|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
05-18-2009, 12:18 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 25
OS: Windows Vista SP1/XP Home SP3
|
Wierd One Here
I have a few symptoms... All because I downloaded a file expecting to be an add-in for a programming language...
Just for the Info: I'm running Windows XP Home SP3, I use Google Chrome For my browser (<3) I have LogMeIn for my remote control software (In case that looks suspicious to anyone ;) ) My AntiVirus is AVG 8.5 I installed Ad-Aware to maybe check for anything I also installed Zone Alarm to help stop some outgoing stuff I also had a problem with some DLLs previously being some virus or whatever the proper term is, so I used a Live Linux CD to delete the files sine they were 'being used by windows'. So I think one of the logs still shows the dll file as there, even though it isn't... it might have been in a registry or something I Forget. Firstly, when I go to My Computer->C:\ (like double clicking on the Presario C drive) I get a:  This is because I deleted the .com's that kept appearing in the RECYCLE folder since I had a feeling they weren't supposed to be there... My AntiVirus (AVG 8.5) agrees with me. Anyway, I ran Peer Guardian, knowing it helps block IPs, and it showed a few IPs from and to a few ranges of 85.255.112.* which I later investigated to be from a Ukranian ISP. Seeing this beech of firewall, I quickly installed Zone Alarm (I wasn't using a firewall previously due to Zone Alarm giving my Computer bsod's in it's previous form). I noticed, that nearly EVERY program using the Internet is being forwarded to an 85.255.112.* IP then to it's original path. Such as, I ran CMD, and did ping google.com and got a wierd request:  If I allow the request, it pings to the correct IP. I already attempted to use some of the things described on: http://www.techspot.com/vb/all/windows/t-119159-Cannot-open-hard-drive.html But I'm still getting the First Image's error box, so I donno  .Anyway, I'm still running the GMER test so I'll get that and the other log zipped and uploaded, but here is my DDS.txt log DDS (Ver_09-05-14.01) - NTFSx86 Run by David at 21:32:25.06 on Sun 05/17/2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.269 [GMT -7:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\LogMeIn\x86\RaMaint.exe C:\Program Files\LogMeIn\x86\LogMeIn.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\HP\KBD\KBD.EXE C:\Program Files\LogMeIn\x86\LogMeInSystray.exe C:\WINDOWS\system32\WDBtnMgr.exe C:\WINDOWS\system32\hphmon04.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\WINDOWS\system32\HPHipm11.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WhatPulse\WhatPulse.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\David\Desktop\welp\new\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\david\local settings\application data\google\update\GoogleUpdate.exe" /c mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe mRun: [nwiz] nwiz.exe /install mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe" mRun: [WD Button Manager] WDBtnMgr.exe mRun: [HPHmon04] c:\windows\system32\hphmon04.exe mRun: [HPHUPD04] "c:\program files\hp photosmart 11\hphinstall\unipatch\hphupd04.exe" mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe" mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe StartupFolder: c:\docume~1\david\startm~1\programs\startup\peergu~1.lnk - c:\program files\peerguardian2\pg2.exe IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckControl.cab DPF: {26ACAE6F-BC95-44B4-9150-61E4D20D5C2E} - hxxp://www.promotionsoft.com/web-game-builder/loadgame_et.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 85.255.112.124,85.255.112.233 TCP: {B3D218E8-FDEB-4C27-865E-B4BEA0EE9ED5} = 85.255.112.124,85.255.112.233 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll Notify: avgrsstarter - avgrsstx.dll Notify: LMIinit - LMIinit.dll STS: {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - No File LSA: Notification Packages = scecli c:\windows\system32\rijebehu.