|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Virus/Trojan/Spyware Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
LinkBack | Thread Tools |
04-20-2009, 07:11 PM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Is this a malware/spyware/virus etc. problem?
I should've asked for help on this a long time ago, but I've been dealing with it...anyways, a couple months ago or so, I had some cheap virus protection pop up, except it wasn't from the internet the way the window looked(I'm not very good with computers). Of course I clicked no to the license agreement and it went away. I went on with whatever it was I was doing, and it came back again about 10 min later. I said no again and my McAfee said it found a trojan and deleted it. Another 10min later my whole explorer.exe interface just disappears. I restart it up again, and it flashes on and off repeatedly until it finally just goes off again. So I work around this for a while using task manager...lol. Eventually, about a week or two later, the explorer interface is working again and I can go about what I was doing, I thought everything was fixed....sadly I was mistaken. I get a blue screen saying "Page_Fault_In_Non_Paged_Area" and warnings about how there was a system error and blah blah to protect computer...and an error code. I have a picture I took with my camera I can type stuff out in a reply if needed. Now my computer has 1500MB of RAM or so, and its running WAY slower than it was before...plus I get that blue screen every 1-3 days, doesn't matter what I'm doing and its really random. That's the basic story, sorry for blabbering, but I could really use some help right about now, because I think if I procrastinate it much longer, the computer might blow on me lol. It's an HP, about 4 years old I think. Tried a lot of stuff, no viruses or anything, scanned with 50 diff programs for em. Cleaned errors out...no fix for this problem yet. I've searched on this topic and saw it could potentially be bad RAM, but I've removed RAM sticks and booted a few times, and same problem, so I really am clueless what is wrong. Please help!!! Thanks a lot in advance.
Here's my logs: DDS (Ver_09-03-16.01) - NTFSx86 Run by HP_Owner at 19:50:59.95 on Mon 04/20/2009 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1527.888 [GMT -5:00] AV: COMODO Antivirus *On-access scanning enabled* (Updated) AV: McAfee VirusScan *On-access scanning enabled* (Outdated) FW: McAfee Personal Firewall *enabled* FW: COMODO Firewall *enabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\libusbd-nt.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\PROGRA~1\McAfee\MSC\McOEMMGr.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\QuickTime\QTTask.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\Java\jre6\bin\jucheck.exe c:\windows\system\hpsysdrv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\HP_Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: Yahoo! IE Suggest: {5a263cf7-56a6-4d68-a8cf-345be45bc911} - c:\program files\yahoo!\search\YSearchSuggest.dll BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll BHO: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - No File BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll {f74a555f-5c86-46f0-9df1-2512996e898e} TB: HP view: {b2847e28-5d7d-4deb-8b67-05d28bcf79f5} - c:\program files\hp\digital imaging\bin\HPDTLK02.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Aim6] uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [IPHSend] c:\program files\common files\aol\iphsend\IPHSend.exe mRun: [MWLExe] c:\program files\mcafee\mwl\MWLGui.exe /Start mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [McENUI] c:\progra~1\mcafee\mhn\McENUI.exe /hide mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [SoundMan] SOUNDMAN.EXE mRun: [AlcWzrd] ALCWZRD.EXE mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [BOC-427] c:\progra~1\comodo\cboclean\BOC427.exe mRun: [McAfee Backup] "c:\program files\mcafee\mbk\McAfeeDataBackup.exe" dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\belkin~1.lnk - c:\program files\belkin\usb f5d7050\wireless utility\Belkinwcui.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe IE: Add To HP Organize... - c:\progra~1\hewlet~1\hporga~1\bin/module.main/favorites\ie_add_to.html IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab55579.cab DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab TCP: {34C0A864-20DC-4882-BCB1-2368B595FC09} = 192.168.0.100,192.168.0.1 Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - No File SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll, zpasspc.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\hp_owner\applic~1\mozilla\firefox\profiles\7gya1e6g.default\ FF - prefs.js: browser.startup.homepage - hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll FF - HiddenExtension: XUL Cache: {9374B670-86D5-4C81-A12B-3CA6DC69E142} - c:\windows\system32\config\systemprofile\local settings\application data\{9374b670-86d5-4c81-a12b-3ca6dc69e142}\ ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service ============= SERVICES / DRIVERS =============== R0 AVG Anti-Rootkit;AVG Anti-Rootkit;c:\windows\system32\drivers\avgarkt.sys [2007-1-31 5632] R1 AvgArCln;Avg Anti-Rootkit Clean Driver;c:\windows\system32\drivers\AvgArCln.sys [2008-3-27 3968] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-1-9 101776] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-1-9 31504] R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2007-1-11 213640] R2 Belkin 54g Wireless USB Network Adapter Service;Belkin 54g Wireless USB Network Adapter;c:\program files\belkin\belkin wireless network utility\WLService.exe [2006-1-10 49152] R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-10-1 210216] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-1-11 359952] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2007-1-11 144704] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2007-7-8 33792] R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2007-1-11 606736] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2007-1-11 79304] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2007-1-11 35272] R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2007-1-11 40552] S0 aylnlfdx;aylnlfdx;c:\windows\system32\drivers\phqghume.sys --> c:\windows\system32\drivers\phqghume.sys [?] S0 kozuvlew;kozuvlew;c:\windows\system32\drivers\buybxmlo.sys --> c:\windows\system32\drivers\buybxmlo.sys [?] S0 zlbscijh;zlbscijh;c:\windows\system32\drivers\ituugkxb.sys [] S2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2009-1-10 73464] S2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2009-1-9 618232] S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-10-10 24652] S3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;c:\windows\system32\drivers\rt2500usb.sys [2006-1-10 140416] S3 iatmunin;iatmunin;\??\c:\docume~1\hp_owner\locals~1\temp\iatmunin.sys --> c:\docume~1\hp_owner\locals~1\temp\iatmunin.sys [?] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2007-1-11 34216] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064] =============== Created Last 30 ================ 2009-04-20 17:06 <DIR> --d----- c:\windows\pss 2009-04-15 19:46 284,160 -------- c:\windows\system32\dllcache\pdh.dll 2009-04-15 19:46 401,408 -------- c:\windows\system32\dllcache\rpcss.dll 2009-04-15 19:46 110,592 -------- c:\windows\system32\dllcache\services.exe 2009-04-15 19:46 473,600 -------- c:\windows\system32\dllcache\fastprox.dll 2009-04-15 19:46 227,840 -------- c:\windows\system32\dllcache\wmiprvse.exe 2009-04-15 19:46 453,120 -------- c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-15 19:46 729,088 -------- c:\windows\system32\dllcache\lsasrv.dll 2009-04-15 19:46 617,472 -------- c:\windows\system32\dllcache\advapi32.dll 2009-04-15 19:46 714,752 -------- c:\windows\system32\dllcache\ntdll.dll 2009-04-15 19:41 2,560 -------- c:\windows\system32\xpsp4res.dll 2009-04-15 19:41 1,203,922 -------- c:\windows\system32\dllcache\sysmain.sdb 2009-04-15 19:41 215,552 -------- c:\windows\system32\dllcache\wordpad.exe 2009-04-14 13:17 41,808 a------- c:\windows\system32\xfcodec.dll 2009-03-29 14:40 <DIR> --d----- c:\program files\SiteAdvisor ==================== Find3M ==================== 2009-03-21 09:06 989,696 -------- c:\windows\system32\dllcache\kernel32.dll 2009-03-06 09:22 284,160 a------- c:\windows\system32\pdh.dll 2009-03-02 19:18 826,368 a------- c:\windows\system32\wininet.dll 2009-03-02 19:18 826,368 a------- c:\windows\system32\dllcache\wininet.dll 2009-02-27 23:54 636,072 a------- c:\windows\system32\dllcache\iexplore.exe 2009-02-20 05:20 70,656 a------- c:\windows\system32\dllcache\ie4uinit.exe 2009-02-20 05:20 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe 2009-02-20 00:14 161,792 a------- c:\windows\system32\dllcache\ieakui.dll 2009-02-09 07:10 729,088 a------- c:\windows\system32\lsasrv.dll 2009-02-09 07:10 714,752 a------- c:\windows\system32\ntdll.dll 2009-02-09 07:10 617,472 a------- c:\windows\system32\advapi32.dll 2009-02-09 07:10 401,408 a------- c:\windows\system32\rpcss.dll 2009-02-09 06:13 1,846,784 a------- c:\windows\system32\win32k.sys 2009-02-09 06:13 1,846,784 -------- c:\windows\system32\dllcache\win32k.sys 2009-02-07 19:02 2,066,048 -------- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-06 06:11 110,592 a------- c:\windows\system32\services.exe 2009-02-06 06:08 2,189,056 -------- c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 06:06 2,145,280 a------- c:\windows\system32\ntoskrnl.exe 2009-02-06 06:06 2,145,280 -------- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 05:39 35,328 a------- c:\windows\system32\sc.exe 2009-02-06 05:39 35,328 a------- c:\windows\system32\dllcache\sc.exe 2009-02-06 05:32 2,023,936 a------- c:\windows\system32\ntkrnlpa.exe 2009-02-06 05:32 2,023,936 -------- c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-03 14:59 56,832 a------- c:\windows\system32\secur32.dll 2009-02-03 14:59 56,832 -------- c:\windows\system32\dllcache\secur32.dll 2009-01-30 22:20 410,984 a------- c:\windows\system32\deploytk.dll 2008-07-09 18:11 0 a------- c:\documents and settings\hp_owner\jagex_runescape_preferences.dat 2007-10-15 16:47 1,756 a------- c:\docume~1\hp_owner\applic~1\wklnhst.dat 2006-04-29 16:31 389,120 a------- c:\documents and settings\hp_owner\remote.exe 2009-01-10 01:01 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008122920090105\index.dat 2009-01-10 17:01 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009011020090111\index.dat ============= FINISH: 19:53:28.65 =============== |
|
     
|
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
04-22-2009, 01:28 PM
|
#2 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
Hi,
*You have two internet security suites installed there (Comodo & Mcafee) These suites programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two of them running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash. Please remove one of them and keep only one. *Please visit this webpage for download links, and instructions for running combofix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review.
__________________
UNITE and ASAP since 2006  If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-22-2009, 02:34 PM
|
#3 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
That isn't what's causing the problem because I installed comodo after I started having the problem to check on it too. But I'll uninstall it anyways, because I don't use it. And I'll try running combofix, then ill post it afterwards.
|
|
|
|
|
04-22-2009, 04:29 PM
|
#4 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
Ok it took a while but i printed out and followed all instructions. I have the log report now too, I'm going to post it below.
ComboFix 09-04-23.02 - HP_Owner 04/22/2009 16:36.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1527.979 [GMT -5:00] Running from: c:\documents and settings\HP_Owner\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) FW: McAfee Personal Firewall *enabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\windows\IE4 Error Log.txt c:\windows\msvrc20.dll c:\windows\system32\bbIRBJlm.ini2 c:\windows\system32\DeLTAcfe.ini c:\windows\system32\DeLTAcfe.ini2 c:\windows\system32\drivers\seneka.sys c:\windows\system32\java2.sys c:\windows\system32\snjava.dll c:\windows\system32\tuCIknnn.ini c:\windows\system32\XEegOXyb.ini c:\windows\system32\XEegOXyb.ini2 c:\windows\system32\XyFiQXbc.ini D:\Autorun.inf . ---- Previous Run ------- . c:\windows\system\download c:\windows\system\logs c:\windows\system\sounds c:\windows\system32\drivers\senekatvxlgiyu.sys c:\windows\system32\senekaiqakfrhc.dll c:\windows\system32\senekatubdobaj.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_SENEKA ((((((((((((((((((((((((( Files Created from 2009-03-22 to 2009-04-22 ))))))))))))))))))))))))))))))) . 2009-04-16 00:46 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll 2009-04-16 00:46 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 00:46 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe 2009-04-16 00:46 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 00:46 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 00:46 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-16 00:46 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll 2009-04-16 00:46 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 00:46 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 00:41 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll 2009-04-16 00:41 . 2009-03-27 06:58 1203922 ------w c:\windows\system32\dllcache\sysmain.sdb 2009-04-16 00:41 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe 2009-04-14 18:17 . 2009-04-14 18:17 41808 ----a-w c:\windows\system32\xfcodec.dll 2009-03-29 23:33 . 2009-03-29 23:33 -------- d-----w c:\windows\system32\config\systemprofile\Application Data\SACore . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-22 21:27 . 2009-01-10 03:40 -------- d-----w c:\documents and settings\All Users\Application Data\comodo 2009-04-22 21:25 . 2009-01-10 05:20 -------- d-----w c:\documents and settings\All Users\Application Data\_comodo_ 2009-04-22 21:13 . 2007-07-07 01:17 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-04-22 21:11 . 2009-01-10 03:40 -------- d-----w c:\program files\COMODO 2009-04-22 21:05 . 2007-04-08 19:50 -------- d-----w c:\program files\Cheat Engine 2009-04-22 20:53 . 2006-01-03 19:31 72587 ----a-w C:\hpfr3840.log 2009-04-21 21:45 . 2006-12-25 00:13 -------- d-----w c:\program files\World of Warcraft 2009-04-20 23:57 . 2008-10-01 20:55 -------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2009-04-20 21:37 . 2007-04-14 17:35 -------- d-s---w c:\program files\Xfire 2009-04-19 16:48 . 2007-04-14 17:35 -------- d-----w c:\documents and settings\HP_Owner\Application Data\Xfire 2009-04-10 03:47 . 2007-05-10 21:33 -------- d-----w c:\documents and settings\HP_Owner\Application Data\Audacity 2009-04-04 15:52 . 2006-09-26 04:14 -------- d-----w c:\program files\SecondLife 2009-03-30 20:36 . 2006-01-10 19:04 -------- d-----w c:\program files\McAfee 2009-03-29 19:40 . 2009-03-29 19:40 -------- d-----w c:\program files\SiteAdvisor 2009-03-29 19:27 . 2007-07-13 22:38 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-03-29 19:27 . 2007-07-13 22:38 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-03-23 00:15 . 2009-02-26 00:27 -------- d-----w c:\program files\World of Warcraft Public Test 2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w c:\windows\system32\dllcache\kernel32.dll 2009-03-09 01:30 . 2005-05-26 16:51 -------- d-----w c:\program files\Google 2009-03-06 14:22 . 2004-08-04 04:00 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2004-08-04 04:00 826368 ----a-w c:\windows\system32\wininet.dll 2009-03-03 00:18 . 2004-08-04 04:00 826368 ----a-w c:\windows\system32\dllcache\wininet.dll 2009-03-01 22:18 . 2008-02-28 22:25 -------- d-----w c:\program files\AIMTunes 2009-03-01 04:40 . 2009-03-01 04:40 -------- d-----w c:\program files\Microsoft Silverlight 2009-03-01 01:39 . 2005-05-26 16:34 -------- d--h--w c:\program files\InstallShield Installation Information 2009-02-28 17:07 . 2009-02-28 17:07 -------- d-----w c:\program files\ACSPMonitor 2009-02-28 04:54 . 2004-08-04 04:00 636072 ----a-w c:\windows\system32\dllcache\iexplore.exe 2009-02-26 00:48 . 2006-12-25 00:16 -------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-02-21 03:58 . 2008-03-04 04:16 232 ---ha-w C:\sqmdata13.sqm 2009-02-21 03:58 . 2008-03-04 04:16 244 ---ha-w C:\sqmnoopt13.sqm 2009-02-21 02:38 . 2008-03-03 04:29 244 ---ha-w C:\sqmnoopt12.sqm 2009-02-21 02:38 . 2008-03-03 04:29 232 ---ha-w C:\sqmdata12.sqm 2009-02-20 10:20 . 2007-05-10 21:00 13824 ------w c:\windows\system32\dllcache\ieudinit.exe 2009-02-20 10:20 . 2004-08-04 04:00 70656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe 2009-02-20 05:14 . 2004-08-04 04:00 161792 ----a-w c:\windows\system32\dllcache\ieakui.dll 2009-02-09 12:10 . 2004-08-04 04:00 729088 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 12:10 . 2004-08-04 11:00 714752 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 12:10 . 2004-08-04 04:00 617472 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 12:10 . 2004-08-04 04:00 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 11:13 . 2008-10-16 04:02 1846784 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 11:13 . 2004-08-04 04:00 1846784 ----a-w c:\windows\system32\win32k.sys 2009-02-08 00:02 . 2008-10-16 04:02 2066048 ------w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-06 11:11 . 2004-08-04 04:00 110592 ----a-w c:\windows\system32\services.exe 2009-02-06 11:08 . 2008-10-16 04:02 2189056 ------w c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 11:06 . 2008-10-16 04:02 2145280 ------w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 11:06 . 2004-08-04 04:00 2145280 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-06 10:39 . 2004-08-04 04:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 10:39 . 2004-08-04 04:00 35328 ----a-w c:\windows\system32\dllcache\sc.exe 2009-02-06 10:32 . 2008-10-16 04:02 2023936 ------w c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-06 10:32 . 2004-08-04 11:00 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w c:\windows\system32\dllcache\secur32.dll 2009-02-03 19:59 . 2004-08-04 04:00 56832 ----a-w c:\windows\system32\secur32.dll 2009-01-31 03:20 . 2009-01-31 03:21 410984 ----a-w c:\windows\system32\deploytk.dll 2009-01-08 02:59 . 2006-01-11 22:29 67936 ----a-w c:\documents and settings\HP_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2008-09-13 02:56 . 2008-09-13 02:56 127864 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2008-07-09 23:11 . 2008-07-09 23:11 0 ----a-w c:\documents and settings\HP_Owner\jagex_runescape_preferences.dat 2007-10-15 21:47 . 2006-11-08 19:34 1756 ----a-w c:\documents and settings\HP_Owner\Application Data\wklnhst.dat 2006-04-29 21:31 . 2006-04-29 21:31 389120 ----a-w c:\documents and settings\HP_Owner\remote.exe 2006-01-25 00:26 . 2006-01-25 00:26 131 ----a-w c:\documents and settings\HP_Owner\Local Settings\Application Data\fusioncache.dat 2009-01-10 06:01 . 2009-01-10 06:01 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008122920090105\index.dat 2009-01-10 22:01 . 2009-01-10 06:01 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009011020090111\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-08-06 21:20 279944 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-06 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-06 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-22 68856] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-01-23 126976] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-25 245760] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-05-26 180269] "Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-05 114688] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-31 136600] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-01-23 155648] "IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520] "MWLExe"="c:\program files\Mcafee\MWL\MWLGui.exe" [2007-07-28 1279336] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328] "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-01-09 1176808] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2009-01-09 5134864] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-01-10 1797880] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2005-01-07 61952] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208] "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2008-08-19 77824] "AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2008-06-19 2808832] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-05-30 5419008] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Belkin Wireless USB Utility.lnk - c:\program files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [2005-10-28 1404928] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Updates from HP\\309731\\Program\\Updates from HP.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"= "c:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"= "c:\\Program Files\\MSN Gaming Zone\\zclient.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Program Files\\NetMeeting\\conf.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\StubInstaller.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\GameSpy Arcade\\Aphex.exe"= [HKLM\~\Services\\_common\\RWVoice.exe"=] "c:\\WINDOWS\\system32\\dxdiag.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\Common Files\\AOL\\1163374914\\ee\\aolsoftware.exe"= "c:\\Program Files\\Common Files\\AOL\\1163374914\\ee\\aim6.exe"= "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"= "c:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"= "c:\\Program Files\\McAfee\\MWL\\MwlSvc.exe"= "c:\\Program Files\\World of Warcraft\\Launcher.exe"= "c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3y.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"= "c:\\Program Files\\ACSPMonitor\\ASMonitor.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "2300:TCP"= 2300:TCP:AoEIII2 "2310:TCP"= 2310:TCP:AoEIII3 R0 aylnlfdx;aylnlfdx; [x] R0 kozuvlew;kozuvlew; [x] R3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;c:\windows\system32\DRIVERS\rt2500usb.sys [2004-07-16 140416] R3 iatmunin;iatmunin; [x] R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-01-10 101776] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-01-10 31504] S2 Belkin 54g Wireless USB Network Adapter Service;Belkin 54g Wireless USB Network Adapter;c:\program files\Belkin\Belkin Wireless Network Utility\WLService.exe [2004-03-29 49152] S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [2005-03-10 18944] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216] S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652] S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2005-03-10 33792] . Contents of the 'Scheduled Tasks' folder 2009-04-22 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57] 2009-04-15 c:\windows\Tasks\McDefragTask.job - c:\windows\system32\defrag.exe [2004-08-04 00:12] 2009-03-01 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-01-12 15:53] . - - - - ORPHANS REMOVED - - - - BHO-{F74A555F-5C86-46F0-9DF1-2512996E898E} - (no file) HKCU-Run-Aim6 - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add To HP Organize... - c:\progra~1\HEWLET~1\HPORGA~1\bin/module.main/favorites\ie_add_to.html IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 TCP: {34C0A864-20DC-4882-BCB1-2368B595FC09} = 192.168.0.100,192.168.0.1 FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\7gya1e6g.default\ FF - prefs.js: browser.startup.homepage - hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-22 17:10 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\system32\drivers\ituugkxb.sys 25088 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-4269192602-1158202227-2009760326-1009\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(1004) c:\windows\system32\nview.dll c:\program files\McAfee\SiteAdvisor\saHook.