rc1234

Dear Tech Support,

I'm facing some terrible problems started two days ago and I really appreciate your assistant.
I'm using XP Pro with SP3. The problems started by a sudden restart in the middle of my work. After login again, I found out that the sudden restart is repeated and it seams like the computer got into a loop. I was trying to use AVG and Ad-Ware to clean some staff, but nothing happen. I have removed the option of 'automatically restart' when failure (in System-->Advanced-->Startup and Recovery), but then after a minute or so, received the blue screen with the following details:
*** STOP: 0x0000007E (0x0000005, 0xB14B86F9, 0xBAD03C1C, 0xBAD03918)
jfw.sys - Address B14B86F9 base at B14B1000 DateStamp 49bf727f
etc.
I was trying to run chkdsk again but got the same results.
I have noticed that I installed lately some free software (from giveawayoftheday.com) that installed the jfw.sys so I have uninstalled it (the software was jfirewall and I've found it after running your dds tool).

Now the status is that I can login to the machine, but I do not know what next...? What was corrupted and if any virus/spyware still reside in the machine. Another terrible thing is that I see now in my C drive many folders that were created in the last two days (some ARE links from the IE favorites) and other some gibberish names with some setups and different files inside which looks very legitimate, such as:
2009-05-18 07:38 <DIR> --d----- C:\7a5583891bc0dd5b010ccc
2009-05-18 07:37 <DIR> --d----- C:\9e7c904b7ca740eec18ff14622abe0
2009-05-18 07:34 <DIR> --d----- C:\2f624d63665ea0472768d64df70811f6
2009-05-18 07:34 <DIR> --d----- C:\749ebe22eef91ec8b039767198
2009-05-18 07:31 <DIR> --d----- C:\0892d2033d12a2ec99
2009-05-18 07:31 <DIR> --d----- C:\8052bfed0b101db2ce
2009-05-18 07:28 <DIR> --d----- C:\fe848be54a34e1f96444d1ca902550
2009-05-18 07:28 <DIR> --d----- C:\390562ff2628ebe6a3be
2009-05-18 04:28 <DIR> --d----- C:\04ba5d8b8fadea5340eb943769
2009-05-18 04:28 <DIR> --d----- C:\1ba9208733c6ca146b10cf0c
2009-05-18 03:47 <DIR> --d----- C:\ea2c237101522dc5a8b944
2009-05-18 03:47 <DIR> --d----- C:\aaddecfe9826f64d11dc84
2009-05-18 03:09 <DIR> --d----- C:\85f72f309f4575d95c4543e07ac7
2009-05-18 03:09 <DIR> --d----- C:\8b1086eda9490f58b88b9e8a
2009-05-18 03:06 <DIR> --d----- C:\e3915b028dc4933d5c4b8a80
2009-05-18 03:06 <DIR> --d----- C:\17c5c2642f441325c0613ed15ea28712
2009-05-18 03:03 <DIR> --d----- C:\f1940edbf848202726f2
2009-05-18 03:03 <DIR> --d----- C:\61719aa7f18b1be702a6

Now, I have run Norton Internet Security 2009 and AVG 8.5, as well as Ad-Ware (Free License), bur no special virus was found!!!


Here is the dds.txt file:

DDS (Ver_09-05-14.01) - NTFSx86
Run by rcohen at 22:14:56.45 on Mon 05/18/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3054.2564 [GMT 3:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Documents and Settings\rcohen\Desktop\Ronen\apps\Ditto_Portable_3_15_4_0\Ditto\Ditto.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\rcohen\Desktop\fixPC\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.il/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Disabled:{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - No File
BHO: Disabled:{22BF413B-C6D2-4d91-82A9-A0F997BA588C} - No File
BHO: Disabled:{DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO: Disabled:{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Ditto] c:\documents and settings\rcohen\desktop\ronen\apps\ditto_portable_3_15_4_0\ditto\Ditto.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HSLAB Sys Monitor Pro] c:\program files\handy software lab\hslab sys monitor pro\sm.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
dRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
mPolicies-system: EnableLUA = 0 (0x0)
IE: Add to EverNote - c:\program files\evernote\evernote\enbar.dll/2000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - c:\program files\eltima software\flash decompiler trillix\saveflash\iebt.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: acceptondemand.com\help
Trusted Zone: acceptondemand.com\support
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://vpn.sjc.opsource.net/CACHE/stc/1/binaries/vpnweb.cab
DPF: {67AB7FBE-251A-49E7-87EE-442F120D9364} - hxxp://tavor:8104/InstallClient/AcceptClient_IE.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: {FA831101-3BB8-4F51-9EC6-309C89270AEC} = 192.168.0.1,212.150.49.10
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: c:\progra~1\google\google~3\goec62~1.dll,c:\progra~1\google\google~3\GOEC62~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\rcohen\applic~1\mozilla\firefox\profiles\ib4kjtlc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.il/
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\mozilla firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

============= SERVICES / DRIVERS ===============

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2009-4-30 40368]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-15 64160]
R1 jFirewallProDriver;jFirewallProDriver;c:\program files\jfirewall personal pro 1.0\drivers\jfw.sys [2009-3-17 48512]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 953168]
S3 BCASPROT;Advanced System Protector;\??\c:\program files\systweak\advanced system protector\sasprot32.sys --> c:\program files\systweak\advanced system protector\sasprot32.sys [?]
S3 GoogleDesktopManager-010108-205858;Google Desktop Manager 5.7.801.1629;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-1-30 29744]
S3 OracleOraDb10g_home1TNSListener;OracleOraDb10g_home1TNSListener;c:\oracle\product\10.2.0\db_2\bin\tnslsnr --> c:\oracle\product\10.2.0\db_2\bin\TNSLSNR [?]
S3 OracleServiceORCL;OracleServiceORCL;c:\oracle\product\10.2.0\db_2\bin\oracle.exe orcl --> c:\oracle\product\10.2.0\db_2\bin\ORACLE.EXE ORCL [?]
S3 PlcmAEC;Polycom Communicator;c:\windows\system32\drivers\PlcmAEC.sys [2008-1-3 512896]
S3 vmserverdWin32;VMware Registration Service;c:\program files\vmware\vmware server\vmserverdWin32.exe [2008-5-9 1650781]
S3 vpnva;Cisco AnyConnect VPN Virtual Miniport Adapter for Windows;c:\windows\system32\drivers\vpnva.sys [2008-5-19 15360]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]
S4 OracleJobSchedulerORCL;OracleJobSchedulerORCL;c:\oracle\product\10.2.0\db_2\bin\extjob.exe orcl --> c:\oracle\product\10.2.0\db_2\bin\extjob.exe ORCL [?]