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-1 325896] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-1 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-1 108552] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-2-19 55152] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856] ============== File Associations =============== regfile="regedit.exe" "%1" =============== Created Last 30 ================ 2009-05-17 21:33 20,352 a------- c:\windows\system32\dllcache\hidbatt.sys 2009-05-17 21:31 444,416 a------- c:\windows\system32\dllcache\fpcibase.sys 2009-05-17 21:30 174,464 a------- c:\windows\system32\dllcache\es198x.sys 2009-05-17 21:29 20,992 a------- c:\windows\system32\dllcache\dshowext.ax 2009-05-17 21:28 24,649 a------- c:\windows\system32\dllcache\dfe650d.sys 2009-05-17 21:27 6,656 a------- c:\windows\system32\dllcache\cmdide.sys 2009-05-17 21:26 66,082 a------- c:\windows\system32\dllcache\OLD134.tmp 2009-05-17 21:25 49,920 a------- c:\windows\system32\dllcache\atirtcap.sys 2009-05-17 21:24 66,048 a------- c:\windows\system32\dllcache\s3legacy.dll 2009-05-17 21:24 2,189,184 a------- c:\windows\system32\dllcache\OLD3C.tmp 2009-05-17 20:46 64,160 a------- c:\windows\system32\drivers\Lbd.sys 2009-05-17 20:45 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-05-17 20:44 <DIR> --d----- c:\program files\Lavasoft 2009-05-17 14:33 4,212 a---h--- c:\windows\system32\zllictbl.dat 2009-05-17 14:32 1,221,512 a------- c:\windows\system32\zpeng25.dll 2009-05-17 14:32 <DIR> --d----- c:\windows\system32\ZoneLabs 2009-05-17 14:32 <DIR> --d----- c:\program files\Zone Labs 2009-05-17 14:32 350,192 a------- c:\windows\system32\vsconfig.xml 2009-05-17 14:31 <DIR> --d----- c:\windows\Internet Logs 2009-05-17 12:18 1,033,728 a------- c:\windows\system32\dllcache\explorer.exe 2009-05-17 12:18 1,033,728 -------- c:\windows\explorer.exe 2009-05-15 21:20 860,211 a--s---- c:\windows\system32\XSIFtk-3.6.2.1.dll 2009-05-15 21:20 <DIR> --d----- c:\program files\NaturalMotion 2009-05-14 23:04 <DIR> --d----- c:\program files\NewtonSDK 2009-05-14 20:37 410,984 a------- c:\windows\system32\deploytk.dll 2009-05-14 20:37 73,728 a------- c:\windows\system32\javacpl.cpl 2009-05-09 19:37 <DIR> --d----- c:\docume~1\david\applic~1\Wings3D 2009-05-09 19:29 <DIR> --d----- c:\program files\wings3d_0.99.04a 2009-05-03 18:21 <DIR> --d----- c:\docume~1\david\applic~1\TeamViewer 2009-05-03 18:20 <DIR> --d----- c:\documents and settings\david\temp 2009-05-03 11:20 <DIR> --d----- c:\program files\fragMOTION 0.9.6 2009-05-03 11:02 <DIR> --d----- c:\docume~1\david\applic~1\MilkShape 3D 1.x.x 2009-05-03 11:02 <DIR> --d----- c:\program files\MilkShape 3D 1.8.4 2009-04-26 19:03 <DIR> --d----- c:\program files\Microsoft DirectX SDK (August 2007) 2009-04-25 20:52 <DIR> --d----- c:\program files\Dark Basic Software 2009-04-25 20:52 7,883 a------- c:\windows\Eng_UK.gpl 2009-04-25 20:52 796,672 a------- c:\windows\GPInstall.exe 2009-04-25 20:44 <DIR> --d----- c:\program files\The Game Creators 2009-04-19 16:23 765,952 a------- c:\windows\system32\xvidcore.dll 2009-04-19 16:23 180,224 a------- c:\windows\system32\xvidvfw.dll 2009-04-18 17:55 <DIR> --d----- c:\windows\system32\xlive 2009-04-18 17:49 <DIR> --d----- c:\program files\Microsoft XNA ==================== Find3M ==================== 2009-05-14 08:26 11,952 a------- c:\windows\system32\avgrsstx.dll 2009-05-14 08:26 325,896 a------- c:\windows\system32\drivers\avgldx86.sys 2009-05-14 08:26 108,552 a------- c:\windows\system32\drivers\avgtdix.sys 2009-04-26 16:33 65,332 a---h--- c:\windows\system32\mlfcache.dat 2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys 2007-02-25 20:46 22 a--sh--- c:\windows\sminst\HPCD.SYS 2008-11-30 12:16 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008113020081201\index.dat ============= FINISH: 21:40:12.93 =============== Is there still a need for a HJT log? Or not? Thanks for your time everyone! Let's hope we can get this figured out! :) |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
05-18-2009, 06:35 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: Wierd One Here
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ I need to see the other logs in order to help you. Please attach the second log from dds, Attach.txt, and the gmer log to your next reply. ------------------------------------------------------ |
|
|
|
|
05-19-2009, 12:47 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 25
OS: Windows Vista SP1/XP Home SP3
|
Re: Wierd One Here
Well, I looked through the internet, found out I had a Trojan.Flush
I read through several other places and used ComboFix to remove it. It seems to have solved my DNS and my C:\ problems. I would still post the gmer log, however it stopped, and gave no option for a log. I'll try running it again tonight and have it posted to see if there still is anything to be done. :) |
|
|
|
|
05-19-2009, 06:31 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: Wierd One Here
Hello dabberz. A reminder...
As you should have read here in Step 2 of our NEW INSTRUCTIONS thread: Why we don't ask you to run ComboFix from the onset As stated by the author of ComboFix: ComboFix is a very powerful tool which when improperly used may render your machine to a doorstop. ------------------------------------------------------ If gmer still won't run, download RootRepeal.zip to your Desktop and click 'Extract all files' to extract the compressed file to it's own folder.
Drivers
Go Start > Run and copy/paste the following into the Run box and click OK: C:\ComboFix.txt Please post ComboFix.txt here for review. ------------------------------------------------------ Don't forget to attach the Attach.txt from dds in your next reply. ------------------------------------------------------ |
|
|
|
|
05-19-2009, 08:56 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 25
OS: Windows Vista SP1/XP Home SP3
|
Re: Wierd One Here
Ok, I lost my old Attach.txt file so I'm uploading the new one. Here is my ComboFix.txt
ComboFix 09-05-17.05 - David 05/18/2009 7:42.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.391 [GMT -7:00] Running from: c:\documents and settings\David\My Documents\Downloads\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\David\Local Settings\Temporary Internet Files\fbk.sts c:\documents and settings\David\Local Settings\Temporary Internet Files\tpg.ico c:\windows\IE4 Error Log.txt c:\windows\system32\akesigup.ini d:\recycled\Warning.bmp ----- BITS: Possible infected sites ----- hxxp://www.spiralfrog.com . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF ((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 ))))))))))))))))))))))))))))))) . 2009-05-18 04:58 . 2008-04-13 23:12 116224 ----a-w c:\windows\system32\dllcache\xrxwiadr.dll 2009-05-18 04:58 . 2001-08-18 05:36 23040 ----a-w c:\windows\system32\dllcache\xrxwbtmp.dll 2009-05-18 04:58 . 2008-04-13 23:12 18944 ----a-w c:\windows\system32\dllcache\xrxscnui.dll 2009-05-18 04:58 . 2001-08-18 05:37 27648 ----a-w c:\windows\system32\dllcache\xrxftplt.exe 2009-05-18 04:58 . 2001-08-18 05:37 4608 ----a-w c:\windows\system32\dllcache\xrxflnch.exe 2009-05-18 04:58 . 2001-08-18 05:37 99865 ----a-w c:\windows\system32\dllcache\xlog.exe 2009-05-18 04:58 . 2001-08-17 19:11 16970 ----a-w c:\windows\system32\dllcache\xem336n5.sys 2009-05-18 04:58 . 2004-08-04 05:29 19455 ----a-w c:\windows\system32\dllcache\wvchntxx.sys 2009-05-18 04:57 . 2004-08-04 05:29 12063 ----a-w c:\windows\system32\dllcache\wsiintxx.sys 2009-05-18 04:57 . 2008-04-13 23:12 8192 ----a-w c:\windows\system32\dllcache\wshirda.dll 2009-05-18 04:56 . 2008-04-13 17:36 8832 ----a-w c:\windows\system32\dllcache\wmiacpi.sys 2009-05-18 04:56 . 2004-08-04 05:31 154624 ----a-w c:\windows\system32\dllcache\wlluc48.sys 2009-05-18 04:56 . 2001-08-17 19:12 34890 ----a-w c:\windows\system32\dllcache\wlandrv2.sys 2009-05-18 04:56 . 2001-08-17 20:28 771581 ----a-w c:\windows\system32\dllcache\winacisa.sys 2009-05-18 04:56 . 2001-08-18 05:36 53760 ----a-w c:\windows\system32\dllcache\wiamsmud.dll 2009-05-18 04:56 . 