, choose "Standard Scripts"
  • Put a check next to item 2: Advanced System Investigation
  • Click Execute selected scripts
  • At the next prompt, click the OK button
  • Let the scan run and click "OK" when the completion prompt pops up
  • Now Close out of the Standard Scripts window, and exit AVZ
  • Navigate to the avz4 folder and locate the folder LOG
  • Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
  • Attach the Compressed file, virusinfo_syscheck.zip, to your next reply, along with a fresh HijackThis log

Also, how would you feel about installing a third-party Firewall instead of Windows Firewall to see if that helps at all? If you want to give it a go, I can suggest some free Firewalls that are considered to be good at what they do.

Thanks.
Post #20
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23:11 PM, on 2/8/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch…DTP&M=T5234
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [a-squared] "C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2guard.exe" /d=60
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.eset.eu
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL avgrsstx.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\eMachines Games\eMachines Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c980f2ca0647e0) (gupdate1c980f2ca0647e0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7159 bytes


I hope I attched the right file, the zipped one. I am fine with the third party firewall, I'm sure you wouldn't recommend an unsafe thing. If I didn't do the right file I will send the other two that were in that folder.

Attachments:

Post #21
Hi,

Thanks for that log, I am just going to check back with some of my colleagues on that.

In the meantime, here are 3 (free) Firewalls that I usually recommend to those without one.
1) Comodo
2) Agnitum
3) Sunbelt/Kerio
Once you have installed one of these, disable Windows Firewall.

I will check back soon.

Thanks.
Post #22
Ok I have Comodo internet security pro installed…..it seems to have everything, i can't decipher it all ….but the problem is my firewall was still penetrated with a leak test…..and under traffic it said openvpn.exe was using 99.8% of the traffic……I attached a new hijack this log as well

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:02:30 PM, on 2/9/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Comodo\SafeSurf\cssurf.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Comodo\TrustConnect\bin\TrustConnect.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch…DTP&M=T5234
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\Comodo\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.eset.eu
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} (TPIR Control) - http://www.worldwinner.com/games/v50/tpir/tpir.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/famil…/familyfeud.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL C:\Windows\system32\guard32.dll C:\Windows\system32\cssdll32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\eMachines Games\eMachines Game Console\GameConsoleService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1c980f2ca0647e0) (gupdate1c980f2ca0647e0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7002 bytes
Post #23
Here is another thing I am wondering if it is normal….with this comodo program it tell me traffic incoming and traffic outgoing….when i open up internet explorer i all of the sudden get 20 things on outgoing and they are various ip addresses using various amounts of bytes in and out….is this normal?
Post #24
Hi,

I have had some suggestions from out Tech Team Administrator, Doug.

First of all, this openvpn.exe is a file used for remote access work, ssh tunnelling, and other such activities. It undoubtedly will use a few ports for what it does. Is this something that you use? Do you ever have to remotely access any files, ever need to work from home or do anything else that may involve making this kind of 'special' connection?

Next, it has been suggested that we can increase your computer's performance by turning of Windows Search Indexer. You can do this by the following:

Click Start, type services.msc and open the program. DO NOT make any changes in this program other than the following. Scroll down the list of services until you see Windows Search, double-click on it to open the options screen. Where it says Startup Type:, please change the value to say Disabled. Next, click the Stop button. Click Apply, OK and then exit services.msc.


Now, I want to run AVZ again. Please do the same as my previous instructions for AVZ, but this time please right-click the program and select Run As Administrator… instead of double-clicking it. Attach the log as before.


There are a few other things we can look into, but we'll leave it at that for now and see if that sheds any light.

Thanks.
Post #25
ok….so I did the windows search thing and disabled it and stopped it….it came up with an error though saying it could not be stopped…but on the main page it said it was disabled so I do not know…..next AvZ…when I went to do the updat it comes up with a window that says…..Automatic update error-loaded file is damaged-main062.avz… so the remote access….the only thing we do that i can think of is we use this computer to access our shop computer….we use go to my pc for that……let me know what else you may need….thanks

Attachments:

Post #26
Hi,

OK. I am quite satisfied that there is no Malware involved in this. Since Malware is my area, I think I will now hand you over to someone who will be able to aid you better in sorting out the remaining problems with your computer. I recommend you start a new topic in this forum:
Browser, Internet and Email
With a description of your problem and also a link to this topic so they can see what has already been done.

You should receive prompt, expert assistance from the Tech Team, and I am sure they will be able to make much more progress than we have done.

I am sorry there is nothing more that I can do, but as I say, there is no Malware involvement.

Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI