Error message [Moved from XP]

heckernana · 01-20-2008, 06:58 PM

When starting my computer, I get an error message which includes ....."C:\WINDOWS\system32\mljjj.exe". It appears twice and after I click okay, it does not return until next start.

**speedster123** · 01-20-2008, 07:11 PM

welcome
please follow the link in my sig for infections.

heckernana · 01-21-2008, 07:02 PM

I have attempted to follow the instructions provided by speedster123. This is the first time I have ever posted to a forum and apologize for my lack of knowledge in the protocol. I was unable to complete the online scan using Panda ActiveScan even though I disabled the Avast AntiVirus. I was successful in the other steps. Below is the Deckard Scan results.

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon(tm) 64 Processor 3800+
Percentage of Memory in Use: 51%
Physical Memory (total/avail): 958.48 MiB / 461.7 MiB
Pagefile Memory (total/avail): 2312.76 MiB / 1565.69 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1911.12 MiB

C: is Fixed (NTFS) - 174.52 GiB total, 142.21 GiB free.
D: is Fixed (FAT32) - 11.76 GiB total, 4.65 GiB free.
E: is CDROM (No Media)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Removable (No Media)

\\.\PHYSICALDRIVE0 - Maxtor 6L200M0 - 186.31 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 174.52 GiB - C:
\PARTITION1 - Unknown - 11.78 GiB - D:

\\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device

\\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device

\\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device

\\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device

-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.
FirewallDisableNotify is set.

FW: Bitdefender Firewall v8.0 (BitDefender)
AV: Bitdefender Antivirus v8.0 (BitDefender)
AV: avast! antivirus 4.7.1098 [VPS 080120-1] v4.7.1098 (ALWIL Software)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"="C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe:*:Enabled:Updates from HP"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\DISC\\DISCover.exe"="C:\\Program Files\\DISC\\DISCover.exe:*:Enabled:DISCover Drop & Play System"
"C:\\Program Files\\DISC\\DiscStreamHub.exe"="C:\\Program Files\\DISC\\DiscStreamHub.exe:*:Enabled:DISCover Stream Hub"
"C:\\Program Files\\DISC\\myFTP.exe"="C:\\Program Files\\DISC\\myFTP.exe:*:Enabled:DISCover FTP"
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"="C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe:*:Enabled:Updates from HP"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"="C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe:*:Disabled:Earthlink"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Netscape\\Navigator 9\\navigator.exe"="C:\\Program Files\\Netscape\\Navigator 9\\navigator.exe:*:Enabled:Navigator"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\system32\\jmovqwmc.exe"="C:\\WINDOWS\\system32\\jmo"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\HP_Administrator\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=YOUR-4DACD0EA75
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\HP_Administrator
LOGONSERVER=\\YOUR-4DACD0EA75
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\Python22;C:\Program Files\QuickTime\QTSystem\;;C:\PROGRA~1\COMMON~1\MUVEET~1\030625;C:\PROGRA~1\COMMON~1\MUVEET~1\030625
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f02
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip
SESSIONNAME=Console
SonicCentral=c:\Program Files\Common Files\Sonic Shared\Sonic Central\
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
USERDOMAIN=YOUR-4DACD0EA75
USERNAME=HP_Administrator
USERPROFILE=C:\Documents and Settings\HP_Administrator
windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

HP_Administrator (admin)
Administrator (admin)

-- Add/Remove Programs ---------------------------------------------------------

-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {F80239D8-7811-4D5E-B033-0D0BBFE32920}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 9 --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81100000003}
Agere Systems PCI-SV92PP Soft Modem --> agrsmdel
AiO_Scan -->
AiO_Scan_CDA -->
AiOSoftware -->
AiOSoftwareNPI -->
AOL Security Toolbar --> regsvr32 /u /s "C:\Program Files\AOL Security Toolbar\tbu354\AOL_security_toolbar.dll"
Apple Software Update --> MsiExec.exe /I{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D}
avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
BitDefender Total Security 2008 --> MsiExec.exe /I{C33A19F0-A3D8-45B4-B067-251D2DBABB1A}
BufferChm -->
CameraDrivers -->
CameraDrivers -->
CP_AtenaShokunin1Config -->
CP_CalendarTemplates1 -->
cp_LightScribeConfig -->
cp_OnlineProjectsConfig -->
CP_Package_Basic1 -->
CP_Package_Variety1 -->
CP_Package_Variety2 -->
CP_Package_Variety3 -->
CP_Panorama1Config -->
cp_PosterPrintConfig -->
cp_UpdateProjectsConfig -->
CueTour -->
Customer Experience Enhancement -->
Customer Experience Enhancement --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{23012310-3E05-46A5-88A9-C6CBCABCAC79} /l1033
CustomerResearchQFolder -->
Destinations -->
DeviceFunctionQFolder -->
DeviceManagementQFolder -->
DISCover --> "C:\Program Files\DISC\uninstall.exe"
DocProc -->
DocumentViewer -->
DocumentViewerQFolder -->
Easy Internet Sign-up -->
Easy Internet Sign-up --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1033
Enhanced Multimedia Keyboard Solution --> C:\HP\KBD\Install.exe /u
Family Feud --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\413773DA-62DE-4C4C-A0F9-10EFB9317DE5\Uninstall.exe"
FATE from HP Media Center (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\3320769C-062B-4670-BD6B-AA4B3D0E9903\Uninstall.exe"
Fax -->
Fax_CDA -->
FullDPAppQFolder -->
GemMaster Mystic --> "C:\Program Files\GemMaster\uninstallgemmaster.exe"
Google Desktop --> C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
Highlight Viewer (Windows Live Toolbar) --> MsiExec.exe /X{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Boot Optimizer --> C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe /uninstall
HP Deskjet 5400 series --> C:\Program Files\HP\Digital Imaging\{EB57A16E-500D-43d7-85B9-FBE279EBBA6E}\setup\hpzscr01.exe -datfile hpfscr05.dat
HP Deskjet Printer Preload --> MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
HP DigitalMedia Archive --> MsiExec.exe /X{F80239D8-7811-4D5E-B033-0D0BBFE32920}
HP Document Viewer 5.3 --> C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP DVD Play 1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
HP Extended Capabilities 5.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Game Console and games --> C:\Program Files\WildTangent\Apps\hpuninstall.exe
HP Imaging Device Functions 6.0 --> C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart 330,380,420,470,7800,8000,8200 Series --> C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
HP Photosmart Cameras 5.0 --> C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP Photosmart for Media Center PC --> c:\Program Files\HP\Digital Imaging\bin\mcpc\setupmcl.exe /u
HP Photosmart Premier Software 6.0 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 5.3.A --> "C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
HP PSC & OfficeJet 5.3.B --> "C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Solution Center & Imaging Support Tools 5.3 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update --> MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HP Web Helper --> regsvr32 /u /s "C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\webhelper.dll"
HPDeskjet5400Series -->
HPProductAssistant -->
HpSdpAppCoreApp -->
InstantShareDevices -->
iTunes --> MsiExec.exe /I{446DBFFA-4088-48E3-8932-74316BA4CAE4}
J2SE Runtime Environment 5.0 Update 10 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150050}
LightScribe 1.4.62.1 -->
LiveUpdate 3.2 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Macromedia Flash Player 8 --> MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Map Button (Windows Live Toolbar) --> MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA}
MarketResearch -->
Microsoft Away Mode -->
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Money 2006 --> "C:\Program Files\Microsoft Money 2006\MNYCoreFiles\Setup\uninst.exe" /s:120
Microsoft Office 2003 Edition 60 Days Trial Welcome Tour --> MsiExec.exe /I{A01FC76F-CC09-4658-9E37-5C2F635EE708}
Microsoft Office PowerPoint Viewer 2003 --> MsiExec.exe /X{90AF0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Standard Edition 2003 --> MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Works --> MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}
MSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
muvee autoProducer 4.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E073D315-3C54-44BF-A1B2-B5583AEA618C}\setup.exe" -l0x9
muvee autoProducer unPlugged 1.2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35DD9A1D-B340-4F41-A8B0-6EEBFB119280}\setup.exe" -l0x9
Netscape Navigator (9.0.0.5) --> C:\PROGRA~1\NETSCAPE\Navigator 9\uninstall\helper.exe
Network Play System (Patching) --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Electronic Arts\Network Play System\NPSPatch.isu"
NewCopy -->
NewCopy_CDA -->
NVIDIA Drivers --> C:\WINDOWS\system32\nvunrm.exe UninstallGUI
OptionalContentQFolder -->
Otto --> "C:\Program Files\EnglishOtto\uninstallotto.exe"
PanoStandAlone -->
PC-Doctor 5 for Windows --> C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
PhotoGallery -->
PopsMedia Site Adviser --> C:\Program Files\PopsMedia Site Adviser\vm5_killer.exe
PS2 --> C:\WINDOWS\system32\ps2.exe uninstall
PSPrinters08 -->
PSTAPlugin -->
Python 2.2 pywin32 extensions (build 203) --> "C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
Python 2.2.3 --> C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
Quicken 2006 --> MsiExec.exe /X{2818095F-FB6C-42C8-827E-0A406CC9AFF5}
QuickTime --> MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1961C7767A}
RandMap -->
Readme -->
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver --> RtlUpd.exe -r -m
Remove IntelliMover Demo --> c:\hp\bin\cloaker.exe c:\hp\bin\commands.exe /c "C:\Program Files\IntelliMoverDemo\clean.bat"
Router --> C:\Program Files\Router\UnInstall.exe
Scan -->
ScannerCopy -->
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
SkinsHP1 -->
Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D}
SolutionCenter -->
Sonic Express Labeler --> MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus --> MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio --> MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic RecordNow Copy --> MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic RecordNow Data --> MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Update Manager --> MsiExec.exe /X{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Sonic_PrimoSDK -->
Spyware Doctor 5.1 --> C:\Program Files\Spyware Doctor\unins000.exe /LOG
SpywareBlaster v3.5.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
Status -->
TrayApp -->
Unload -->
Update Rollup 2 for Windows XP Media Center Edition 2005 -->
Updates from HP (remove only) --> C:\WINDOWS\HPCPCUninstall-9972322\HPBWSetup.exe -appid 9972322 -uninstall
WebFldrs XP -->
WebReg -->
WildTangent Web Driver --> C:\Program Files\WildTangent\Apps\CDA\CDAUninstall.exe
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Favorites for Windows Live Toolbar --> MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Mail --> MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Photo Gallery --> MsiExec.exe /X{257E440F-781F-459B-9A68-A0872B80C1D6}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar --> MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar Extension (Windows Live Toolbar) --> MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D}
Windows Live Writer --> MsiExec.exe /X{9176251A-4CC1-4DDB-B343-B487195EB397}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB925766 --> "C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
Yahoo! Toolbar -->
Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe

-- Application Event Log -------------------------------------------------------

Event Record #/Type11192 / Error
Event Submitted/Written: 01/20/2008 06:48:43 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application navigator.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type11179 / Error
Event Submitted/Written: 01/20/2008 05:16:54 PM
Event ID/Source: 1001 / Application Hang
Event Description:
Fault bucket 07616520.

Event Record #/Type11178 / Error
Event Submitted/Written: 01/20/2008 05:16:05 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application navigator.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type11174 / Error
Event Submitted/Written: 01/20/2008 04:45:23 PM
Event ID/Source: 101 / Automatic LiveUpdate Scheduler
Event Description:
Information Level: error

Initialization of the COM subsystem failed. Error code: 0x8007041D

Event Record #/Type11170 / Error
Event Submitted/Written: 01/20/2008 00:51:45 PM
Event ID/Source: 101 / Automatic LiveUpdate Scheduler
Event Description:
Information Level: error

Initialization of the COM subsystem failed. Error code: 0x8007041D

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type66989 / Error
Event Submitted/Written: 01/20/2008 05:24:27 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
The following boot-start or system-start driver(s) failed to load:
ftsata2

Event Record #/Type66983 / Warning
Event Submitted/Written: 01/20/2008 04:58:23 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type66979 / Error
Event Submitted/Written: 01/20/2008 04:45:43 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The LiveUpdate service failed to start due to the following error:
%%1053

Event Record #/Type66978 / Error
Event Submitted/Written: 01/20/2008 04:45:42 PM
Event ID/Source: 7009 / Service Control Manager
Event Description:
Timeout (30000 milliseconds) waiting for the LiveUpdate service to connect.

Event Record #/Type66977 / Error
Event Submitted/Written: 01/20/2008 04:45:22 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1053" attempting to start the service LiveUpdate with arguments ""
in order to run the server:
{03E0E6C2-363B-11D3-B536-00902771A435}

-- End of Deckard's System Scanner: finished at 2008-01-20 22:28:10 ------------

tetonbob · 01-22-2008, 11:37 AM

Hello -

Deckard's System Scanner should have also produced another log, main.txt

If it's been closed, it's located at C:\Deckard\System Scanner\main.txt

Please locate and post it.

heckernana · 01-22-2008, 04:25 PM

Thank you.

Deckard's System Scanner v20071014.68
Run by HP_Administrator on 2008-01-20 21:22:37
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
58: 2008-01-21 03:22:43 UTC - RP534 - Deckard's System Scanner Restore Point
57: 2008-01-21 00:33:00 UTC - RP533 - Spyware Doctor: Cleaning Threats
56: 2008-01-20 02:53:54 UTC - RP532 - System Checkpoint
55: 2008-01-19 02:35:07 UTC - RP531 - System Checkpoint
54: 2008-01-18 02:27:44 UTC - RP530 - System Checkpoint

-- First Restore Point --
1: 2007-12-29 21:12:12 UTC - RP477 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-01-20 22:27:24
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\6HJZJBSD\dss[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/1me10enus/2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by CenturyTel
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/1me10enus/2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/1me10enus/2
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by CenturyTel
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F0 - win.ini: load=C:\WINDOWS\system32\mljjj.exe
F3 - REG:win.ini: Load=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2E7F256F-0217-4924-B535-5530D2342791} - (no file)
O2 - BHO: {e7b2a9a9-0d80-9348-b084-f30833740cc3} - {3cc04733-803f-480b-8439-08d09a9a2b7e} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9689D867-13DE-1E5D-DC2E-4FE679F3589A} - (no file)
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {CD61E5EE-6447-41C9-BD85-84B4ED476CB4} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Dora Fairytale Adventures Registration.lnk = E:\ATR1.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.emdat.com (HKLM)
O15 - Trusted Zone: *.mytranscriptions.com (HKLM)
O15 - Trusted Zone: http://trymedia.com (HKLM)
O15 - Trusted Zone: https://trymedia.com (HKLM)
O15 - Trusted Zone: https://emdat.com (HKCU)
O15 - Trusted Zone: https://mytranscriptions.com (HKCU)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase2895.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1178592258437
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players...stallAsst2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/A...oadcontrol.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 14197 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 sdcplh - c:\windows\system32\drivers\sdcplh.sys <Not Verified; ; SDCPLH>
R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path Manager® (32-bit)>
R3 BDSelfPr - c:\program files\bitdefender\bitdefender 2008\bdselfpr.sys <Not Verified; BitDefender S.R.L.; BitDefender>

S0 ftsata2 - c:\windows\system32\drivers\ftsata2.sys (file missing)
S3 3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df - e:\cds300\cds300.dll (file missing)
S3 BOCDRIVE (BOClean Kernel Monitor.) - c:\program files\comodo\cboclean\bocdrive.sys (file missing)
S3 PCD5SRVC{085326CB-51A3560A-05010003} (PCD5SRVC{085326CB-51A3560A-05010003} - PCDR Kernel Mode Service Helper Driver) - c:\program files\pc-doctor 5 for windows\pcd5srvc.pkms <Not Verified; PC-Doctor, Inc.; PC-Doctor for Windows>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S3 GoogleDesktopManager-093007-112848 (Google Desktop Manager 5.5.709.30344) - "c:\program files\google\google desktop search\googledesktop.exe" (file missing)

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-01-20 22:02:00 276 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
2008-01-20 18:24:22 354 --a------ C:\WINDOWS\Tasks\Disk Cleanup.job

-- Files created between 2007-12-20 and 2008-01-20 -----------------------------

2008-01-20 21:14:48 0 d-------- C:\ie-spyad_zo
2008-01-20 20:46:53 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-01-20 20:46:51 0 d-------- C:\WINDOWS\LastGood
2008-01-19 18:05:38 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft
2008-01-13 17:16:04 0 d-------- C:\WINDOWS\Cache
2008-01-12 16:15:54 0 d-------- C:\Documents and Settings\LocalService\Start Menu
2008-01-11 20:43:28 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-01-09 20:25:15 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\BitDefender
2008-01-09 20:23:54 0 d-------- C:\Program Files\BitDefender
2008-01-09 20:23:54 0 d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-01-09 20:12:50 0 d-------- C:\Program Files\Common Files\BitDefender
2008-01-03 14:22:48 717165 --ahs---- C:\WINDOWS\system32\jjjlm.ini2
2008-01-01 19:28:14 235008 --a------ C:\WINDOWS\UNBOC.EXE <Not Verified; COMODO; COMODO BOClean - Anti-Malware>
2008-01-01 19:28:13 208896 --a------ C:\WINDOWS\CMDLIC.DLL <Not Verified; COMODO; COMODO BOClean - AntiMalware>
2008-01-01 18:32:45 0 d-------- C:\Program Files\Common Files\xing shared
2008-01-01 10:16:01 0 d-------- C:\Documents and Settings\Default User\Application Data\Apple Computer
2007-12-31 20

42 0 d-------- C:\Program Files\Alwil Software
2007-12-30 21:38:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-12-30 21:37:41 0 d-------- C:\Program Files\Common Files\Adobe
2007-12-30 21:26:38 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-30 21:26:09 0 d-------- C:\Program Files\Spyware Doctor
2007-12-30 21:26:09 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\PC Tools
2007-12-30 21:20:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Mozilla
2007-12-30 21:16:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2007-12-30 20:11:43 0 d-------- C:\Documents and Settings\HP_Administrator\.housecall6.6
2007-12-30 19:33:44 0 d-------- C:\Program Files\Common Files\F?nts
2007-12-30 19:33:31 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?ssembly
2007-12-30 19:33:22 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\??mantec
2007-12-30 17:41:31 0 d-------- C:\Program Files\Enigma Software Group
2007-12-30 16:50:56 1283174 --a------ C:\Install
2007-12-30 16:11:22 0 d-------- C:\Program Files\Words
2007-12-30 15:35:53 0 d-------- C:\Program Files\Router
2007-12-30 15:20:58 0 d-------- C:\WINDOWS\??mbols
2007-12-30 15:20:46 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\a?sembly
2007-12-30 13:33:50 69632 --a------ C:\WINDOWS\b143.exe
2007-12-29 15:12:01 719058 --ahs---- C:\WINDOWS\system32\yyadd.ini2
2007-12-29 15

41 0 d-------- C:\Program Files\Common Files\??crosoft.NET
2007-12-29 15

33 0 d-------- C:\WINDOWS\?dobe
2007-12-22 21:11:33 0 d--h----- C:\WINDOWS\msdownld.tmp

-- Find3M Report ---------------------------------------------------------------

2008-01-20 21:04:46 0 d-------- C:\Program Files\SpywareBlaster
2008-01-20 20:37:43 0 d-------- C:\Program Files\Viewpoint
2008-01-19 17:40:20 0 d-------- C:\Program Files\Coupons
2008-01-15 16:58:46 10656 --a------ C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
2008-01-11 20:44:45 0 d-------- C:\Program Files\Best Buy Rhapsody
2008-01-11 20:19:42 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\HP
2008-01-09 20:22:58 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-01-09 20:22:14 0 d-------- C:\Program Files\Symantec
2008-01-09 20:22:10 0 d-------- C:\Program Files\Common Files
2008-01-04 11:05:56 0 d-------- C:\Program Files\iTunes
2008-01-01 19:28:00 0 d-------- C:\Program Files\Comodo
2008-01-01 19:20:23 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla
2008-01-01 18:31:47 0 d-------- C:\Program Files\Common Files\Real
2008-01-01 16:55:40 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Google
2008-01-01 09:53:05 0 d-------- C:\Program Files\PC-Doctor 5 for Windows
2008-01-01 09:53:02 0 d-------- C:\Program Files\QuickTime
2007-12-31 20:23:55 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?ssembly
2007-12-30 22:00:33 0 d-------- C:\Program Files\Common Files\F?nts
2007-12-30 21:23:31 0 d-------- C:\Program Files\Google
2007-12-30 19:35:39 0 d-------- C:\Program Files\SpywareBot
2007-12-30 19:35:08 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\??mantec
2007-12-30 19:35:08 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\a?sembly
2007-12-29 19:07:32 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-12-29 19:04:06 0 d-------- C:\Program Files\AIM
2007-12-29 19:03:57 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Aim
2007-12-29 19:01:44 0 d-------- C:\Program Files\Common Files\??crosoft.NET
2007-12-29 18:39:59 0 d-------- C:\Program Files\DISC
2007-12-18 22:29:27 0 d-------- C:\Program Files\Common Files\AOL
2007-11-29 16:50:20 38567 --a------ C:\WINDOWS\system32\pcpbios.exe
2007-11-27 16:46:24 77824 --a------ C:\WINDOWS\system32\xcomm.dll <Not Verified; BitDefender; BitDefender Communicator>
2007-10-23 17

08 585728 --a------ C:\WINDOWS\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery>

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E7F256F-0217-4924-B535-5530D2342791}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3cc04733-803f-480b-8439-08d09a9a2b7e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9689D867-13DE-1E5D-DC2E-4FE679F3589A}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD61E5EE-6447-41C9-BD85-84B4ED476CB4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [08/05/2005 02:56 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [01/24/2006 07:15 PM]
"nwiz"="nwiz.exe" [01/24/2006 07:15 PM C:\WINDOWS\system32\nwiz.exe]
"@"="" []
"PCDrProfiler"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" []
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [12/04/2007 07:00 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/30/2006 09:36 AM]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [10/09/2007 03:46 PM]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [11/16/2007 04:37 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [12/30/2007 09:09 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/09/2004 10:00 PM]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [12/30/2007 09:09 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx scan

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb6bd30b-338a-11db-a151-806d6172696f}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

-- End of Deckard's System Scanner: finished at 2008-01-20 22:28:10 ------------

tetonbob · 01-22-2008, 04:32 PM

I see you have more than one Anti-Virus program installed, Avast and Bitdefender. While this may seem like greater protection, it can cause problems including slowdowns and system hangs. Choose one to keep and uninstall the other.

Any antivirus program must be removed via add/remove program.
For any program that doesn't have an add/remove entry, you will have to do this:

re-install the program -> reboot -> uninstall

-----------------------------------------------------------------------

Please visit this webpage for instructions for downloading and running ComboFix. Take your time and read the page completely. If there's anything you don't understand, post back and ask questions first, before proceeding.

http://www.bleepingcomputer.com/comb...o-use-combofix

If, while you're performing those instructions, you need to install the Windows XP Recovery Console using ComboFix, a log will be produced, CF-RC.txt

Post that log before continuing any further, and do NOT reboot your machine until I've reviewed it.

If you have a Windows XP CD with which to install the Windows XP Recovery Console as directed in the Guide, or already have the Windows XP Recovery Console installed, post the log from ComboFix when you've accomplished all that, along with a new HijackThis log.

tetonbob · 01-22-2008, 04:35 PM

Please see edited instructions above.

heckernana · 01-24-2008, 06:03 PM

I am unable to run the ComboFix. After closing down all program and disabling antivirus/spyware, etc. I double click on the icon then click run. A screen then appears stating NIRCMD.com is not a valid Win32 application. After clicking the OK button another screen appears which states Windows cannot open this file: NIRCMD.cfexe To open this file, Windows needs to know what program to run it with. I am unable to remove this screen. Another screen is also open. Instead of: Please wait-ComboFix is preparing to run, it states: Access denied. ComboFix is preparing to run.

Please advise

tetonbob · 01-24-2008, 06:20 PM

Sounds to me like the file is corrupt. Perhaps one of your protection applications harmed it.

What size is ComboFix.exe, and exactly when did you download it?

heckernana · 01-24-2008, 07:24 PM

It was downloaded at 6:00 PM Central Time today. The size is 1.49 MB

tetonbob · 01-24-2008, 07:29 PM

I'm pretty sure BOClean is interfering, or has corrupted the file. It's very aggressive with it's heuristics.

Did you disable BOClean before attempting to first run ComboFix?

Is ComboFix still open? What state is your machine in?

heckernana · 01-24-2008, 07:40 PM

I uninstalled BO Cleaner last week and disabled everything else. ComboFix is not open. Each time I have attempted to run it, I receive the same message - NIRCMD.com is not a valid Win32 application.

The computer is running slow; however, since you advised to remove one of the antivirus programs, it has picked up speed, although still somewhat slow for DSL. At startup, the ....."C:\WINDOWS\system32\mljjj.exe.... message continues to appear.

tetonbob · 01-24-2008, 07:42 PM

Please delete your existing version of ComboFix, download a fresh version, and boot into safe mode to run it.

heckernana · 01-24-2008, 08:34 PM

ComboFix 08-01-23.1C - HP_Administrator 2008-01-24 21:16:40.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.694 [GMT -6:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\HP_Administrator\Application Data\ASEMBL~1
C:\Documents and Settings\HP_Administrator\Application Data\DriveCleaner Free
C:\Documents and Settings\HP_Administrator\Application Data\DriveCleaner Free\Logs\update.log
C:\Documents and Settings\HP_Administrator\Application Data\MANTEC~1
C:\Documents and Settings\HP_Administrator\Application Data\SSEMBL~1
C:\Documents and Settings\HP_Administrator\Application Data\SSEMBL~1\?ssembly\
C:\Documents and Settings\HP_Administrator\err.log
C:\Documents and Settings\HP_Administrator\g2mdlhlpx.exe
C:\Program Files\Common Files\crosof~1.net
C:\Program Files\Common Files\fnts~1
C:\Program Files\racle~1
C:\Program Files\Router
C:\Program Files\sstem3~1
C:\Program Files\ystem3~1
C:\WINDOWS\b143.exe
C:\WINDOWS\dobe~1
C:\WINDOWS\mbols~1
C:\WINDOWS\racle~1
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\jjjlm.ini
C:\WINDOWS\system32\jjjlm.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\yyadd.ini
C:\WINDOWS\system32\yyadd.ini2
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-24 21:15 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-20 21:21 . 2008-01-20 21:21 <DIR> d-------- C:\Deckard
2008-01-20 21:14 . 2008-01-20 21:14 <DIR> d-------- C:\ie-spyad_zo
2008-01-20 20:46 . 2008-01-21 19:37 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-20 20:46 . 2008-01-21 19:45 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-20 20:46 . 2008-01-21 19:45 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-20 20:46 . 2008-01-21 19:45 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-19 18:05 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 17:16 . 2008-01-13 17:16 <DIR> d-------- C:\WINDOWS\Cache
2008-01-11 20:43 . 2008-01-11 20:43 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-01-09 20:41 . 2008-01-24 21:05 121 --a------ C:\WINDOWS\bdagent.INI
2008-01-09 20:23 . 2008-01-09 20:24 <DIR> d-------- C:\Program Files\BitDefender
2008-01-09 20:12 . 2008-01-09 20:24 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-01-05 21:01 . 2008-01-09 20:46 268 --ah----- C:\sqmdata19.sqm
2008-01-05 21:01 . 2008-01-09 20:46 244 --ah----- C:\sqmnoopt19.sqm
2008-01-05 20:55 . 2008-01-09 03:08 268 --ah----- C:\sqmdata18.sqm
2008-01-05 20:55 . 2008-01-09 03:08 244 --ah----- C:\sqmnoopt18.sqm
2008-01-01 19:28 . 2007-08-08 20:02 235,008 --a------ C:\WINDOWS\UNBOC.EXE
2008-01-01 19:28 . 2007-05-08 17:01 208,896 --a------ C:\WINDOWS\CMDLIC.DLL
2008-01-01 19:28 . 2004-08-09 22:00 22,528 --a------ C:\WINDOWS\system32\wsock32.dlb
2008-01-01 18:32 . 2008-01-01 18:32 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-01-01 09:54 . 2008-01-05 21:33 244 --ah----- C:\sqmnoopt17.sqm
2008-01-01 09:54 . 2008-01-05 21:33 232 --ah----- C:\sqmdata17.sqm
2007-12-31 20:19 . 2008-01-05 21:32 244 --ah----- C:\sqmnoopt16.sqm
2007-12-31 20:19 . 2008-01-05 21:32 232 --ah----- C:\sqmdata16.sqm
2007-12-31 20:06 . 2007-12-31 20:06 <DIR> d-------- C:\Program Files\Alwil Software
2007-12-30 22:01 . 2008-01-05 21:32 244 --ah----- C:\sqmnoopt15.sqm
2007-12-30 22:01 . 2008-01-05 21:32 232 --ah----- C:\sqmdata15.sqm
2007-12-30 21:37 . 2007-12-30 21:38 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-30 21:26 . 2008-01-24 00:17 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-12-30 21:26 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-12-30 21:26 . 2007-10-04 17:10 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-12-30 21:26 . 2007-10-04 17:10 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-12-30 21:26 . 2007-10-04 17:10 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-12-30 21:26 . 2007-10-04 17:11 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-12-30 19:33 . 2008-01-24 21:05 268 --ah----- C:\sqmdata14.sqm
2007-12-30 19:33 . 2008-01-24 21:05 244 --ah----- C:\sqmnoopt14.sqm
2007-12-30 19:28 . 2008-01-24 20:45 268 --ah----- C:\sqmdata13.sqm
2007-12-30 19:28 . 2008-01-24 20:45 244 --ah----- C:\sqmnoopt13.sqm
2007-12-30 19:16 . 2008-01-24 17:48 268 --ah----- C:\sqmdata12.sqm
2007-12-30 19:16 . 2008-01-24 17:48 244 --ah----- C:\sqmnoopt12.sqm
2007-12-30 17:58 . 2008-01-23 07:28 268 --ah----- C:\sqmdata11.sqm
2007-12-30 17:58 . 2008-01-23 07:28 244 --ah----- C:\sqmnoopt11.sqm
2007-12-30 17:41 . 2007-12-30 17:41 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-12-30 16:50 . 2007-12-30 16:51 1,283,174 --a------ C:\Install
2007-12-30 16:32 . 2007-12-30 19:36 1,031,499 --ahs---- C:\WINDOWS\system32\oifqonjm.ini
2007-12-30 16:11 . 2008-01-20 17:17 268 --ah----- C:\sqmdata10.sqm
2007-12-30 16:11 . 2008-01-20 17:17 244 --ah----- C:\sqmnoopt10.sqm
2007-12-30 15:17 . 2007-12-30 16:30 1,031,199 --ahs---- C:\WINDOWS\system32\jycraqnr.ini
2007-12-29 18:43 . 2008-01-17 07:01 268 --ah----- C:\sqmdata09.sqm
2007-12-29 18:43 . 2008-01-17 07:01 244 --ah----- C:\sqmnoopt09.sqm
2007-12-29 16:06 . 2008-01-15 20:37 268 --ah----- C:\sqmdata08.sqm
2007-12-29 16:06 . 2008-01-15 20:37 244 --ah----- C:\sqmnoopt08.sqm
2007-12-29 16:03 . 2007-12-30 19:36 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-12-29 15:59 . 2008-01-14 20:40 268 --ah----- C:\sqmdata07.sqm
2007-12-29 15:59 . 2008-01-14 20:40 244 --ah----- C:\sqmnoopt07.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 03:04 --------- d-----w C:\Program Files\SpywareBlaster
2008-01-21 02:37 --------- d-----w C:\Program Files\Viewpoint
2008-01-19 23:40 --------- d-----w C:\Program Files\Coupons
2008-01-12 02:44 --------- d-----w C:\Program Files\Best Buy Rhapsody
2008-01-10 02:22 --------- d-----w C:\Program Files\Symantec
2008-01-10 02:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-04 17:05 --------- d-----w C:\Program Files\iTunes
2008-01-02 01:28 --------- d-----w C:\Program Files\Comodo
2008-01-02 00:31 --------- d-----w C:\Program Files\Common Files\Real
2008-01-01 15:53 --------- d-----w C:\Program Files\QuickTime
2008-01-01 15:53 --------- d-----w C:\Program Files\PC-Doctor 5 for Windows
2007-12-31 03:23 --------- d-----w C:\Program Files\Google
2007-12-31 01:35 --------- d-----w C:\Program Files\SpywareBot
2007-12-30 01:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-30 01:04 --------- d-----w C:\Program Files\AIM
2007-12-30 00:39 --------- d-----w C:\Program Files\DISC
2007-12-19 04:29 --------- d-----w C:\Program Files\Common Files\AOL
2007-11-29 22:50 38,567 ----a-w C:\WINDOWS\system32\pcpbios.exe
2007-11-27 22:46 77,824 ----a-w C:\WINDOWS\system32\xcomm.dll
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:35 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 23:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2005-09-24 07:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
1998-11-17 17:09 24,576 ----a-w C:\WINDOWS\inf\Vizpnpin.exe
1998-10-12 17:23 40,960 ----a-w C:\WINDOWS\inf\vizPnP\Vipersti.dll
1998-07-30 18:44 19,112 ----a-w C:\WINDOWS\inf\vizPnP\Pmxscan.sys
.

Code:

<pre>
----a-w            61,440 2007-12-31 01:45:08  C:\hp\KBD\KBD .EXE
----a-w            81,920 2007-12-29 23:00:02  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w           221,184 2007-12-29 23:05:09  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w           180,269 2007-12-29 22:49:55  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w         1,064,960 2007-12-29 22:13:47  C:\Program Files\DISC\DISCover .exe
----a-w            61,440 2007-12-29 22:13:42  C:\Program Files\DISC\DiscUpdateMgr .exe
----a-w           847,872 2007-12-31 01:03:57  C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3 .exe
----a-w            68,856 2007-12-29 22:14:48  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w           249,856 2007-12-31 03:09:01  C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp  .exe
----a-w           249,856 2007-12-31 03:09:02  C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp .exe
----a-w            49,152 2007-12-31 01:35:43  C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08 .exe
----a-w            49,152 2007-12-31 01:35:50  C:\Program Files\HP\HP Software Update\HPwuSchd2 .exe
----a-w            49,263 2007-12-31 01:35:56  C:\Program Files\Java\jre1.5.0_10\bin\jusched .exe
----a-w           368,640 2007-12-31 01:36:43  C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor .exe
----a-w         2,577,120 2007-12-31 01:22:24  C:\Program Files\PCPitstop\Optimize\PCPOptimize .exe
----a-w           897,752 2007-12-31 01:21:00  C:\Program Files\PCPitstop\Optimize\Reminder .exe
----a-w           282,624 2007-12-31 04:00:23  C:\Program Files\QuickTime\qttask     .exe
----a-w           282,624 2007-12-31 03:09:02  C:\Program Files\QuickTime\qttask    .exe
----a-w           282,624 2007-12-31 03:09:03  C:\Program Files\QuickTime\qttask   .exe
----a-w           282,624 2007-12-31 03:09:03  C:\Program Files\QuickTime\qttask  .exe
----a-w           282,624 2007-12-31 03:09:03  C:\Program Files\QuickTime\qttask .exe
----a-w           227,328 2007-12-31 01:35:51  C:\Program Files\scansoft\paperport\fbdirect .exe
----a-w           160,568 2007-12-30 00:48:25  C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon .exe
----a-w            90,112 2007-12-31 01:35:45  C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler .exe
----a-w         5,111,808 2007-12-31 01:36:05  C:\Program Files\SpywareBot\SpywareBot .exe
----a-w         5,724,184 2007-12-31 04:00:26  C:\Program Files\Windows Live\Messenger\MsnMsgr       .Exe
----a-w         5,724,184 2007-12-31 03:09:05  C:\Program Files\Windows Live\Messenger\MsnMsgr      .Exe
----a-w         5,724,184 2007-12-31 03:09:05  C:\Program Files\Windows Live\Messenger\MsnMsgr     .Exe
----a-w         5,724,184 2007-12-31 03:09:07  C:\Program Files\Windows Live\Messenger\MsnMsgr    .Exe
----a-w         5,724,184 2007-12-31 03:09:11  C:\Program Files\Windows Live\Messenger\MsnMsgr   .Exe
----a-w         5,724,184 2007-12-31 03:09:11  C:\Program Files\Windows Live\Messenger\MsnMsgr  .Exe
----a-w         5,724,184 2007-12-31 03:09:12  C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
----a-w           204,288 2007-12-31 01:36:06  C:\Program Files\Windows Media Player\WMPNSCFG .exe
----a-w            64,512 2007-12-31 01:35:43  C:\WINDOWS\ehome\ehtray .exe
----a-w           237,568 2007-12-31 01:35:48  C:\WINDOWS\SMINST\RECGUARD .EXE
----a-w            15,360 2007-12-31 01:36:00  C:\WINDOWS\system32\ctfmon .exe
</pre>

-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{3BB63FD4-3C00-44D7-94A9-5DE211900DEF}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{381FFDE8-2394-4F90-B10D-FC6124A40F8C}

[HKEY_CLASSES_ROOT\clsid\{381ffde8-2394-4f90-b10d-fc6124a40f8c}]
[HKEY_CLASSES_ROOT\BitDefender Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 22:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-12-30 21:09 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56 64512]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-24 19:15 7311360]
"nwiz"="nwiz.exe" [2006-01-24 19:15 1519616 C:\WINDOWS\system32\nwiz.exe]
"PCDrProfiler"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 15:46 61440]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2007-11-16 16:37 319488]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-30 21:09 282624]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 22:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-12-30 21:16:47 124400]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-08-24 01

07 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

S1 bdftdif;bdftdif;C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys [2007-11-12 16:28]
S1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-09-05 08:39]
S3 3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df;3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df;E:\CDS300\cds300.dll []
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-11-12 16:27]
S3 bdfsfltr;bdfsfltr;C:\WINDOWS\system32\drivers\bdfsfltr.sys [2007-08-02 16:03]
S3 BDSelfPr;BDSelfPr;C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys [2008-01-21 19:55]
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
S3 PCD5SRVC{085326CB-51A3560A-05010003};PCD5SRVC{085326CB-51A3560A-05010003} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [2005-11-21 11:27]
S3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe [2004-08-09 22:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 03:02:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-22 08:53:00 C:\WINDOWS\Tasks\Disk Cleanup.job"
- C:\Documents and Settings\HP_Administrator\My Documents\ppviewer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 21:21:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-24 21:22:01
ComboFix-quarantined-files.txt 2008-01-25 03:21:41
.
2008-01-23 13:33:07 --- E O F ---

tetonbob · 01-24-2008, 09:23 PM

Please go to: VirusTotal

On the page you'll find a "Browse" button.
Next to the browse button you'll see a box to enter text.

Please copy/paste the following:

Code:

  C:\Program Files\PCPitstop\Optimize\Reminder .exe

Then click the "Send File " button just below.
This will scan the file. Please be patient.
Once scanned, copy and paste the results in your next reply.

heckernana · 01-25-2008, 05:32 PM

Antivirus Version Last Update Result
AhnLab-V3 2008.1.26.10 2008.01.25 -
AntiVir 7.6.0.53 2008.01.25 -
Authentium 4.93.8 2008.01.26 -
Avast 4.7.1098.0 2008.01.25 -
AVG 7.5.0.516 2008.01.25 -
BitDefender 7.2 2008.01.26 -
CAT-QuickHeal 9.00 2008.01.25 -
ClamAV 0.91.2 2008.01.25 -
DrWeb 4.44.0.09170 2008.01.25 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5484 2008.01.25 -
Ewido 4.0 2008.01.25 -
FileAdvisor 1 2008.01.26 -
Fortinet 3.14.0.0 2008.01.25 -
F-Prot 4.4.2.54 2008.01.25 -
F-Secure 6.70.13260.0 2008.01.25 -
Ikarus T3.1.1.20 2008.01.25 -
Kaspersky 7.0.0.125 2008.01.25 -
McAfee 5216 2008.01.26 -
Microsoft 1.3109 2008.01.25 -
NOD32v2 2823 2008.01.25 -
Norman 5.80.02 2008.01.24 -
Panda 9.0.0.4 2008.01.25 -
Prevx1 V2 2008.01.26 -
Rising 20.28.41.00 2008.01.25 -
Sophos 4.25.0 2008.01.25 -
Sunbelt 2.2.907.0 2008.01.25 -
Symantec 10 2008.01.26 -
TheHacker 6.2.9.198 2008.01.25 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.25 -
Webwasher-Gateway 6.6.2 2008.01.25 -
Additional information
File size: 897752 bytes
MD5: 0e2d4811b631c54e8da76dc3e50b3c72
SHA1: 25017b8334c49065ed7b7c2f4a25498483f9640a
PEiD: -

tetonbob · 01-25-2008, 05:40 PM

Thanks.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Restart your computer and boot into Safe Mode by tapping the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.

---------------------------------------------------------------------------------------------

Open notepad and copy/paste all the text in the codebox below into it:

Code:

 
File::
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\oifqonjm.ini
C:\WINDOWS\system32\jycraqnr.ini

RenV::
----a-w            61,440 2007-12-31 01:45:08  C:\hp\KBD\KBD .EXE
----a-w            81,920 2007-12-29 23:00:02  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w           221,184 2007-12-29 23:05:09  C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe
----a-w           180,269 2007-12-29 22:49:55  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w         1,064,960 2007-12-29 22:13:47  C:\Program Files\DISC\DISCover .exe
----a-w            61,440 2007-12-29 22:13:42  C:\Program Files\DISC\DiscUpdateMgr .exe
----a-w            68,856 2007-12-29 22:14:48  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w           249,856 2007-12-31 03:09:01  C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp  .exe
----a-w           249,856 2007-12-31 03:09:02  C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp .exe
----a-w            49,152 2007-12-31 01:35:43  C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08 .exe
----a-w            49,152 2007-12-31 01:35:50  C:\Program Files\HP\HP Software Update\HPwuSchd2 .exe
----a-w            49,263 2007-12-31 01:35:56  C:\Program Files\Java\jre1.5.0_10\bin\jusched .exe
----a-w           368,640 2007-12-31 01:36:43  C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor .exe
----a-w         2,577,120 2007-12-31 01:22:24  C:\Program Files\PCPitstop\Optimize\PCPOptimize .exe
----a-w           897,752 2007-12-31 01:21:00  C:\Program Files\PCPitstop\Optimize\Reminder .exe
----a-w           282,624 2007-12-31 04:00:23  C:\Program Files\QuickTime\qttask     .exe
----a-w           282,624 2007-12-31 03:09:02  C:\Program Files\QuickTime\qttask    .exe
----a-w           282,624 2007-12-31 03:09:03  C:\Program Files\QuickTime\qttask   .exe
----a-w           282,624 2007-12-31 03:09:03  C:\Program Files\QuickTime\qttask  .exe
----a-w           282,624 2007-12-31 03:09:03  C:\Program Files\QuickTime\qttask .exe
----a-w           227,328 2007-12-31 01:35:51  C:\Program Files\scansoft\paperport\fbdirect .exe
----a-w           160,568 2007-12-30 00:48:25  C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon .exe
----a-w            90,112 2007-12-31 01:35:45  C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler .exe
----a-w         5,724,184 2007-12-31 04:00:26  C:\Program Files\Windows Live\Messenger\MsnMsgr       .Exe
----a-w         5,724,184 2007-12-31 03:09:05  C:\Program Files\Windows Live\Messenger\MsnMsgr      .Exe
----a-w         5,724,184 2007-12-31 03:09:05  C:\Program Files\Windows Live\Messenger\MsnMsgr     .Exe
----a-w         5,724,184 2007-12-31 03:09:07  C:\Program Files\Windows Live\Messenger\MsnMsgr    .Exe
----a-w         5,724,184 2007-12-31 03:09:11  C:\Program Files\Windows Live\Messenger\MsnMsgr   .Exe
----a-w         5,724,184 2007-12-31 03:09:11  C:\Program Files\Windows Live\Messenger\MsnMsgr  .Exe
----a-w         5,724,184 2007-12-31 03:09:12  C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe
----a-w           204,288 2007-12-31 01:36:06  C:\Program Files\Windows Media Player\WMPNSCFG .exe
----a-w            64,512 2007-12-31 01:35:43  C:\WINDOWS\ehome\ehtray .exe
----a-w           237,568 2007-12-31 01:35:48  C:\WINDOWS\SMINST\RECGUARD .EXE

Folder::
C:\Program Files\SpywareBot
C:\Program Files\Enigma Software Group
C:\Program Files\Coupons
C:\Program Files\Viewpoint

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

If ComboFix reboots the machine, allow the machine to restart in normal mode. If ComboFix does not restart the machine, restart in normal mode.

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

heckernana · 01-25-2008, 06:39 PM

Thank you. I have reviewed your instructions and only have one question. Where do I go to open Hijack This to do the system scan?

tetonbob · 01-25-2008, 06:44 PM

Apparently DSS was unable to download and install HijackThis as part of it's routine.

When you get to that part....

Please download HijackThis to your desktop

Alternate link

Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

---------------------------------------------------------------------------------------------

heckernana · 01-25-2008, 07:18 PM

ComboFix 08-01-23.1C - HP_Administrator 2008-01-25 20:00:57.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.730 [GMT -6:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Administrator\Desktop\CFScript.txt

FILE
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\jycraqnr.ini
C:\WINDOWS\system32\oifqonjm.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Coupons
C:\Program Files\Coupons\uninstall.exe
C:\Program Files\Coupons\Uninstall\IRIMG7.JPG
C:\Program Files\Coupons\Uninstall\IRIMG8.JPG
C:\Program Files\Coupons\Uninstall\Thumbs.db
C:\Program Files\Enigma Software Group
C:\Program Files\Enigma Software Group\SpyHunter\AXList.txt
C:\Program Files\Enigma Software Group\SpyHunter\pgdata.dat
C:\Program Files\Enigma Software Group\SpyHunter\rgdata.dat
C:\Program Files\Enigma Software Group\SpyHunter\spyhunter.log
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3 .exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterInstance.lock
C:\Program Files\Enigma Software Group\SpyHunter\support.log
C:\Program Files\SpywareBot
C:\Program Files\SpywareBot\DataBaseNew.ref
C:\Program Files\SpywareBot\Log\log_2006_08_27_17_12_48.log
C:\Program Files\SpywareBot\Log\log_2006_08_27_17_12_49.log
C:\Program Files\SpywareBot\Log\log_2006_08_27_20_36_55.log
C:\Program Files\SpywareBot\Log\log_2006_08_27_20_44_58.log
C:\Program Files\SpywareBot\Log\log_2006_08_28_07_30_54.log
C:\Program Files\SpywareBot\Log\log_2006_09_02_22_08_04.log
C:\Program Files\SpywareBot\Log\log_2006_09_07_07_41_33.log
C:\Program Files\SpywareBot\Log\log_2006_09_07_21_40_50.log
C:\Program Files\SpywareBot\Log\log_2006_09_09_12_12_05.log
C:\Program Files\SpywareBot\Log\log_2006_09_09_16_30_23.log
C:\Program Files\SpywareBot\Log\log_2006_09_10_11_11_02.log
C:\Program Files\SpywareBot\Log\log_2006_09_10_13_12_55.log
C:\Program Files\SpywareBot\Log\log_2006_09_10_13_48_13.log
C:\Program Files\SpywareBot\Log\log_2006_09_10_14_10_31.log
C:\Program Files\SpywareBot\Log\log_2006_09_10_14_21_34.log
C:\Program Files\SpywareBot\Log\log_2006_09_13_11_09_37.log
C:\Program Files\SpywareBot\Log\log_2006_09_15_21_35_02.log
C:\Program Files\SpywareBot\Log\log_2006_09_15_22_16_04.log
C:\Program Files\SpywareBot\Log\log_2006_09_15_22_25_58.log
C:\Program Files\SpywareBot\Log\log_2006_09_18_18_49_37.log
C:\Program Files\SpywareBot\Log\log_2006_10_06_21_27_17.log
C:\Program Files\SpywareBot\Log\log_2006_10_06_21_35_06.log
C:\Program Files\SpywareBot\Log\log_2006_10_06_22_51_42.log
C:\Program Files\SpywareBot\Log\log_2006_10_07_10_05_08.log
C:\Program Files\SpywareBot\Log\log_2006_10_13_08_24_43.log
C:\Program Files\SpywareBot\Log\log_2006_10_19_07_21_51.log
C:\Program Files\SpywareBot\Log\log_2006_10_20_15_48_35.log
C:\Program Files\SpywareBot\Log\log_2006_11_15_15_05_23.log
C:\Program Files\SpywareBot\Log\log_2006_11_15_19_35_44.log
C:\Program Files\SpywareBot\Log\log_2006_11_15_20_36_10.log
C:\Program Files\SpywareBot\Log\log_2006_12_14_12_29_34.log
C:\Program Files\SpywareBot\Log\log_2006_12_17_15_38_17.log
C:\Program Files\SpywareBot\Log\log_2006_12_17_21_02_50.log
C:\Program Files\SpywareBot\Log\log_2006_12_18_20_54_53.log
C:\Program Files\SpywareBot\Log\log_2006_12_20_21_02_48.log
C:\Program Files\SpywareBot\Log\log_2006_12_23_18_20_07.log
C:\Program Files\SpywareBot\Log\log_2006_12_30_04_52_22.log
C:\Program Files\SpywareBot\Log\log_2007_01_05_14_15_36.log
C:\Program Files\SpywareBot\Log\log_2007_01_07_16_53_43.log
C:\Program Files\SpywareBot\Log\log_2007_01_20_11_18_40.log
C:\Program Files\SpywareBot\Log\log_2007_01_28_09_37_35.log
C:\Program Files\SpywareBot\Log\log_2007_01_30_18_45_37.log
C:\Program Files\SpywareBot\Log\log_2007_01_30_18_58_13.log
C:\Program Files\SpywareBot\Log\log_2007_02_03_22_56_17.log
C:\Program Files\SpywareBot\Log\log_2007_02_04_20_07_02.log
C:\Program Files\SpywareBot\Log\log_2007_02_05_20_29_39.log
C:\Program Files\SpywareBot\Log\log_2007_02_12_17_16_43.log
C:\Program Files\SpywareBot\Log\log_2007_02_12_17_43_45.log
C:\Program Files\SpywareBot\Log\log_2007_02_14_14_16_34.log
C:\Program Files\SpywareBot\Log\log_2007_02_15_18_54_08.log
C:\Program Files\SpywareBot\Log\log_2007_02_18_03_08_07.log
C:\Program Files\SpywareBot\Log\log_2007_02_18_17_34_02.log
C:\Program Files\SpywareBot\Log\log_2007_02_21_05_34_27.log
C:\Program Files\SpywareBot\Log\log_2007_02_21_10_14_38.log
C:\Program Files\SpywareBot\Log\log_2007_03_01_18_56_53.log
C:\Program Files\SpywareBot\Log\log_2007_03_02_19_14_00.log
C:\Program Files\SpywareBot\Log\log_2007_03_03_19_19_19.log
C:\Program Files\SpywareBot\Log\log_2007_03_04_15_02_30.log
C:\Program Files\SpywareBot\Log\log_2007_03_07_07_27_20.log
C:\Program Files\SpywareBot\Log\log_2007_03_11_20_46_23.log
C:\Program Files\SpywareBot\Log\log_2007_03_14_17_34_40.log
C:\Program Files\SpywareBot\Log\log_2007_03_15_13_30_14.log
C:\Program Files\SpywareBot\Log\log_2007_03_16_07_35_50.log
C:\Program Files\SpywareBot\Log\log_2007_03_17_09_42_50.log
C:\Program Files\SpywareBot\Log\log_2007_03_18_21_47_31.log
C:\Program Files\SpywareBot\Log\log_2007_03_23_20_48_07.log
C:\Program Files\SpywareBot\Log\log_2007_03_24_21_05_03.log
C:\Program Files\SpywareBot\Log\log_2007_03_27_11_03_52.log
C:\Program Files\SpywareBot\Log\log_2007_03_27_18_11_52.log
C:\Program Files\SpywareBot\Log\log_2007_04_04_03_07_08.log
C:\Program Files\SpywareBot\Log\log_2007_04_04_18_22_23.log
C:\Program Files\SpywareBot\Log\log_2007_04_05_19_28_01.log
C:\Program Files\SpywareBot\Log\log_2007_04_07_12_51_29.log
C:\Program Files\SpywareBot\Log\log_2007_04_10_18_04_52.log
C:\Program Files\SpywareBot\Log\log_2007_04_12_09_31_11.log
C:\Program Files\SpywareBot\Log\log_2007_04_13_03_08_15.log
C:\Program Files\SpywareBot\Log\log_2007_04_14_11_26_42.log
C:\Program Files\SpywareBot\Log\log_2007_04_18_20_17_15.log
C:\Program Files\SpywareBot\Log\log_2007_04_22_19_31_24.log
C:\Program Files\SpywareBot\Log\log_2007_04_27_10_51_39.log
C:\Program Files\SpywareBot\Log\log_2007_04_27_21_20_33.log
C:\Program Files\SpywareBot\Log\log_2007_04_28_10_04_50.log
C:\Program Files\SpywareBot\Log\log_2007_05_04_21_22_20.log
C:\Program Files\SpywareBot\Log\log_2007_05_05_08_48_19.log
C:\Program Files\SpywareBot\Log\log_2007_05_07_22_26_40.log
C:\Program Files\SpywareBot\Log\log_2007_05_08_19_24_06.log
C:\Program Files\SpywareBot\Log\log_2007_05_08_20_50_41.log
C:\Program Files\SpywareBot\Log\log_2007_05_08_21_39_18.log
C:\Program Files\SpywareBot\Log\log_2007_05_09_17_26_42.log
C:\Program Files\SpywareBot\Log\log_2007_05_09_17_35_29.log
C:\Program Files\SpywareBot\Log\log_2007_05_09_17_46_01.log
C:\Program Files\SpywareBot\Log\log_2007_05_09_17_58_33.log
C:\Program Files\SpywareBot\Log\log_2007_05_10_03_12_43.log
C:\Program Files\SpywareBot\Log\log_2007_05_10_20_22_03.log
C:\Program Files\SpywareBot\Log\log_2007_05_23_03_09_15.log
C:\Program Files\SpywareBot\Log\log_2007_05_27_18_10_34.log
C:\Program Files\SpywareBot\Log\log_2007_06_03_16_27_06.log
C:\Program Files\SpywareBot\Log\log_2007_06_05_21_23_35.log
C:\Program Files\SpywareBot\Log\log_2007_06_10_18_37_10.log
C:\Program Files\SpywareBot\Log\log_2007_06_13_03_09_48.log
C:\Program Files\SpywareBot\Log\log_2007_06_22_06_17_36.log
C:\Program Files\SpywareBot\Log\log_2007_06_26_22_46_43.log
C:\Program Files\SpywareBot\Log\log_2007_07_04_09_57_58.log
C:\Program Files\SpywareBot\Log\log_2007_07_05_11_27_02.log
C:\Program Files\SpywareBot\Log\log_2007_07_06_16_52_42.log
C:\Program Files\SpywareBot\Log\log_2007_07_07_19_30_02.log
C:\Program Files\SpywareBot\Log\log_2007_07_12_03_15_34.log
C:\Program Files\SpywareBot\Log\log_2007_07_13_08_40_25.log
C:\Program Files\SpywareBot\Log\log_2007_07_19_18_38_48.log
C:\Program Files\SpywareBot\Log\log_2007_07_24_19_20_20.log
C:\Program Files\SpywareBot\Log\log_2007_08_16_08_12_29.log
C:\Program Files\SpywareBot\Log\log_2007_08_17_18_13_25.log
C:\Program Files\SpywareBot\Log\log_2007_08_18_18_24_58.log
C:\Program Files\SpywareBot\Log\log_2007_08_19_14_11_29.log
C:\Program Files\SpywareBot\Log\log_2007_08_21_21_22_26.log
C:\Program Files\SpywareBot\Log\log_2007_08_25_10_25_48.log
C:\Program Files\SpywareBot\Log\log_2007_08_28_19_52_51.log
C:\Program Files\SpywareBot\Log\log_2007_09_02_12_26_19.log
C:\Program Files\SpywareBot\Log\log_2007_09_09_15_04_52.log
C:\Program Files\SpywareBot\Log\log_2007_09_09_18_33_11.log
C:\Program Files\SpywareBot\Log\log_2007_09_09_18_43_51.log
C:\Program Files\SpywareBot\Log\log_2007_09_19_15_37_36.log
C:\Program Files\SpywareBot\Log\log_2007_09_19_15_41_26.log
C:\Program Files\SpywareBot\Log\log_2007_09_19_19_02_47.log
C:\Program Files\SpywareBot\Log\log_2007_10_02_19_53_23.log
C:\Program Files\SpywareBot\Log\log_2007_10_09_15_23_00.log
C:\Program Files\SpywareBot\Log\log_2007_10_09_17_28_09.log
C:\Program Files\SpywareBot\Log\log_2007_10_09_18_05_22.log
C:\Program Files\SpywareBot\Log\log_2007_10_09_21_49_50.log
C:\Program Files\SpywareBot\Log\log_2007_10_10_03_07_44.log
C:\Program Files\SpywareBot\Log\log_2007_10_15_13_35_51.log
C:\Program Files\SpywareBot\Log\log_2007_10_17_14_11_21.log
C:\Program Files\SpywareBot\Log\log_2007_10_17_15_05_02.log
C:\Program Files\SpywareBot\Log\log_2007_10_19_17_58_51.log
C:\Program Files\SpywareBot\Log\log_2007_10_22_13_18_23.log
C:\Program Files\SpywareBot\Log\log_2007_10_22_17_13_00.log
C:\Program Files\SpywareBot\Log\log_2007_10_22_20_37_05.log
C:\Program Files\SpywareBot\Log\log_2007_10_23_12_06_51.log
C:\Program Files\SpywareBot\Log\log_2007_10_23_20_18_42.log
C:\Program Files\SpywareBot\Log\log_2007_10_24_19_29_44.log
C:\Program Files\SpywareBot\Log\log_2007_10_27_10_42_36.log
C:\Program Files\SpywareBot\Log\log_2007_10_28_16_39_56.log
C:\Program Files\SpywareBot\Log\log_2007_10_29_18_15_06.log
C:\Program Files\SpywareBot\Log\log_2007_10_31_14_10_58.log
C:\Program Files\SpywareBot\Log\log_2007_11_01_17_06_02.log
C:\Program Files\SpywareBot\Log\log_2007_11_02_12_06_01.log
C:\Program Files\SpywareBot\Log\log_2007_11_04_17_47_28.log
C:\Program Files\SpywareBot\Log\log_2007_11_14_03_09_35.log
C:\Program Files\SpywareBot\Log\log_2007_11_18_05_59_14.log
C:\Program Files\SpywareBot\Log\log_2007_11_19_20_10_53.log
C:\Program Files\SpywareBot\Log\log_2007_11_20_17_56_10.log
C:\Program Files\SpywareBot\Log\log_2007_11_25_07_02_37.log
C:\Program Files\SpywareBot\Log\log_2007_12_13_03_11_25.log
C:\Program Files\SpywareBot\Log\log_2007_12_18_22_27_55.log
C:\Program Files\SpywareBot\Log\log_2007_12_21_11_10_48.log
C:\Program Files\SpywareBot\Log\log_2007_12_22_21_15_39.log
C:\Program Files\SpywareBot\Log\log_2007_12_29_16_03_33.log
C:\Program Files\SpywareBot\Log\log_2007_12_29_16_14_37.log
C:\Program Files\SpywareBot\Log\log_2007_12_29_18_48_20.log
C:\Program Files\SpywareBot\Log\log_2007_12_30_19_04_11.log
C:\Program Files\SpywareBot\Log\log_2007_12_30_19_21_19.log
C:\Program Files\SpywareBot\Log\log_2007_12_30_19_30_49.log
C:\Program Files\SpywareBot\Log\log_2007_12_30_19_36_22.log
C:\Program Files\SpywareBot\Log\log_2007_12_31_19_32_20.log
C:\Program Files\SpywareBot\Log\log_2007_12_31_21_09_03.log
C:\Program Files\SpywareBot\Settings\CustomScan.stg
C:\Program Files\SpywareBot\Settings\IgnoreList.stg
C:\Program Files\SpywareBot\Settings\ScanInfo.stg
C:\Program Files\SpywareBot\Settings\ScanResults.stg
C:\Program Files\SpywareBot\Settings\SelectedFolders.stg
C:\Program Files\SpywareBot\Settings\Settings.stg
C:\Program Files\SpywareBot\SpywareBot .exe
C:\Program Files\Viewpoint
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\jycraqnr.ini
C:\WINDOWS\system32\oifqonjm.ini

.
((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-24 21:15 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-20 21:21 . 2008-01-20 21:21 <DIR> d-------- C:\Deckard
2008-01-20 21:14 . 2008-01-20 21:14 <DIR> d-------- C:\ie-spyad_zo
2008-01-20 20:46 . 2008-01-21 19:37 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-20 20:46 . 2008-01-21 19:45 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-20 20:46 . 2008-01-21 19:45 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-20 20:46 . 2008-01-21 19:45 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-19 18:05 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 17:16 . 2008-01-13 17:16 <DIR> d-------- C:\WINDOWS\Cache
2008-01-11 20:43 . 2008-01-11 20:43 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-01-09 20:41 . 2008-01-25 19:48 121 --a------ C:\WINDOWS\bdagent.INI
2008-01-09 20:23 . 2008-01-09 20:24 <DIR> d-------- C:\Program Files\BitDefender
2008-01-09 20:12 . 2008-01-09 20:24 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-01-05 21:01 . 2008-01-09 20:46 268 --ah----- C:\sqmdata19.sqm
2008-01-05 21:01 . 2008-01-09 20:46 244 --ah----- C:\sqmnoopt19.sqm
2008-01-05 20:55 . 2008-01-09 03:08 268 --ah----- C:\sqmdata18.sqm
2008-01-05 20:55 . 2008-01-09 03:08 244 --ah----- C:\sqmnoopt18.sqm
2008-01-01 19:28 . 2007-08-08 20:02 235,008 --a------ C:\WINDOWS\UNBOC.EXE
2008-01-01 19:28 . 2007-05-08 17:01 208,896 --a------ C:\WINDOWS\CMDLIC.DLL
2008-01-01 19:28 . 2004-08-09 22:00 22,528 --a------ C:\WINDOWS\system32\wsock32.dlb
2008-01-01 18:32 . 2008-01-01 18:32 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-01-01 09:54 . 2008-01-05 21:33 244 --ah----- C:\sqmnoopt17.sqm
2008-01-01 09:54 . 2008-01-05 21:33 232 --ah----- C:\sqmdata17.sqm
2007-12-31 20:19 . 2008-01-05 21:32 244 --ah----- C:\sqmnoopt16.sqm
2007-12-31 20:19 . 2008-01-05 21:32 232 --ah----- C:\sqmdata16.sqm
2007-12-31 20:06 . 2007-12-31 20:06 <DIR> d-------- C:\Program Files\Alwil Software
2007-12-30 22:01 . 2008-01-25 19:48 268 --ah----- C:\sqmdata15.sqm
2007-12-30 22:01 . 2008-01-25 19:48 244 --ah----- C:\sqmnoopt15.sqm
2007-12-30 21:37 . 2007-12-30 21:38 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-30 21:26 . 2008-01-24 00:17 <DIR> d-------- C:\Program Files\Spyware Doctor
2007-12-30 21:26 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-12-30 21:26 . 2007-10-04 17:10 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2007-12-30 21:26 . 2007-10-04 17:10 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2007-12-30 21:26 . 2007-10-04 17:10 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-12-30 21:26 . 2007-10-04 17:11 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2007-12-30 19:33 . 2008-01-24 21:05 268 --ah----- C:\sqmdata14.sqm
2007-12-30 19:33 . 2008-01-24 21:05 244 --ah----- C:\sqmnoopt14.sqm
2007-12-30 19:28 . 2008-01-24 20:45 268 --ah----- C:\sqmdata13.sqm
2007-12-30 19:28 . 2008-01-24 20:45 244 --ah----- C:\sqmnoopt13.sqm
2007-12-30 19:16 . 2008-01-24 17:48 268 --ah----- C:\sqmdata12.sqm
2007-12-30 19:16 . 2008-01-24 17:48 244 --ah----- C:\sqmnoopt12.sqm
2007-12-30 17:58 . 2008-01-23 07:28 268 --ah----- C:\sqmdata11.sqm
2007-12-30 17:58 . 2008-01-23 07:28 244 --ah----- C:\sqmnoopt11.sqm
2007-12-30 16:50 . 2007-12-30 16:51 1,283,174 --a------ C:\Install
2007-12-30 16:11 . 2008-01-20 17:17 268 --ah----- C:\sqmdata10.sqm
2007-12-30 16:11 . 2008-01-20 17:17 244 --ah----- C:\sqmnoopt10.sqm
2007-12-29 18:43 . 2008-01-17 07:01 268 --ah----- C:\sqmdata09.sqm
2007-12-29 18:43 . 2008-01-17 07:01 244 --ah----- C:\sqmnoopt09.sqm
2007-12-29 16:06 . 2008-01-15 20:37 268 --ah----- C:\sqmdata08.sqm
2007-12-29 16:06 . 2008-01-15 20:37 244 --ah----- C:\sqmnoopt08.sqm
2007-12-29 15:59 . 2008-01-14 20:40 268 --ah----- C:\sqmdata07.sqm
2007-12-29 15:59 . 2008-01-14 20:40 244 --ah----- C:\sqmnoopt07.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 01:59 --------- d-----w C:\Program Files\QuickTime
2008-01-26 01:59 --------- d-----w C:\Program Files\PC-Doctor 5 for Windows
2008-01-26 01:59 --------- d-----w C:\Program Files\DISC
2008-01-21 03:04 --------- d-----w C:\Program Files\SpywareBlaster
2008-01-12 02:44 --------- d-----w C:\Program Files\Best Buy Rhapsody
2008-01-10 02:22 --------- d-----w C:\Program Files\Symantec
2008-01-10 02:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-04 17:05 --------- d-----w C:\Program Files\iTunes
2008-01-02 01:28 --------- d-----w C:\Program Files\Comodo
2008-01-02 00:31 --------- d-----w C:\Program Files\Common Files\Real
2007-12-31 03:23 --------- d-----w C:\Program Files\Google
2007-12-30 01:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-30 01:04 --------- d-----w C:\Program Files\AIM
2007-12-19 04:29 --------- d-----w C:\Program Files\Common Files\AOL
2007-11-29 22:50 38,567 ----a-w C:\WINDOWS\system32\pcpbios.exe
2007-11-27 22:46 77,824 ----a-w C:\WINDOWS\system32\xcomm.dll
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:35 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 23:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2005-09-24 07:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
1998-11-17 17:09 24,576 ----a-w C:\WINDOWS\inf\Vizpnpin.exe
1998-10-12 17:23 40,960 ----a-w C:\WINDOWS\inf\vizPnP\Vipersti.dll
1998-07-30 18:44 19,112 ----a-w C:\WINDOWS\inf\vizPnP\Pmxscan.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{3BB63FD4-3C00-44D7-94A9-5DE211900DEF}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{381FFDE8-2394-4F90-B10D-FC6124A40F8C}

[HKEY_CLASSES_ROOT\clsid\{381ffde8-2394-4f90-b10d-fc6124a40f8c}]
[HKEY_CLASSES_ROOT\BitDefender Toolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 22:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-12-30 21:09 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2007-12-30 19:35 64512]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-24 19:15 7311360]
"nwiz"="nwiz.exe" [2006-01-24 19:15 1519616 C:\WINDOWS\system32\nwiz.exe]
"PCDrProfiler"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2007-12-30 19:35 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 15:46 61440]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2007-11-16 16:37 319488]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-30 21:09 282624]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-09 22:00 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-12-30 21:16:47 124400]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-08-24 01

07 36903]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

S1 bdftdif;bdftdif;C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys [2007-11-12 16:28]
S1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-09-05 08:39]
S3 3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df;3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df;E:\CDS300\cds300.dll []
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-11-12 16:27]
S3 bdfsfltr;bdfsfltr;C:\WINDOWS\system32\drivers\bdfsfltr.sys [2007-08-02 16:03]
S3 BDSelfPr;BDSelfPr;C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys [2008-01-21 19:55]
S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
S3 PCD5SRVC{085326CB-51A3560A-05010003};PCD5SRVC{085326CB-51A3560A-05010003} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [2005-11-21 11:27]
S3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe [2004-08-09 22:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

.
Contents of the 'Scheduled Tasks' folder
"2008-01-26 01:02:13 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-22 08:53:00 C:\WINDOWS\Tasks\Disk Cleanup.job"
- C:\Documents and Settings\HP_Administrator\My Documents\ppviewer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 20:04:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-25 20:05:11
ComboFix-quarantined-files.txt 2008-01-26 02:04:52
ComboFix2.txt 2008-01-25 03:22:01
.
2008-01-23 13:33:07 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:13:13 PM, on 1/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/1me10enus/2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/1me10enus/2
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\webhelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.emdat.com (HKLM)
O15 - Trusted Zone: *.mytranscriptions.com (HKLM)
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase2895.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1178592258437
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players...stallAsst2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/A...oadcontrol.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 11535 bytes

01-20-2008, 06:58 PM	#1 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Error message [Moved from XP] When starting my computer, I get an error message which includes ....."C:\WINDOWS\system32\mljjj.exe". It appears twice and after I click okay, it does not return until next start.

01-20-2008, 07:11 PM	#2 (permalink)
speedster123 Mentor Join Date: Oct 2006 Location: United States-New York-Long Island Posts: 5,132 OS: xp pro SP3 My System	Re: Error message welcome please follow the link in my sig for infections. __________________

01-21-2008, 07:02 PM	#3 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message I have attempted to follow the instructions provided by speedster123. This is the first time I have ever posted to a forum and apologize for my lack of knowledge in the protocol. I was unable to complete the online scan using Panda ActiveScan even though I disabled the Avast AntiVirus. I was successful in the other steps. Below is the Deckard Scan results. Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: AMD Athlon(tm) 64 Processor 3800+ Percentage of Memory in Use: 51% Physical Memory (total/avail): 958.48 MiB / 461.7 MiB Pagefile Memory (total/avail): 2312.76 MiB / 1565.69 MiB Virtual Memory (total/avail): 2047.88 MiB / 1911.12 MiB C: is Fixed (NTFS) - 174.52 GiB total, 142.21 GiB free. D: is Fixed (FAT32) - 11.76 GiB total, 4.65 GiB free. E: is CDROM (No Media) F: is Removable (No Media) G: is Removable (No Media) H: is Removable (No Media) I: is Removable (No Media) \\.\PHYSICALDRIVE0 - Maxtor 6L200M0 - 186.31 GiB - 2 partitions \PARTITION0 (bootable) - Installable File System - 174.52 GiB - C: \PARTITION1 - Unknown - 11.78 GiB - D: \\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device \\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device \\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device \\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FirstRunDisabled is set. FirewallDisableNotify is set. FW: Bitdefender Firewall v8.0 (BitDefender) AV: Bitdefender Antivirus v8.0 (BitDefender) AV: avast! antivirus 4.7.1098 [VPS 080120-1] v4.7.1098 (ALWIL Software) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"="C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe::Enabled:Updates from HP" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe::Enabled:AOL Instant Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe::Enabled:hpqtra08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe::Enabled:hpqste08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe::Enabled:hpofxm08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe::Enabled:hposfx08.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe::Enabled:hposid01.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe::Enabled:hpqscnvw.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe::Enabled:hpqkygrp.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe::Enabled:hpqcopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe::Enabled:hpfccopy.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe::Enabled:hpzwiz01.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe::Enabled:hpqphunl.exe" "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe::Enabled:hpqdia.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe::Enabled:hpoews01.exe" "C:\\Program Files\\DISC\\DISCover.exe"="C:\\Program Files\\DISC\\DISCover.exe::Enabled:DISCover Drop & Play System" "C:\\Program Files\\DISC\\DiscStreamHub.exe"="C:\\Program Files\\DISC\\DiscStreamHub.exe::Enabled:DISCover Stream Hub" "C:\\Program Files\\DISC\\myFTP.exe"="C:\\Program Files\\DISC\\myFTP.exe::Enabled:DISCover FTP" "C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"="C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe::Enabled:Updates from HP" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe::Enabled:AOL Instant Messenger" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe::Enabled:Windows Messenger" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe::Enabled:AOL Loader" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe::Enabled:LimeWire" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe::Enabled:Internet Explorer" "C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"="C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe::Disabled:Earthlink" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe::Disabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Netscape\\Navigator 9\\navigator.exe"="C:\\Program Files\\Netscape\\Navigator 9\\navigator.exe::Enabled:Navigator" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\\WINDOWS\\system32\\jmovqwmc.exe"="C:\\WINDOWS\\system32\\jmo" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe::Enabled:iTunes" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\HP_Administrator\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=YOUR-4DACD0EA75 ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\HP_Administrator LOGONSERVER=\\YOUR-4DACD0EA75 NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\Python22;C:\Program Files\QuickTime\QTSystem\;;C:\PROGRA~1\COMMON~1\MUVEET~1\030625;C:\PROGRA~1\COMMON~1\MUVEET~1\030625 PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=2f02 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip SESSIONNAME=Console SonicCentral=c:\Program Files\Common Files\Sonic Shared\Sonic Central\ SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp TMP=C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp USERDOMAIN=YOUR-4DACD0EA75 USERNAME=HP_Administrator USERPROFILE=C:\Documents and Settings\HP_Administrator windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- HP_Administrator (admin)* Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks\|RealPlayer\|6.0 --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu --> c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205} --> c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382} --> c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629} --> c:\WINDOWS\system32\\MSIEXEC.EXE /x {F80239D8-7811-4D5E-B033-0D0BBFE32920} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 9 --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81100000003} Agere Systems PCI-SV92PP Soft Modem --> agrsmdel AiO_Scan --> AiO_Scan_CDA --> AiOSoftware --> AiOSoftwareNPI --> AOL Security Toolbar --> regsvr32 /u /s "C:\Program Files\AOL Security Toolbar\tbu354\AOL_security_toolbar.dll" Apple Software Update --> MsiExec.exe /I{A50C25D7-62E9-4511-AD70-8E2DA5E79B7D} avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe BitDefender Total Security 2008 --> MsiExec.exe /I{C33A19F0-A3D8-45B4-B067-251D2DBABB1A} BufferChm --> CameraDrivers --> CameraDrivers --> CP_AtenaShokunin1Config --> CP_CalendarTemplates1 --> cp_LightScribeConfig --> cp_OnlineProjectsConfig --> CP_Package_Basic1 --> CP_Package_Variety1 --> CP_Package_Variety2 --> CP_Package_Variety3 --> CP_Panorama1Config --> cp_PosterPrintConfig --> cp_UpdateProjectsConfig --> CueTour --> Customer Experience Enhancement --> Customer Experience Enhancement --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{23012310-3E05-46A5-88A9-C6CBCABCAC79} /l1033 CustomerResearchQFolder --> Destinations --> DeviceFunctionQFolder --> DeviceManagementQFolder --> DISCover --> "C:\Program Files\DISC\uninstall.exe" DocProc --> DocumentViewer --> DocumentViewerQFolder --> Easy Internet Sign-up --> Easy Internet Sign-up --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1033 Enhanced Multimedia Keyboard Solution --> C:\HP\KBD\Install.exe /u Family Feud --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\413773DA-62DE-4C4C-A0F9-10EFB9317DE5\Uninstall.exe" FATE from HP Media Center (remove only) --> "C:\Program Files\WildTangent\Apps\GameChannel\Games\3320769C-062B-4670-BD6B-AA4B3D0E9903\Uninstall.exe" Fax --> Fax_CDA --> FullDPAppQFolder --> GemMaster Mystic --> "C:\Program Files\GemMaster\uninstallgemmaster.exe" Google Desktop --> C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72} Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe" Highlight Viewer (Windows Live Toolbar) --> MsiExec.exe /X{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF} Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" HP Boot Optimizer --> C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe /uninstall HP Deskjet 5400 series --> C:\Program Files\HP\Digital Imaging\{EB57A16E-500D-43d7-85B9-FBE279EBBA6E}\setup\hpzscr01.exe -datfile hpfscr05.dat HP Deskjet Printer Preload --> MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0} HP DigitalMedia Archive --> MsiExec.exe /X{F80239D8-7811-4D5E-B033-0D0BBFE32920} HP Document Viewer 5.3 --> C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat HP DVD Play 1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall HP Extended Capabilities 5.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat HP Game Console and games --> C:\Program Files\WildTangent\Apps\hpuninstall.exe HP Imaging Device Functions 6.0 --> C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat HP Photosmart 330,380,420,470,7800,8000,8200 Series --> C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat HP Photosmart Cameras 5.0 --> C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat HP Photosmart for Media Center PC --> c:\Program Files\HP\Digital Imaging\bin\mcpc\setupmcl.exe /u HP Photosmart Premier Software 6.0 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat HP PSC & OfficeJet 5.3.A --> "C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat HP PSC & OfficeJet 5.3.B --> "C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat HP Solution Center & Imaging Support Tools 5.3 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat HP Update --> MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134} HP Web Helper --> regsvr32 /u /s "C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\webhelper.dll" HPDeskjet5400Series --> HPProductAssistant --> HpSdpAppCoreApp --> InstantShareDevices --> iTunes --> MsiExec.exe /I{446DBFFA-4088-48E3-8932-74316BA4CAE4} J2SE Runtime Environment 5.0 Update 10 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100} J2SE Runtime Environment 5.0 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150050} LightScribe 1.4.62.1 --> LiveUpdate 3.2 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U Macromedia Flash Player 8 --> MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46} Map Button (Windows Live Toolbar) --> MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA} MarketResearch --> Microsoft Away Mode --> Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Money 2006 --> "C:\Program Files\Microsoft Money 2006\MNYCoreFiles\Setup\uninst.exe" /s:120 Microsoft Office 2003 Edition 60 Days Trial Welcome Tour --> MsiExec.exe /I{A01FC76F-CC09-4658-9E37-5C2F635EE708} Microsoft Office PowerPoint Viewer 2003 --> MsiExec.exe /X{90AF0409-6000-11D3-8CFE-0150048383C9} Microsoft Office Standard Edition 2003 --> MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9} Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8} Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Works --> MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44} MSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP muvee autoProducer 4.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E073D315-3C54-44BF-A1B2-B5583AEA618C}\setup.exe" -l0x9 muvee autoProducer unPlugged 1.2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35DD9A1D-B340-4F41-A8B0-6EEBFB119280}\setup.exe" -l0x9 Netscape Navigator (9.0.0.5) --> C:\PROGRA~1\NETSCAPE\Navigator 9\uninstall\helper.exe Network Play System (Patching) --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Electronic Arts\Network Play System\NPSPatch.isu" NewCopy --> NewCopy_CDA --> NVIDIA Drivers --> C:\WINDOWS\system32\nvunrm.exe UninstallGUI OptionalContentQFolder --> Otto --> "C:\Program Files\EnglishOtto\uninstallotto.exe" PanoStandAlone --> PC-Doctor 5 for Windows --> C:\Program Files\PC-Doctor 5 for Windows\uninst.exe PhotoGallery --> PopsMedia Site Adviser --> C:\Program Files\PopsMedia Site Adviser\vm5_killer.exe PS2 --> C:\WINDOWS\system32\ps2.exe uninstall PSPrinters08 --> PSTAPlugin --> Python 2.2 pywin32 extensions (build 203) --> "C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log" Python 2.2.3 --> C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG Quicken 2006 --> MsiExec.exe /X{2818095F-FB6C-42C8-827E-0A406CC9AFF5} QuickTime --> MsiExec.exe /I{50D8FFDD-90CD-4859-841F-AA1961C7767A} RandMap --> Readme --> RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks\|RealPlayer\|6.0 Realtek High Definition Audio Driver --> RtlUpd.exe -r -m Remove IntelliMover Demo --> c:\hp\bin\cloaker.exe c:\hp\bin\commands.exe /c "C:\Program Files\IntelliMoverDemo\clean.bat" Router --> C:\Program Files\Router\UnInstall.exe Scan --> ScannerCopy --> Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe" Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe" SkinsHP1 --> Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D} SolutionCenter --> Sonic Express Labeler --> MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA} Sonic MyDVD Plus --> MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29} Sonic RecordNow Audio --> MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382} Sonic RecordNow Copy --> MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629} Sonic RecordNow Data --> MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205} Sonic Update Manager --> MsiExec.exe /X{30465B6C-B53F-49A1-9EBA-A3F187AD502E} Sonic_PrimoSDK --> Spyware Doctor 5.1 --> C:\Program Files\Spyware Doctor\unins000.exe /LOG SpywareBlaster v3.5.1 --> "C:\Program Files\SpywareBlaster\unins000.exe" Status --> TrayApp --> Unload --> Update Rollup 2 for Windows XP Media Center Edition 2005 --> Updates from HP (remove only) --> C:\WINDOWS\HPCPCUninstall-9972322\HPBWSetup.exe -appid 9972322 -uninstall WebFldrs XP --> WebReg --> WildTangent Web Driver --> C:\Program Files\WildTangent\Apps\CDA\CDAUninstall.exe Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe" Windows Live Favorites for Windows Live Toolbar --> MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66} Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} Windows Live Mail --> MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7} Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0} Windows Live Photo Gallery --> MsiExec.exe /X{257E440F-781F-459B-9A68-A0872B80C1D6} Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750} Windows Live Toolbar --> MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750} Windows Live Toolbar Extension (Windows Live Toolbar) --> MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D} Windows Live Writer --> MsiExec.exe /X{9176251A-4CC1-4DDB-B343-B487195EB397} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows XP Media Center Edition 2005 KB925766 --> "C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe" Yahoo! Toolbar --> Yahoo! Toolbar --> C:\PROGRA~1\Yahoo!\Common\unyt.exe -- Application Event Log ------------------------------------------------------- Event Record #/Type11192 / Error Event Submitted/Written: 01/20/2008 06:48:43 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application navigator.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type11179 / Error Event Submitted/Written: 01/20/2008 05:16:54 PM Event ID/Source: 1001 / Application Hang Event Description: Fault bucket 07616520. Event Record #/Type11178 / Error Event Submitted/Written: 01/20/2008 05:16:05 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application navigator.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type11174 / Error Event Submitted/Written: 01/20/2008 04:45:23 PM Event ID/Source: 101 / Automatic LiveUpdate Scheduler Event Description: Information Level: error Initialization of the COM subsystem failed. Error code: 0x8007041D Event Record #/Type11170 / Error Event Submitted/Written: 01/20/2008 00:51:45 PM Event ID/Source: 101 / Automatic LiveUpdate Scheduler Event Description: Information Level: error Initialization of the COM subsystem failed. Error code: 0x8007041D -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type66989 / Error Event Submitted/Written: 01/20/2008 05:24:27 PM Event ID/Source: 7026 / Service Control Manager Event Description: The following boot-start or system-start driver(s) failed to load: ftsata2 Event Record #/Type66983 / Warning Event Submitted/Written: 01/20/2008 04:58:23 PM Event ID/Source: 4226 / Tcpip Event Description: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. Event Record #/Type66979 / Error Event Submitted/Written: 01/20/2008 04:45:43 PM Event ID/Source: 7000 / Service Control Manager Event Description: The LiveUpdate service failed to start due to the following error: %%1053 Event Record #/Type66978 / Error Event Submitted/Written: 01/20/2008 04:45:42 PM Event ID/Source: 7009 / Service Control Manager Event Description: Timeout (30000 milliseconds) waiting for the LiveUpdate service to connect. Event Record #/Type66977 / Error Event Submitted/Written: 01/20/2008 04:45:22 PM Event ID/Source: 10005 / DCOM Event Description: DCOM got error "%%1053" attempting to start the service LiveUpdate with arguments "" in order to run the server: {03E0E6C2-363B-11D3-B536-00902771A435} -- End of Deckard's System Scanner: finished at 2008-01-20 22:28:10 ------------

01-22-2008, 11:37 AM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] Hello - Deckard's System Scanner should have also produced another log, main.txt If it's been closed, it's located at C:\Deckard\System Scanner\main.txt Please locate and post it. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