2001-08-17 20:28 701386 ----a-w c:\windows\system32\dllcache\wdhaalba.sys 2009-05-18 04:56 . 2004-08-04 05:29 23615 ----a-w c:\windows\system32\dllcache\wch7xxnt.sys 2009-05-18 04:56 . 2008-04-13 17:45 31744 ----a-w c:\windows\system32\dllcache\wceusbsh.sys 2009-05-18 04:56 . 2001-08-17 19:10 35871 ----a-w c:\windows\system32\dllcache\wbfirdma.sys 2009-05-18 04:54 . 2001-08-17 20:28 687999 ----a-w c:\windows\system32\dllcache\usrwdxjs.sys 2009-05-18 04:53 . 2001-08-18 05:36 69632 ----a-w c:\windows\system32\dllcache\umaxu12.dll 2009-05-18 04:52 . 2001-08-17 19:12 34375 ----a-w c:\windows\system32\dllcache\tpro4.sys 2009-05-18 04:52 . 2001-08-18 05:35 42496 ----a-w c:\windows\system32\dllcache\tp4res.dll 2009-05-18 04:52 . 2008-04-13 23:12 82944 ----a-w c:\windows\system32\dllcache\tp4mon.exe 2009-05-18 04:52 . 2001-08-18 05:36 31744 ----a-w c:\windows\system32\dllcache\tp4.dll 2009-05-18 04:52 . 2001-08-17 20:51 4992 ----a-w c:\windows\system32\dllcache\toside.sys 2009-05-18 04:52 . 2001-08-17 21:02 230912 ----a-w c:\windows\system32\dllcache\tosdvd03.sys 2009-05-18 04:52 . 2001-08-17 21:01 241664 ----a-w c:\windows\system32\dllcache\tosdvd02.sys 2009-05-18 04:52 . 2001-08-17 19:10 28232 ----a-w c:\windows\system32\dllcache\tos4mo.sys 2009-05-18 04:52 . 2001-08-17 19:14 123995 ----a-w c:\windows\system32\dllcache\tjisdn.sys 2009-05-18 04:52 . 2001-08-17 19:51 138528 ----a-w c:\windows\system32\dllcache\tgiulnt5.sys 2009-05-18 04:52 . 2001-08-17 21:56 81408 ----a-w c:\windows\system32\dllcache\tgiul50.dll 2009-05-18 04:52 . 2008-04-13 17:40 149376 ----a-w c:\windows\system32\dllcache\tffsport.sys 2009-05-18 04:50 . 2001-08-18 05:36 10240 ----a-w c:\windows\system32\dllcache\swpdflt2.dll 2009-05-18 04:50 . 2001-08-18 05:36 53760 ----a-w c:\windows\system32\dllcache\sw_wheel.dll 2009-05-18 04:50 . 2001-08-18 05:36 41472 ----a-w c:\windows\system32\dllcache\sw_effct.dll 2009-05-18 04:50 . 2001-08-18 05:36 155648 ----a-w c:\windows\system32\dllcache\stlnprop.dll 2009-05-18 04:50 . 2001-08-18 05:36 53248 ----a-w c:\windows\system32\dllcache\stlncoin.dll 2009-05-18 04:50 . 2001-08-17 19:18 285760 ----a-w c:\windows\system32\dllcache\stlnata.sys 2009-05-18 04:50 . 2001-08-17 20:51 16896 ----a-w c:\windows\system32\dllcache\stcusb.sys 2009-05-18 04:50 . 2001-08-17 19:11 48736 ----a-w c:\windows\system32\dllcache\srwlnd5.sys 2009-05-18 04:50 . 2001-08-18 05:36 99328 ----a-w c:\windows\system32\dllcache\srusd.dll 2009-05-18 04:50 . 2001-08-18 05:36 24660 ----a-w c:\windows\system32\dllcache\spxupchk.dll 2009-05-18 04:50 . 2001-08-17 20:51 61824 ----a-w c:\windows\system32\dllcache\speed.sys 2009-05-18 04:50 . 2001-08-18 05:36 106584 ----a-w c:\windows\system32\dllcache\spdports.dll 2009-05-18 04:48 . 2008-04-13 17:36 6912 ----a-w c:\windows\system32\dllcache\smbclass.sys 2009-05-18 04:47 . 2001-07-21 21:29 161568 ----a-w c:\windows\system32\dllcache\sgsmusb.sys 2009-05-18 04:46 . 2001-08-17 19:50 75392 ----a-w c:\windows\system32\dllcache\s3savmxm.sys 2009-05-18 04:45 . 