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\COMODO\COMODO Internet Security\cmdagent.exe c:\program files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\Common Files\McAfee\MNA\McNASvc.exe c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\McAfee\MSK\msksrver.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\progra~1\McAfee\MSC\mcoemmgr.exe c:\progra~1\McAfee.com\Agent\mcagent.exe c:\program files\Common Files\AOL\1163374914\ee\aolsoftware.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\program files\McAfee\MPF\MpfSrv.exe c:\program files\Java\jre6\bin\jucheck.exe . ************************************************************************** . Completion time: 2009-04-22 17:17 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-22 22:16 Pre-Run: 60,330,348,544 bytes free Post-Run: 60,411,535,360 bytes free 315 --- E O F --- 2009-04-16 04:30 |
|
|
|
|
04-22-2009, 11:12 PM
|
#5 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
Hi,
Did you intentionally install Actual Spy 3.0 keylogger? Did you completely uninstall comodo? There are still remnants lying around .. *I see you have P2P software ( LimeWire 4.18.8) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. Please see this topic for more information: http://www.techsupportforum.com/secu...e-sharing.html I would strongly recommend that you uninstall this. You can do so via Control Panel >> Add or Remove Programs. Also, I recommend that you uninstall Ask Toolbar --> http://www.benedelman.org/spyware/ask-toolbars/ Cheat Engine 5.3 --> Cheat engine works by injecting codes into your system processes which could be very dangerous Registry Mechanic 8.0 --> We do not recommend the use of registry cleaners. Our colleague miekiemoes has an excellent writeup here. Another excellent article by Bill Castner is located here. Viewpoint Media Player --> Viewpoint related software are considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 *Open notepad. Copy and paste the text inside the code box below to notepad Code:
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/368815-malware-spyware-virus-etc-problem.html
Driver::
aylnlfdx
kozuvlew
iatmunin
zlbscijh
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
Collect::
c:\windows\system32\drivers\ituugkxb.sys
Firefox::
FF - HiddenExtension: XUL Cache: {9374B670-86D5-4C81-A12B-3CA6DC69E142} - c:\windows\system32\config\systemprofile\local settings\application data\{9374b670-86d5-4c81-a12b-3ca6dc69e142}\
DDS::
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789}
SEH: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - No File
uRun: [Aim6]
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - No File
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you. Post that log in your next reply. **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
*Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities. Updating Java:
*Next, it's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
On your next reply, please include a
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 04-22-2009 at 11:13 PM. |
|
|
|
|
04-26-2009, 08:09 PM
|
#6 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
Ok sorry it took so long but I've been busy. Plus the above took quite a while to do especially the kapersky scan...whew.
I'm going to attach the files to this reply. And yes, I intentionally have Actual Spy on my computer as a keylogger. |
|
|
|
|
04-27-2009, 11:37 PM
|
#7 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
*Open notepad.
Copy and paste the text inside the code box below to notepad Code:
File:: c:\windows\system32\drivers\ituugkxb.sys Folder:: c:\program files\Viewpoint c:\documents and settings\HP_Owner\Application Data\Viewpoint
Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you. Post that log in your next reply. also, let me know how's it running.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-28-2009, 03:05 PM
|
#8 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
Ok, I did the scan and I will attach the log. It's still just as slow as before, doesn't feel any different. I'm no expert, but if I could add a little to my original post and/or provide an opinion of what I think MAY be wrong....I think that there is something wrong with my explorer.exe file as well. Because that's the desktop/flashing screen problem I had, and right clicking on desktop take longer to open than it normally did in the past. I could be wrong though, but if there's a way to find out if it's the explorer.exe file that's causing the problem, I think we should try to find out. But beyond that, I'm uploading the combofix log and continuing what we have been doing. Thanks very much up to this point.