01-22-2008, 04:25 PM	#5 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message [Moved from XP] Thank you. Deckard's System Scanner v20071014.68 Run by HP_Administrator on 2008-01-20 21:22:37 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 58: 2008-01-21 03:22:43 UTC - RP534 - Deckard's System Scanner Restore Point 57: 2008-01-21 00:33:00 UTC - RP533 - Spyware Doctor: Cleaning Threats 56: 2008-01-20 02:53:54 UTC - RP532 - System Checkpoint 55: 2008-01-19 02:35:07 UTC - RP531 - System Checkpoint 54: 2008-01-18 02:27:44 UTC - RP530 - System Checkpoint -- First Restore Point -- 1: 2007-12-29 21:12:12 UTC - RP477 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-01-20 22:27:24 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\arservice.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\alg.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\ehome\ehmsas.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\WINDOWS\RTHDCPL.EXE C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\6HJZJBSD\dss[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/1me10enus/2 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by CenturyTel R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/1me10enus/2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/1me10enus/2 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by CenturyTel R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll F0 - win.ini: load=C:\WINDOWS\system32\mljjj.exe F3 - REG:win.ini: Load=C:\WINDOWS\system32\userinit.exe, O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2E7F256F-0217-4924-B535-5530D2342791} - (no file) O2 - BHO: {e7b2a9a9-0d80-9348-b084-f30833740cc3} - {3cc04733-803f-480b-8439-08d09a9a2b7e} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {9689D867-13DE-1E5D-DC2E-4FE679F3589A} - (no file) O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {CD61E5EE-6447-41C9-BD85-84B4ED476CB4} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: (no name) - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - (no file) O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Startup: Dora Fairytale Adventures Registration.lnk = E:\ATR1.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: .emdat.com (HKLM) O15 - Trusted Zone: .mytranscriptions.com (HKLM) O15 - Trusted Zone: http://trymedia.com (HKLM) O15 - Trusted Zone: https://trymedia.com (HKLM) O15 - Trusted Zone: https://emdat.com (HKCU) O15 - Trusted Zone: https://mytranscriptions.com (HKCU) O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase2895.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1178592258437 O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players...stallAsst2.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/A...oadcontrol.cab O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 14197 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 sdcplh - c:\windows\system32\drivers\sdcplh.sys <Not Verified; ; SDCPLH> R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path Manager® (32-bit)> R3 BDSelfPr - c:\program files\bitdefender\bitdefender 2008\bdselfpr.sys <Not Verified; BitDefender S.R.L.; BitDefender> S0 ftsata2 - c:\windows\system32\drivers\ftsata2.sys (file missing) S3 3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df - e:\cds300\cds300.dll (file missing) S3 BOCDRIVE (BOClean Kernel Monitor.) - c:\program files\comodo\cboclean\bocdrive.sys (file missing) S3 PCD5SRVC{085326CB-51A3560A-05010003} (PCD5SRVC{085326CB-51A3560A-05010003} - PCDR Kernel Mode Service Helper Driver) - c:\program files\pc-doctor 5 for windows\pcd5srvc.pkms <Not Verified; PC-Doctor, Inc.; PC-Doctor for Windows> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S3 GoogleDesktopManager-093007-112848 (Google Desktop Manager 5.5.709.30344) - "c:\program files\google\google desktop search\googledesktop.exe" (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-01-20 22:02:00 276 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job 2008-01-20 18:24:22 354 --a------ C:\WINDOWS\Tasks\Disk Cleanup.job -- Files created between 2007-12-20 and 2008-01-20 ----------------------------- 2008-01-20 21:14:48 0 d-------- C:\ie-spyad_zo 2008-01-20 20:46:53 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-01-20 20:46:51 0 d-------- C:\WINDOWS\LastGood 2008-01-19 18:05:38 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Grisoft 2008-01-13 17:16:04 0 d-------- C:\WINDOWS\Cache 2008-01-12 16:15:54 0 d-------- C:\Documents and Settings\LocalService\Start Menu 2008-01-11 20:43:28 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2008-01-09 20:25:15 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\BitDefender 2008-01-09 20:23:54 0 d-------- C:\Program Files\BitDefender 2008-01-09 20:23:54 0 d-------- C:\Documents and Settings\All Users\Application Data\BitDefender 2008-01-09 20:12:50 0 d-------- C:\Program Files\Common Files\BitDefender 2008-01-03 14:22:48 717165 --ahs---- C:\WINDOWS\system32\jjjlm.ini2 2008-01-01 19:28:14 235008 --a------ C:\WINDOWS\UNBOC.EXE <Not Verified; COMODO; COMODO BOClean - Anti-Malware> 2008-01-01 19:28:13 208896 --a------ C:\WINDOWS\CMDLIC.DLL <Not Verified; COMODO; COMODO BOClean - AntiMalware> 2008-01-01 18:32:45 0 d-------- C:\Program Files\Common Files\xing shared 2008-01-01 10:16:01 0 d-------- C:\Documents and Settings\Default User\Application Data\Apple Computer 2007-12-31 2042 0 d-------- C:\Program Files\Alwil Software 2007-12-30 21:38:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2007-12-30 21:37:41 0 d-------- C:\Program Files\Common Files\Adobe 2007-12-30 21:26:38 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-12-30 21:26:09 0 d-------- C:\Program Files\Spyware Doctor 2007-12-30 21:26:09 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\PC Tools 2007-12-30 21:20:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Mozilla 2007-12-30 21:16:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2007-12-30 20:11:43 0 d-------- C:\Documents and Settings\HP_Administrator\.housecall6.6 2007-12-30 19:33:44 0 d-------- C:\Program Files\Common Files\F?nts 2007-12-30 19:33:31 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?ssembly 2007-12-30 19:33:22 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\??mantec 2007-12-30 17:41:31 0 d-------- C:\Program Files\Enigma Software Group 2007-12-30 16:50:56 1283174 --a------ C:\Install 2007-12-30 16:11:22 0 d-------- C:\Program Files\Words 2007-12-30 15:35:53 0 d-------- C:\Program Files\Router 2007-12-30 15:20:58 0 d-------- C:\WINDOWS\??mbols 2007-12-30 15:20:46 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\a?sembly 2007-12-30 13:33:50 69632 --a------ C:\WINDOWS\b143.exe 2007-12-29 15:12:01 719058 --ahs---- C:\WINDOWS\system32\yyadd.ini2 2007-12-29 1541 0 d-------- C:\Program Files\Common Files\??crosoft.NET 2007-12-29 1533 0 d-------- C:\WINDOWS\?dobe 2007-12-22 21:11:33 0 d--h----- C:\WINDOWS\msdownld.tmp -- Find3M Report --------------------------------------------------------------- 2008-01-20 21:04:46 0 d-------- C:\Program Files\SpywareBlaster 2008-01-20 20:37:43 0 d-------- C:\Program Files\Viewpoint 2008-01-19 17:40:20 0 d-------- C:\Program Files\Coupons 2008-01-15 16:58:46 10656 --a------ C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat 2008-01-11 20:44:45 0 d-------- C:\Program Files\Best Buy Rhapsody 2008-01-11 20:19:42 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\HP 2008-01-09 20:22:58 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-01-09 20:22:14 0 d-------- C:\Program Files\Symantec 2008-01-09 20:22:10 0 d-------- C:\Program Files\Common Files 2008-01-04 11:05:56 0 d-------- C:\Program Files\iTunes 2008-01-01 19:28:00 0 d-------- C:\Program Files\Comodo 2008-01-01 19:20:23 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla 2008-01-01 18:31:47 0 d-------- C:\Program Files\Common Files\Real 2008-01-01 16:55:40 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Google 2008-01-01 09:53:05 0 d-------- C:\Program Files\PC-Doctor 5 for Windows 2008-01-01 09:53:02 0 d-------- C:\Program Files\QuickTime 2007-12-31 20:23:55 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?ssembly 2007-12-30 22:00:33 0 d-------- C:\Program Files\Common Files\F?nts 2007-12-30 21:23:31 0 d-------- C:\Program Files\Google 2007-12-30 19:35:39 0 d-------- C:\Program Files\SpywareBot 2007-12-30 19:35:08 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\??mantec 2007-12-30 19:35:08 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\a?sembly 2007-12-29 19:07:32 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-12-29 19:04:06 0 d-------- C:\Program Files\AIM 2007-12-29 19:03:57 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Aim 2007-12-29 19:01:44 0 d-------- C:\Program Files\Common Files\??crosoft.NET 2007-12-29 18:39:59 0 d-------- C:\Program Files\DISC 2007-12-18 22:29:27 0 d-------- C:\Program Files\Common Files\AOL 2007-11-29 16:50:20 38567 --a------ C:\WINDOWS\system32\pcpbios.exe 2007-11-27 16:46:24 77824 --a------ C:\WINDOWS\system32\xcomm.dll <Not Verified; BitDefender; BitDefender Communicator> 2007-10-23 1708 585728 --a------ C:\WINDOWS\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery> -- Registry Dump --------------------------------------------------------------- Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E7F256F-0217-4924-B535-5530D2342791}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3cc04733-803f-480b-8439-08d09a9a2b7e}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9689D867-13DE-1E5D-DC2E-4FE679F3589A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD61E5EE-6447-41C9-BD85-84B4ED476CB4}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [08/05/2005 02:56 PM] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [01/24/2006 07:15 PM] "nwiz"="nwiz.exe" [01/24/2006 07:15 PM C:\WINDOWS\system32\nwiz.exe] "@"="" [] "PCDrProfiler"="" [] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [12/04/2007 07:00 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/30/2006 09:36 AM] "BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [10/09/2007 03:46 PM] "BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [11/16/2007 04:37 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [12/30/2007 09:09 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/09/2004 10:00 PM] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [12/30/2007 09:09 PM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "RunNarrator"=Narrator.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktop"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx scan [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb6bd30b-338a-11db-a151-806d6172696f}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 -- End of Deckard's System Scanner: finished at 2008-01-20 22:28:10 ------------

01-22-2008, 04:32 PM	#6 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] I see you have more than one Anti-Virus program installed, Avast and Bitdefender. While this may seem like greater protection, it can cause problems including slowdowns and system hangs. Choose one to keep and uninstall the other. Any antivirus program must be removed via add/remove program. For any program that doesn't have an add/remove entry, you will have to do this: re-install the program -> reboot -> uninstall ----------------------------------------------------------------------- Please visit this webpage for instructions for downloading and running ComboFix. Take your time and read the page completely. If there's anything you don't understand, post back and ask questions first, before proceeding. http://www.bleepingcomputer.com/comb...o-use-combofix If, while you're performing those instructions, you need to install the Windows XP Recovery Console using ComboFix, a log will be produced, CF-RC.txt Post that log before continuing any further, and do NOT reboot your machine until I've reviewed it. If you have a Windows XP CD with which to install the Windows XP Recovery Console as directed in the Guide, or already have the Windows XP Recovery Console installed, post the log from ComboFix when you've accomplished all that, along with a new HijackThis log. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009 Last edited by tetonbob; 01-22-2008 at 04:35 PM.

01-22-2008, 04:35 PM	#7 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] Please see edited instructions above. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

01-24-2008, 06:03 PM	#8 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message [Moved from XP] I am unable to run the ComboFix. After closing down all program and disabling antivirus/spyware, etc. I double click on the icon then click run. A screen then appears stating NIRCMD.com is not a valid Win32 application. After clicking the OK button another screen appears which states Windows cannot open this file: NIRCMD.cfexe To open this file, Windows needs to know what program to run it with. I am unable to remove this screen. Another screen is also open. Instead of: Please wait-ComboFix is preparing to run, it states: Access denied. ComboFix is preparing to run. Please advise

01-24-2008, 06:20 PM	#9 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] Sounds to me like the file is corrupt. Perhaps one of your protection applications harmed it. What size is ComboFix.exe, and exactly when did you download it? __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

01-24-2008, 07:24 PM	#10 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message [Moved from XP] It was downloaded at 6:00 PM Central Time today. The size is 1.49 MB

01-24-2008, 07:29 PM	#11 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] I'm pretty sure BOClean is interfering, or has corrupted the file. It's very aggressive with it's heuristics. Did you disable BOClean before attempting to first run ComboFix? Is ComboFix still open? What state is your machine in? __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

01-24-2008, 07:40 PM	#12 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message [Moved from XP] I uninstalled BO Cleaner last week and disabled everything else. ComboFix is not open. Each time I have attempted to run it, I receive the same message - NIRCMD.com is not a valid Win32 application. The computer is running slow; however, since you advised to remove one of the antivirus programs, it has picked up speed, although still somewhat slow for DSL. At startup, the ....."C:\WINDOWS\system32\mljjj.exe.... message continues to appear.

01-24-2008, 07:42 PM	#13 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] Please delete your existing version of ComboFix, download a fresh version, and boot into safe mode to run it. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

