|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
|
|
Thread Tools |
07-06-2008, 05:05 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2008
Posts: 1
OS: Vista
|
Malware Problem- Extemely sluggish computer
I have attached the log file i got after running dss.exe. My computer has been extremely sluggish. i have a hard time opening certain websites, specifically Gmail and facebook applications. When i try and open gmail i have to click on the basic html link or it won't open at all. I don't know if this is also related, but i have lost all sound on my computer. It says that no audio output device is installed. Maybe the Malware killed that. I don't know if it can. Thanks for your help.
Deckard's System Scanner v20071014.68 Run by Ryan D. Johnson on 2008-07-06 17:47:07 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 2 Restore Point(s) -- 2: 2008-07-05 15:19:50 UTC - RP307 - Windows Update 1: 2008-07-04 07:38:53 UTC - RP306 - Windows Vista Service Pack 1 Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Ryan D. Johnson.exe) ------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:50:57 PM, on 7/6/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Windows\System32\mobsync.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe C:\Acer\Empowering Technology\eAudio\eAudio.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Acer\Acer VCM\AcerVCM.exe C:\Windows\system32\igfxext.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\ehome\ehmsas.exe C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE C:\Program Files\Acer\Acer VCM\VC.exe C:\Program Files\Acer\Acer VCM\acp2HID.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Ryan D. Johnson\Downloads\dss.exe C:\Windows\system32\conime.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Ryan D. Johnson.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:0/proxy.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe" O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\Windows\system32\PSDrvCheck.exe O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [LXDJCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXDJtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Acer VCM.lnk = ? O4 - Global Startup: Empowering Technology Launcher.lnk = C:\Acer\Empowering Technology\eAPLauncher.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...nt/swflash.cab O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/i...rl.cab?lmi=100 O21 - SSODL: SvcLauncher - {8C057F9B-678F-2874-35CD-189D9108DFD7} - C:\Windows\system32\nbdtn\Director_yidnjtxsg.dll O22 - SharedTaskScheduler: SvcLauncher - {8C057F9B-678F-2874-35CD-189D9108DFD7} - C:\Windows\system32\nbdtn\Director_yidnjtxsg.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: lxdj_device - - C:\Windows\system32\lxdjcoms.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 9915 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R3 BDSelfPr - \??\c:\program files\bitdefender\bitdefender 2008\bdselfpr.sys R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; > R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 ALaunchService (ALaunch Service) - c:\acer\alaunch\alaunchsvc.exe <Not Verified; ; ALaunchSvc Service Image> R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> R2 eLockService (eLock Service) - c:\acer\empowering technology\elock\service\elockserv.exe <Not Verified; Acer Inc.; Acer eLock Management> R2 eNet Service - c:\acer\empowering technology\enet\enet service.exe <Not Verified; Acer Inc.; Acer eNet Management> R2 eRecoveryService (eRecovery Service) - c:\acer\empowering technology\erecovery\erecoveryservice.exe <Not Verified; Acer Inc.; eRecoveryService> R2 eSettingsService (eSettings Service) - c:\acer\empowering technology\esettings\service\capuserv.exe <Not Verified; ; Service> R2 MobilityService - c:\acer\mobility center\mobilityservice.exe -p R2 WMIService (ePower Service) - c:\acer\empowering technology\epower\epowersvc.exe <Not Verified; acer; Acer ePower Management> S2 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing) -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318} Description: Realtek High Definition Audio Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250121&REV_1001\4&11623BA7&0&0001 Manufacturer: Realtek Name: Realtek High Definition Audio PNP Device ID: HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250121&REV_1001\4&11623BA7&0&0001 Service: Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Broadcom