|
|
|
|
|
04-29-2009, 12:22 PM
|
#9 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
Can you provide me a detailed description on what you mean by "slow." Is it the same before where you get bluscreens? It would really help if you could show me some screenshots of the problem.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-29-2009, 02:41 PM
|
#10 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
Ok. I had taken a picture of the blue screen in the past, and there's what it always gives me. It happens extremely randomly. When it first started happening after my desktop stopped flashing on and off, it would happen every 1-3 days. Now it's even more random and can happen twice in one day, or take a really long time for it to happen again (ex. 3+ days).
Usually after I restart/turn off and turn back on my computer, it will take maybe 15-30 min. or more, but then eventually give an error noise like when something pops up, but nothing pops up - it just makes the noise. The blue screen is still random though. And what I mean by "slow" is that everything takes longer to load up, I can get random 1 second freezes...if you know what I mean, etc. Right clicking on my desktop to refresh the screen, or view properties etc. takes 10 times longer than it used to. I don't know if it would help at all or not, but back in late december or early january, I got a new graphics card and new 1Gig RAM. Once I put both in and installed and stuff, my computer was really fast, a lot more than before even. But even now with whatever is wrong, its slower than before that. And I wouldn't blame it on the RAM or graphics card because this problem started happening a good month or so after I had those. Plus I have already tried taking out the RAM sticks one at a time and testing, and still same problem so it isn't the RAM as far as I can tell. Is that descriptive enough lol. Don't really know what else to say about it... maybe that pic I took will help out some? |
|
|
|
|
04-29-2009, 03:10 PM
|
#11 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
Go in here: C:\Windows\Minidump
There should be some .dmp files. The format of the name is MiniMM/DD/YY. Zip and attach the latest 5 dumps please. If you have less than that, attach what you have.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-29-2009, 04:20 PM
|
#13 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
A single one from 07 won't be much of a help.
Is the BSOD always that same one? How many RAM sticks do you have there?
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-29-2009, 04:46 PM
|
#15 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
Let's test your memory (I understand that you've tried swapping them already)
http://icrontic.com/articles/diagnose_with_memtest86 Let me know the results or problems if there are any.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-29-2009, 05:07 PM
|
#16 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
I'm looking at the instructions and everything from that link, but I'm extremely confused as to what I need to be doing. I have a black disc I can use, bu the only problem is on Step 1, I don't understand which ones I need to download, or where to put them/what to do with them...
|
|
|
|
|
04-30-2009, 12:16 AM
|
#17 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
What you need to do is download this ISO image: http://www.memtest.org/download/2.11...+-2.11.iso.zip
Make sure you burn it as a ISO Disk Image, do not simply burn it as data inside the CD. After that, stick it in then reboot your computer. If it doesn't load the CD automatically, reboot again and try pressing F12 to boot using your CD. If that works, just proceed to Step 3 of the article.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-30-2009, 03:36 PM
|
#18 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
OK, I have the right file and everything but I think I already wasted a CD burning to it. I'm using Nero 9, and it gives me options between Data, Audio, and Video Cds/Dvds to burn. I figured this is considered data, and burned it. But it isnt loading anything up when I boot or anything. Is there a way I can do this with Nero or a different easier to use burning program? Because this isn't really working.
|
|
|
|
|
04-30-2009, 03:44 PM
|
#19 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,581
OS: Vista
|
Re: Is this a malware/spyware/virus etc. problem?
I don't use Nero myself but there are screenshots in the article on how to burn the ISO using Nero.
If you are still having troubles, you can download ISO recorder: http://isorecorder.alexfeinman.com/v2.htm Instructions on how to use here: http://isorecorder.alexfeinman.com/HowTo.htm
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
04-30-2009, 04:47 PM
|
#20 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 17
OS: xp
|
Re: Is this a malware/spyware/virus etc. problem?
Ok, sorry for all the questions, but I tried a different option and burned it and got it to work after selecting what to boot with on start up. It took about 40 minutes to test and there was 1 Pass and 0 Errors. So, that means I'm not having memory problems, right?
|
|
|
|
|
| Thread Tools | |
|
|