01-24-2008, 08:34 PM	#14 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message [Moved from XP] ComboFix 08-01-23.1C - HP_Administrator 2008-01-24 21:16:40.1 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.694 [GMT -6:00] Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\HP_Administrator\Application Data\ASEMBL~1 C:\Documents and Settings\HP_Administrator\Application Data\DriveCleaner Free C:\Documents and Settings\HP_Administrator\Application Data\DriveCleaner Free\Logs\update.log C:\Documents and Settings\HP_Administrator\Application Data\MANTEC~1 C:\Documents and Settings\HP_Administrator\Application Data\SSEMBL~1 C:\Documents and Settings\HP_Administrator\Application Data\SSEMBL~1\?ssembly\ C:\Documents and Settings\HP_Administrator\err.log C:\Documents and Settings\HP_Administrator\g2mdlhlpx.exe C:\Program Files\Common Files\crosof~1.net C:\Program Files\Common Files\fnts~1 C:\Program Files\racle~1 C:\Program Files\Router C:\Program Files\sstem3~1 C:\Program Files\ystem3~1 C:\WINDOWS\b143.exe C:\WINDOWS\dobe~1 C:\WINDOWS\mbols~1 C:\WINDOWS\racle~1 C:\WINDOWS\system32\_000006_.tmp.dll C:\WINDOWS\system32\_000009_.tmp.dll C:\WINDOWS\system32\ctfmon.exe.tmp C:\WINDOWS\system32\jjjlm.ini C:\WINDOWS\system32\jjjlm.ini2 C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\yyadd.ini C:\WINDOWS\system32\yyadd.ini2 D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 ))))))))))))))))))))))))))))))) . 2008-01-24 21:15 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe 2008-01-20 21:21 . 2008-01-20 21:21 <DIR> d-------- C:\Deckard 2008-01-20 21:14 . 2008-01-20 21:14 <DIR> d-------- C:\ie-spyad_zo 2008-01-20 20:46 . 2008-01-21 19:37 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2008-01-20 20:46 . 2008-01-21 19:45 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2008-01-20 20:46 . 2008-01-21 19:45 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-20 20:46 . 2008-01-21 19:45 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-01-19 18:05 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-01-13 17:16 . 2008-01-13 17:16 <DIR> d-------- C:\WINDOWS\Cache 2008-01-11 20:43 . 2008-01-11 20:43 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2008-01-09 20:41 . 2008-01-24 21:05 121 --a------ C:\WINDOWS\bdagent.INI 2008-01-09 20:23 . 2008-01-09 20:24 <DIR> d-------- C:\Program Files\BitDefender 2008-01-09 20:12 . 2008-01-09 20:24 <DIR> d-------- C:\Program Files\Common Files\BitDefender 2008-01-05 21:01 . 2008-01-09 20:46 268 --ah----- C:\sqmdata19.sqm 2008-01-05 21:01 . 2008-01-09 20:46 244 --ah----- C:\sqmnoopt19.sqm 2008-01-05 20:55 . 2008-01-09 03:08 268 --ah----- C:\sqmdata18.sqm 2008-01-05 20:55 . 2008-01-09 03:08 244 --ah----- C:\sqmnoopt18.sqm 2008-01-01 19:28 . 2007-08-08 20:02 235,008 --a------ C:\WINDOWS\UNBOC.EXE 2008-01-01 19:28 . 2007-05-08 17:01 208,896 --a------ C:\WINDOWS\CMDLIC.DLL 2008-01-01 19:28 . 2004-08-09 22:00 22,528 --a------ C:\WINDOWS\system32\wsock32.dlb 2008-01-01 18:32 . 2008-01-01 18:32 <DIR> d-------- C:\Program Files\Common Files\xing shared 2008-01-01 09:54 . 2008-01-05 21:33 244 --ah----- C:\sqmnoopt17.sqm 2008-01-01 09:54 . 2008-01-05 21:33 232 --ah----- C:\sqmdata17.sqm 2007-12-31 20:19 . 2008-01-05 21:32 244 --ah----- C:\sqmnoopt16.sqm 2007-12-31 20:19 . 2008-01-05 21:32 232 --ah----- C:\sqmdata16.sqm 2007-12-31 20:06 . 2007-12-31 20:06 <DIR> d-------- C:\Program Files\Alwil Software 2007-12-30 22:01 . 2008-01-05 21:32 244 --ah----- C:\sqmnoopt15.sqm 2007-12-30 22:01 . 2008-01-05 21:32 232 --ah----- C:\sqmdata15.sqm 2007-12-30 21:37 . 2007-12-30 21:38 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-12-30 21:26 . 2008-01-24 00:17 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-12-30 21:26 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-30 21:26 . 2007-10-04 17:10 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-30 21:26 . 2007-10-04 17:10 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-30 21:26 . 2007-10-04 17:10 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-30 21:26 . 2007-10-04 17:11 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-30 19:33 . 2008-01-24 21:05 268 --ah----- C:\sqmdata14.sqm 2007-12-30 19:33 . 2008-01-24 21:05 244 --ah----- C:\sqmnoopt14.sqm 2007-12-30 19:28 . 2008-01-24 20:45 268 --ah----- C:\sqmdata13.sqm 2007-12-30 19:28 . 2008-01-24 20:45 244 --ah----- C:\sqmnoopt13.sqm 2007-12-30 19:16 . 2008-01-24 17:48 268 --ah----- C:\sqmdata12.sqm 2007-12-30 19:16 . 2008-01-24 17:48 244 --ah----- C:\sqmnoopt12.sqm 2007-12-30 17:58 . 2008-01-23 07:28 268 --ah----- C:\sqmdata11.sqm 2007-12-30 17:58 . 2008-01-23 07:28 244 --ah----- C:\sqmnoopt11.sqm 2007-12-30 17:41 . 2007-12-30 17:41 <DIR> d-------- C:\Program Files\Enigma Software Group 2007-12-30 16:50 . 2007-12-30 16:51 1,283,174 --a------ C:\Install 2007-12-30 16:32 . 2007-12-30 19:36 1,031,499 --ahs---- C:\WINDOWS\system32\oifqonjm.ini 2007-12-30 16:11 . 2008-01-20 17:17 268 --ah----- C:\sqmdata10.sqm 2007-12-30 16:11 . 2008-01-20 17:17 244 --ah----- C:\sqmnoopt10.sqm 2007-12-30 15:17 . 2007-12-30 16:30 1,031,199 --ahs---- C:\WINDOWS\system32\jycraqnr.ini 2007-12-29 18:43 . 2008-01-17 07:01 268 --ah----- C:\sqmdata09.sqm 2007-12-29 18:43 . 2008-01-17 07:01 244 --ah----- C:\sqmnoopt09.sqm 2007-12-29 16:06 . 2008-01-15 20:37 268 --ah----- C:\sqmdata08.sqm 2007-12-29 16:06 . 2008-01-15 20:37 244 --ah----- C:\sqmnoopt08.sqm 2007-12-29 16:03 . 2007-12-30 19:36 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe 2007-12-29 15:59 . 2008-01-14 20:40 268 --ah----- C:\sqmdata07.sqm 2007-12-29 15:59 . 2008-01-14 20:40 244 --ah----- C:\sqmnoopt07.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-21 03:04 --------- d-----w C:\Program Files\SpywareBlaster 2008-01-21 02:37 --------- d-----w C:\Program Files\Viewpoint 2008-01-19 23:40 --------- d-----w C:\Program Files\Coupons 2008-01-12 02:44 --------- d-----w C:\Program Files\Best Buy Rhapsody 2008-01-10 02:22 --------- d-----w C:\Program Files\Symantec 2008-01-10 02:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-01-04 17:05 --------- d-----w C:\Program Files\iTunes 2008-01-02 01:28 --------- d-----w C:\Program Files\Comodo 2008-01-02 00:31 --------- d-----w C:\Program Files\Common Files\Real 2008-01-01 15:53 --------- d-----w C:\Program Files\QuickTime 2008-01-01 15:53 --------- d-----w C:\Program Files\PC-Doctor 5 for Windows 2007-12-31 03:23 --------- d-----w C:\Program Files\Google 2007-12-31 01:35 --------- d-----w C:\Program Files\SpywareBot 2007-12-30 01:07 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-30 01:04 --------- d-----w C:\Program Files\AIM 2007-12-30 00:39 --------- d-----w C:\Program Files\DISC 2007-12-19 04:29 --------- d-----w C:\Program Files\Common Files\AOL 2007-11-29 22:50 38,567 ----a-w C:\WINDOWS\system32\pcpbios.exe 2007-11-27 22:46 77,824 ----a-w C:\WINDOWS\system32\xcomm.dll 2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll 2007-10-29 22:35 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2007-10-27 23:40 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll 2005-09-24 07:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll 1998-11-17 17:09 24,576 ----a-w C:\WINDOWS\inf\Vizpnpin.exe 1998-10-12 17:23 40,960 ----a-w C:\WINDOWS\inf\vizPnP\Vipersti.dll 1998-07-30 18:44 19,112 ----a-w C:\WINDOWS\inf\vizPnP\Pmxscan.sys . Code: <pre> ----a-w 61,440 2007-12-31 01:45:08 C:\hp\KBD\KBD .EXE ----a-w 81,920 2007-12-29 23:00:02 C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe ----a-w 221,184 2007-12-29 23:05:09 C:\Program Files\Common Files\InstallShield\UpdateService\isuspm .exe ----a-w 180,269 2007-12-29 22:49:55 C:\Program Files\Common Files\Real\Update_OB\realsched .exe ----a-w 1,064,960 2007-12-29 22:13:47 C:\Program Files\DISC\DISCover .exe ----a-w 61,440 2007-12-29 22:13:42 C:\Program Files\DISC\DiscUpdateMgr .exe ----a-w 847,872 2007-12-31 01:03:57 C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3 .exe ----a-w 68,856 2007-12-29 22:14:48 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe ----a-w 249,856 2007-12-31 03:09:01 C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp .exe ----a-w 249,856 2007-12-31 03:09:02 C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp .exe ----a-w 49,152 2007-12-31 01:35:43 C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08 .exe ----a-w 49,152 2007-12-31 01:35:50 C:\Program Files\HP\HP Software Update\HPwuSchd2 .exe ----a-w 49,263 2007-12-31 01:35:56 C:\Program Files\Java\jre1.5.0_10\bin\jusched .exe ----a-w 368,640 2007-12-31 01:36:43 C:\Program Files\PC-Doctor 5 for Windows\PcdSmartMonitor .exe ----a-w 2,577,120 2007-12-31 01:22:24 C:\Program Files\PCPitstop\Optimize\PCPOptimize .exe ----a-w 897,752 2007-12-31 01:21:00 C:\Program Files\PCPitstop\Optimize\Reminder .exe ----a-w 282,624 2007-12-31 04:00:23 C:\Program Files\QuickTime\qttask .exe ----a-w 282,624 2007-12-31 03:09:02 C:\Program Files\QuickTime\qttask .exe ----a-w 282,624 2007-12-31 03:09:03 C:\Program Files\QuickTime\qttask .exe ----a-w 282,624 2007-12-31 03:09:03 C:\Program Files\QuickTime\qttask .exe ----a-w 282,624 2007-12-31 03:09:03 C:\Program Files\QuickTime\qttask .exe ----a-w 227,328 2007-12-31 01:35:51 C:\Program Files\scansoft\paperport\fbdirect .exe ----a-w 160,568 2007-12-30 00:48:25 C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon .exe ----a-w 90,112 2007-12-31 01:35:45 C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler .exe ----a-w 5,111,808 2007-12-31 01:36:05 C:\Program Files\SpywareBot\SpywareBot .exe ----a-w 5,724,184 2007-12-31 04:00:26 C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe ----a-w 5,724,184 2007-12-31 03:09:05 C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe ----a-w 5,724,184 2007-12-31 03:09:05 C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe ----a-w 5,724,184 2007-12-31 03:09:07 C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe ----a-w 5,724,184 2007-12-31 03:09:11 C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe ----a-w 5,724,184 2007-12-31 03:09:11 C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe ----a-w 5,724,184 2007-12-31 03:09:12 C:\Program Files\Windows Live\Messenger\MsnMsgr .Exe ----a-w 204,288 2007-12-31 01:36:06 C:\Program Files\Windows Media Player\WMPNSCFG .exe ----a-w 64,512 2007-12-31 01:35:43 C:\WINDOWS\ehome\ehtray .exe ----a-w 237,568 2007-12-31 01:35:48 C:\WINDOWS\SMINST\RECGUARD .EXE ----a-w 15,360 2007-12-31 01:36:00 C:\WINDOWS\system32\ctfmon .exe </pre> -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} {381FFDE8-2394-4F90-B10D-FC6124A40F8C} [HKEY_CLASSES_ROOT\clsid\{381ffde8-2394-4f90-b10d-fc6124a40f8c}] [HKEY_CLASSES_ROOT\BitDefender Toolbar] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-09 22:00 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-12-30 21:09 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56 64512] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-24 19:15 7311360] "nwiz"="nwiz.exe" [2006-01-24 19:15 1519616 C:\WINDOWS\system32\nwiz.exe] "PCDrProfiler"="" [] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [ ] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576] "BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 15:46 61440] "BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2007-11-16 16:37 319488] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-30 21:09 282624] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-09 22:00 53760 C:\WINDOWS\system32\narrator.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-12-30 21:16:47 124400] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624] Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-08-24 0107 36903] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL S1 bdftdif;bdftdif;C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys [2007-11-12 16:28] S1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-09-05 08:39] S3 3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df;3af54a72-c6e4-4c18-98ae-fe1c5d1ca8df;E:\CDS300\cds300.dll [] S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2007-11-12 16:27] S3 bdfsfltr;bdfsfltr;C:\WINDOWS\system32\drivers\bdfsfltr.sys [2007-08-02 16:03] S3 BDSelfPr;BDSelfPr;C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys [2008-01-21 19:55] S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [] S3 PCD5SRVC{085326CB-51A3560A-05010003};PCD5SRVC{085326CB-51A3560A-05010003} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [2005-11-21 11:27] S3 scan;BitDefender Threat Scanner;C:\WINDOWS\System32\svchost.exe [2004-08-09 22:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan . Contents of the 'Scheduled Tasks' folder "2008-01-25 03:02:01 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2008-01-22 08:53:00 C:\WINDOWS\Tasks\Disk Cleanup.job" - C:\Documents and Settings\HP_Administrator\My Documents\ppviewer.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-24 21:21:19 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-01-24 21:22:01 ComboFix-quarantined-files.txt 2008-01-25 03:21:41 . 2008-01-23 13:33:07 --- E O F ---

01-24-2008, 09:23 PM	#15 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] Please go to: VirusTotal On the page you'll find a "Browse" button. Next to the browse button you'll see a box to enter text. Please copy/paste the following: Code: C:\Program Files\PCPitstop\Optimize\Reminder .exe Then click the "Send File " button just below. This will scan the file. Please be patient. Once scanned, copy and paste the results in your next reply. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

01-25-2008, 05:32 PM	#16 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message [Moved from XP] Antivirus Version Last Update Result AhnLab-V3 2008.1.26.10 2008.01.25 - AntiVir 7.6.0.53 2008.01.25 - Authentium 4.93.8 2008.01.26 - Avast 4.7.1098.0 2008.01.25 - AVG 7.5.0.516 2008.01.25 - BitDefender 7.2 2008.01.26 - CAT-QuickHeal 9.00 2008.01.25 - ClamAV 0.91.2 2008.01.25 - DrWeb 4.44.0.09170 2008.01.25 - eSafe 7.0.15.0 2008.01.16 - eTrust-Vet 31.3.5484 2008.01.25 - Ewido 4.0 2008.01.25 - FileAdvisor 1 2008.01.26 - Fortinet 3.14.0.0 2008.01.25 - F-Prot 4.4.2.54 2008.01.25 - F-Secure 6.70.13260.0 2008.01.25 - Ikarus T3.1.1.20 2008.01.25 - Kaspersky 7.0.0.125 2008.01.25 - McAfee 5216 2008.01.26 - Microsoft 1.3109 2008.01.25 - NOD32v2 2823 2008.01.25 - Norman 5.80.02 2008.01.24 - Panda 9.0.0.4 2008.01.25 - Prevx1 V2 2008.01.26 - Rising 20.28.41.00 2008.01.25 - Sophos 4.25.0 2008.01.25 - Sunbelt 2.2.907.0 2008.01.25 - Symantec 10 2008.01.26 - TheHacker 6.2.9.198 2008.01.25 - VBA32 3.12.2.5 2008.01.21 - VirusBuster 4.3.26:9 2008.01.25 - Webwasher-Gateway 6.6.2 2008.01.25 - Additional information File size: 897752 bytes MD5: 0e2d4811b631c54e8da76dc3e50b3c72 SHA1: 25017b8334c49065ed7b7c2f4a25498483f9640a PEiD: -

01-25-2008, 06:39 PM	#18 (permalink)
heckernana Registered User Join Date: Jan 2008 Posts: 18 OS: XP	Re: Error message [Moved from XP] Thank you. I have reviewed your instructions and only have one question. Where do I go to open Hijack This to do the system scan?

01-25-2008, 06:44 PM	#19 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,179 OS: 2000 Pro; XP Pro; XP Home	Re: Error message [Moved from XP] Apparently DSS was unable to download and install HijackThis as part of it's routine. When you get to that part.... Please download HijackThis to your desktop Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless. --------------------------------------------------------------------------------------------- __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009