NetLink (TM) Gigabit Ethernet Device ID: PCI\VEN_14E4&DEV_1693&SUBSYS_01211025&REV_02\4&FED8DA8&0&00E5 Manufacturer: Broadcom Name: Broadcom NetLink (TM) Gigabit Ethernet PNP Device ID: PCI\VEN_14E4&DEV_1693&SUBSYS_01211025&REV_02\4&FED8DA8&0&00E5 Service: b57nd60x Class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318} Description: ADS Instant HDTV PCI Device ID: ROOT\MEDIA\0000 Manufacturer: ADS Technologies Name: ADS Instant HDTV PCI PNP Device ID: ROOT\MEDIA\0000 Service: Ph3xIB32 -- Scheduled Tasks ------------------------------------------------------------- 2008-07-06 00:55:30 438 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{32C5D8DD-9034-4052-B962-E3EB59CE960C}.job -- Files created between 2008-06-06 and 2008-07-06 ----------------------------- 2008-07-05 09:20:32 0 d-------- C:\Windows\LastGood 2008-07-04 03:13:12 0 d-------- C:\PerfLogs 2008-07-04 01:38:11 0 d-------- C:\08e534cbca30636c4c 2008-07-04 01:36:30 0 d-------- C:\HiTRUSTDrive 2008-07-04 00:41:58 0 d-------- C:\Program Files\SpywareBlaster 2008-07-03 14:46:45 0 d-------- C:\Program Files\Panda Security 2008-07-02 00:14:01 0 d-------- C:\Program Files\Trend Micro 2008-06-23 14:50:26 0 d--h----- C:\Users\All Users\CanonBJ 2008-06-23 11:44:06 0 d-------- C:\Program Files\QuickTime 2008-06-23 11:42:06 0 d-------- C:\Program Files\Bonjour 2008-06-23 10:26:54 0 d-------- C:\Windows\system32\nbdtn 2008-06-12 13:43:07 0 d-------- C:\Users\All Users\DVD Shrink 2008-06-12 13:43:06 0 d-------- C:\Program Files\DVD Shrink 2008-06-12 12:12:29 0 d-------- C:\Program Files\DVD Decrypter 2008-06-12 12:04:17 45056 --a------ C:\Windows\system32\WNASPI32.DLL <Not Verified; Adaptec; Adaptec's ASPI Layer> 2008-06-12 12:04:17 25244 --a------ C:\Windows\system32\drivers\ASPI32.SYS <Not Verified; Adaptec; Adaptec's ASPI Layer> 2008-06-12 12:04:17 4672 --a------ C:\Windows\system\WOWPOST.EXE <Not Verified; Adaptec; Adaptec's ASPI Layer> 2008-06-12 12:04:17 5600 --a------ C:\Windows\system\WINASPI.DLL <Not Verified; Adaptec; Adaptec's ASPI Layer> 2008-06-12 12:04:14 0 d-------- C:\Program Files\XviD 2008-06-12 12:04:09 641021 --a------ C:\Windows\unins000.exe <Not Verified; ; Inno Setup> 2008-06-12 12:04:09 1682 --a------ C:\Windows\unins000.dat 2008-06-12 12:04:09 166912 --a------ C:\Windows\system32\Lame_enc.dll 2008-06-12 12:04:09 187904 --a------ C:\Windows\system32\Lame.exe 2008-06-12 12:03:40 0 d-------- C:\Program Files\EasyDVDRip 2008-06-11 03:01:34 0 d-------- C:\Program Files\AKProg -- Find3M Report --------------------------------------------------------------- 2008-07-06 17:50:47 81984 --a------ C:\Windows\system32\bdod.bin 2008-07-04 03:27:10 174 --ahs---- C:\Program Files\desktop.ini 2008-07-04 03:17:58 0 d-------- C:\Program Files\Windows Calendar 2008-07-04 03:17:57 0 d-------- C:\Program Files\Windows Sidebar 2008-07-04 03:17:57 0 d-------- C:\Program Files\Movie Maker 2008-07-04 03:17:55 0 d-------- C:\Program Files\Windows Mail 2008-07-04 03:17:52 0 d-------- C:\Program Files\Windows Collaboration 2008-07-04 03:17:50 0 d-------- C:\Program Files\Windows Journal 2008-07-04 03:17:49 0 d-------- C:\Program Files\Windows Photo Gallery 2008-07-04 03:17:36 0 d-------- C:\Program Files\Windows Defender 2008-07-03 01:05:24 0 d-------- C:\Program Files\Java 2008-07-03 00:49:57 0 d-------- C:\Users\Ryan D. Johnson\AppData\Roaming\Corel 2008-06-30 15:19:48 0 d-------- C:\Users\Ryan D. Johnson\AppData\Roaming\Mozilla 2008-06-25 13:49:34 0 d-------- C:\Program Files\Google 2008-06-25 13:49:26 35948 --a------ C:\Users\Ryan D. Johnson\AppData\Roaming\.googlewebacchosts 2008-06-23 11:46:20 0 d-------- C:\Users\Ryan D. Johnson\AppData\Roaming\Apple Computer 2008-06-13 18:53:39 0 d-------- C:\Users\Ryan D. Johnson\AppData\Roaming\RipIt4Me 2008-06-06 18:42:33 0 d-------- C:\Users\Ryan D. Johnson\AppData\Roaming\U3 2008-06-04 16:59:13 0 d-------- C:\Program Files\Common Files\ACD Systems 2008-06-04 16:55:49 0 d-------- C:\Users\Ryan D. Johnson\AppData\Roaming\ACD Systems 2008-06-04 16:53:44 0 d-------- C:\Program Files\Common Files 2008-06-01 15:22:46 77824 --a------ C:\Windows\system32\xcomm.dll <Not Verified; BitDefender; BitDefender Communicator> 2008-05-30 17:11:29 0 d-------- C:\Users\Ryan D. Johnson\AppData\Roaming\Bitdefender 2008-05-30 17:11:11 0 d-------- C:\Program Files\BitDefender 2008-05-30 17:11:09 0 d-------- C:\Program Files\Common Files\BitDefender 2008-05-23 12:31:42 287232 -ra------ C:\Windows\system32\sqlceca30.dll <Not Verified; Microsoft Corporation; Microsoft SQL Server Compact Edition> 2008-05-23 12:31:41 44544 -ra------ C:\Windows\system32\sqlceme30.dll <Not Verified; Microsoft Corporation; Microsoft SQL Server Compact Edition> 2008-05-23 12:31:41 129536 -ra------ C:\Windows\system32\sqlceer30EN.dll <Not Verified; Microsoft Corporation; Microsoft SQL Server Compact Edition> 2008-05-23 12:31:41 52736 -ra------ C:\Windows\system32\sqlcecompact30.dll <Not Verified; Microsoft Corporation; Microsoft SQL Server Compact Edition> 2008-05-12 10:49:23 0 d-------- C:\Program Files\iTunes 2008-05-12 10:49:15 0 d-------- C:\Program Files\iPod 2008-04-20 18:11:30 72 --a------ C:\Windows\PCBusted123.bat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/19/2008 01:38 AM] "NvSvc"="C:\Windows\system32\nvsvc.dll" [06/26/2007 01:33 AM] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [06/26/2007 01:32 AM] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [06/26/2007 01:33 AM] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [05/08/2007 11:09 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [03/08/2007 05:38 AM] "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [04/25/2007 05:33 PM] "eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [06/11/2007 03:54 PM] "PLFSet"="C:\Windows\PLFSet.dll" [04/25/2007 02:47 PM] "LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [07/30/2007 07:36 PM] "eRecoveryService"="" [] "Acer Product Registration"="C:\Program Files\Acer Registration\ACE1.exe" [02/02/2007 01:24 PM] "Acer Assist Launcher"="C:\Program Files\Acer Assist\launcher.exe" [02/02/2007 12:05 PM] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [02/12/2007 04:37 PM] "SetPanel"="C:\Acer\APanel\APanel.cmd" [] "PinnacleDriverCheck"="C:\Windows\system32\PSDrvCheck.exe" [11/10/2003 06:06 PM] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [02/05/2007 05:52 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [03/25/2008 04:28 AM] "LXDJCATS"="C:\Windows\system32\spool\DRIVERS\W32X86\3\LXDJtime.dll" [02/09/2007 05:21 PM] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [01/02/2008 06:07 PM] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [01/02/2008 06:06 PM] "Persistence"="C:\Windows\system32\igfxpers.exe" [01/02/2008 06:07 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 11:36 AM] "BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [07/03/2008 01:15 AM] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [01/19/2008 01:33 AM] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [01/19/2008 01:33 AM] "Aim6"="" [] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 01:33 AM] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Acer VCM.lnk - C:\Program Files\Acer\Acer VCM\AcerVCM.exe [10/26/2007 4:59:36 PM] Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [8/21/2007 8:09:17 AM] Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 2:05:56 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableUIADesktopToggle"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{8C057F9B-678F-2874-35CD-189D9108DFD7}"= C:\Windows\system32\nbdtn\Director_yidnjtxsg.dll [06/23/2008 10:27 AM 2270294] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "SvcLauncher"= {8C057F9B-678F-2874-35CD-189D9108DFD7} - C:\Windows\system32\nbdtn\Director_yidnjtxsg.dll [06/23/2008 10:27 AM 2270294] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum bdx scan [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] AutoRun\command- E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] AutoRun\command- G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a97fe14-fe82-11dc-accf-c1086cb81e9e}] AutoRun\command- G:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{339feb50-b57e-11dc-8436-c359c615fa85}] AutoRun\command- E:\LaunchU3.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-07-06 17:54:34 ------------ |
|
     |
|
07-09-2008, 09:34 AM
|
#2 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 25,379
OS: 2000 Pro; XP Pro; XP Home
|
Re: Malware Problem- Extemely sluggish computer
Not sure if I see the cause for your issues, but i do see something which should be investigated.
Please go to: VirusTotal
Do you know anything about the above file?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Our help is voluntary, but this site needs donations to operate.
Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience. |
|
|
|
| Thread Tools | |
|
|