=============== Created Last 30 ================

2009-05-18 20:22 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-05-18 19:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avg8
2009-05-18 12:39 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SecTaskMan
2009-05-18 12:38 <DIR> --d----- c:\program files\Security Task Manager
2009-05-18 11:19 <DIR> --dsh--- c:\documents and settings\rcohen\IECompatCache
2009-05-18 11:19 <DIR> --d----- C:\Wii
2009-05-18 11:19 <DIR> --d----- C:\My
2009-05-18 11:19 <DIR> --d----- C:\GoodLinks
2009-05-18 11:19 <DIR> --d----- C:\Mona Vie
2009-05-18 11:17 <DIR> --dsh--- c:\documents and settings\rcohen\PrivacIE
2009-05-18 11:05 <DIR> --d----- c:\windows\pss
2009-05-18 07:38 <DIR> --d----- C:\7a5583891bc0dd5b010ccc
2009-05-18 07:37 <DIR> --d----- C:\9e7c904b7ca740eec18ff14622abe0
2009-05-18 07:34 <DIR> --d----- C:\2f624d63665ea0472768d64df70811f6
2009-05-18 07:34 <DIR> --d----- C:\749ebe22eef91ec8b039767198
2009-05-18 07:31 <DIR> --d----- C:\0892d2033d12a2ec99
2009-05-18 07:31 <DIR> --d----- C:\8052bfed0b101db2ce
2009-05-18 07:28 <DIR> --d----- C:\fe848be54a34e1f96444d1ca902550
2009-05-18 07:28 <DIR> --d----- C:\390562ff2628ebe6a3be
2009-05-18 04:28 <DIR> --d----- C:\04ba5d8b8fadea5340eb943769
2009-05-18 04:28 <DIR> --d----- C:\1ba9208733c6ca146b10cf0c
2009-05-18 03:47 <DIR> --d----- C:\ea2c237101522dc5a8b944
2009-05-18 03:47 <DIR> --d----- C:\aaddecfe9826f64d11dc84
2009-05-18 03:09 <DIR> --d----- C:\85f72f309f4575d95c4543e07ac7
2009-05-18 03:09 <DIR> --d----- C:\8b1086eda9490f58b88b9e8a
2009-05-18 03:06 <DIR> --d----- C:\e3915b028dc4933d5c4b8a80
2009-05-18 03:06 <DIR> --d----- C:\17c5c2642f441325c0613ed15ea28712
2009-05-18 03:03 <DIR> --d----- C:\f1940edbf848202726f2
2009-05-18 03:03 <DIR> --d----- C:\61719aa7f18b1be702a6
2009-05-18 00:23 <DIR> --d----- c:\windows\system32\XPSViewer
2009-05-18 00:23 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-05-18 00:23 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-05-18 00:23 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-05-18 00:23 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-05-18 00:23 <DIR> --d----- C:\38ca6bb8a733697052
2009-05-18 00:23 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-05-18 00:23 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-05-18 00:23 117,760 -------- c:\windows\system32\prntvpt.dll
2009-05-18 00:23 <DIR> --d----- c:\windows\SxsCaPendDel
2009-05-18 00:16 <DIR> --dsh--- c:\documents and settings\rcohen\IETldCache
2009-05-17 22:56 <DIR> --d----- C:\6cf4c7091811ee9405b3d4693c
2009-05-17 22:56 <DIR> --d----- C:\a24ff723cdde87d8bc4ec6
2009-05-17 22:50 <DIR> --d----- c:\windows\ie8updates
2009-05-17 22:50 102,400 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-05-17 22:50 <DIR> -cd-h--- c:\windows\ie8
2009-05-17 20:50 1,023,779 a------- C:\lxcjUNST.csv
2009-05-17 20:50 1,022,976 a------- C:\lxcjUNST.001
2009-05-17 20:50 511,488 a------- C:\lxcjUNST.002
2009-05-17 20:50 511,488 a------- C:\lxcjUNST.000
2009-05-17 10:39 <DIR> --d----- C:\BM2005
2009-05-12 11:26 <DIR> --d----- c:\program files\Almeza
2009-05-11 10:26 <DIR> --d----- c:\program files\Extra DVD to Audio MP3 Ripper
2009-05-09 16:26 <DIR> --d----- c:\program files\Extra DVD to 3GP Ripper
2009-05-04 23:45 <DIR> --d----- c:\docume~1\rcohen\applic~1\Systweak
2009-05-04 23:45 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Systweak
2009-04-30 10:26 7,533 a------- c:\windows\system32\noval6.ctm
2009-04-30 10:26 20,648 a------- c:\windows\system32\novamnl6.dll
2009-04-30 10:26 18,600 a------- c:\windows\system32\novamil6.dll
2009-04-30 10:26 <DIR> --d----- c:\program files\Softland
2009-04-30 09:10 40,368 a------- c:\windows\system32\drivers\hotcore3.sys
2009-04-30 09:10 4,244,744 a------- c:\windows\system32\qtp-mt334.dll
2009-04-30 09:10 247,560 a------- c:\windows\system32\prgiso.dll
2009-04-30 09:10 13,576 a------- c:\windows\system32\wnaspi32.dll
2009-04-30 09:10 <DIR> --d----- c:\program files\Paragon Software
2009-04-26 13:59 <DIR> --d----- c:\docume~1\rcohen\applic~1\Clipdiary
2009-04-24 14:48 <DIR> --d----- c:\program files\Eltima Software
2009-04-22 16:16 15,688 a------- c:\windows\system32\lsdelete.exe
2009-04-22 13:06 <DIR> --d----- c:\docume~1\rcohen\applic~1\Zoner
2009-04-22 13:05 <DIR> --d----- c:\program files\Zoner
2009-04-20 11:17 17,542 a------- c:\windows\SothinkScroller.ico
2009-04-20 11:17 44,544 a------- c:\windows\system32\msxml4a.dll
2009-04-19 10:07 <DIR> --d----- c:\program files\Zards software

==================== Find3M ====================

2009-04-22 15:21 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-03-08 12:21 81,920 a------- c:\docume~1\rcohen\applic~1\ezpinst.exe
2009-03-08 12:21 47,360 a------- c:\docume~1\rcohen\applic~1\pcouffin.sys
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 17:22 284,160 a------- c:\windows\system32\pdh.dll
2007-12-31 14:01 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat

============= FINISH: 22:15:12.84 ===============


Thank you in advance for your support!

Attached Files

Attach.zip (16.3 KB, 2 views)