2001-08-17 19:19 3840 ----a-w c:\windows\system32\dllcache\rpfun.sys 2009-05-18 04:44 . 2001-08-17 20:28 130942 ----a-w c:\windows\system32\dllcache\ptserlv.sys 2009-05-18 04:43 . 2008-04-13 23:10 211584 ----a-w c:\windows\system32\dllcache\perm2dll.dll 2009-05-18 04:42 . 2001-08-17 21:05 48000 ----a-w c:\windows\system32\dllcache\ovcam2.sys 2009-05-18 04:42 . 2001-08-17 21:05 25088 ----a-w c:\windows\system32\dllcache\ovca.sys 2009-05-18 04:42 . 2001-08-17 20:28 54186 ----a-w c:\windows\system32\dllcache\otcsercb.sys 2009-05-18 04:42 . 2001-08-17 19:12 43689 ----a-w c:\windows\system32\dllcache\otceth5.sys 2009-05-18 04:42 . 2001-08-17 19:12 27209 ----a-w c:\windows\system32\dllcache\otc06x5.sys 2009-05-18 04:42 . 2001-08-17 19:20 54528 ----a-w c:\windows\system32\dllcache\opl3sax.sys 2009-05-18 04:42 . 2001-08-17 19:50 198144 ----a-w c:\windows\system32\dllcache\nv3.sys 2009-05-18 04:42 . 2001-08-18 05:36 123776 ----a-w c:\windows\system32\dllcache\nv3.dll 2009-05-18 04:42 . 2001-08-17 19:49 51552 ----a-w c:\windows\system32\dllcache\ntgrip.sys 2009-05-18 04:42 . 2001-08-17 20:47 9344 ----a-w c:\windows\system32\dllcache\ntapm.sys 2009-05-18 04:42 . 2001-08-17 20:53 7552 ----a-w c:\windows\system32\dllcache\nsmmc.sys 2009-05-18 04:42 . 2008-04-13 17:54 28672 ----a-w c:\windows\system32\dllcache\nscirda.sys 2009-05-18 04:40 . 2001-08-17 20:49 19968 ----a-w c:\windows\system32\dllcache\mxnic.sys 2009-05-18 04:40 . 2001-08-18 05:36 19968 ----a-w c:\windows\system32\dllcache\mxicfg.dll 2009-05-18 04:40 . 2001-08-17 20:50 21888 ----a-w c:\windows\system32\dllcache\mxcard.sys 2009-05-18 04:40 . 2004-08-04 12:00 229439 ----a-w c:\windows\system32\dllcache\multibox.dll 2009-05-18 04:40 . 2001-08-17 19:50 103296 ----a-w c:\windows\system32\dllcache\mtxvideo.sys 2009-05-18 04:40 . 2008-04-13 17:46 49024 ----a-w c:\windows\system32\dllcache\mstape.sys 2009-05-18 04:40 . 2001-08-17 20:48 12416 ----a-w c:\windows\system32\dllcache\msriffwv.sys 2009-05-18 04:40 . 2001-08-17 21:00 2944 ----a-w c:\windows\system32\dllcache\msmpu401.sys 2009-05-18 04:40 . 2008-04-13 17:54 22016 ----a-w c:\windows\system32\dllcache\msircomm.sys 2009-05-18 04:40 . 2004-08-04 12:00 98304 ----a-w c:\windows\system32\dllcache\msir3jp.dll 2009-05-18 04:39 . 2001-08-17 21:02 35200 ----a-w c:\windows\system32\dllcache\msgame.sys 2009-05-18 04:39 . 2001-08-17 20:48 6016 ----a-w c:\windows\system32\dllcache\msfsio.sys 2009-05-18 04:39 . 2008-04-13 17:46 51200 ----a-w c:\windows\system32\dllcache\msdv.sys 2009-05-18 04:39 . 2001-08-17 20:52 17280 ----a-w c:\windows\system32\dllcache\mraid35x.sys 2009-05-18 04:39 . 2008-04-13 17:46 15232 ----a-w c:\windows\system32\dllcache\mpe.sys 2009-05-18 04:39 . 2001-08-17 20:57 16128 ----a-w c:\windows\system32\dllcache\modemcsa.sys 2009-05-18 04:39 . 2001-08-17 20:52 6528 ----a-w c:\windows\system32\dllcache\miniqic.sys 2009-05-18 04:39 . 2001-08-17 19:50 320384 ----a-w c:\windows\system32\dllcache\mgaum.sys 2009-05-18 04:39 . 2001-08-17 21:56 235648 ----a-w c:\windows\system32\dllcache\mgaud.dll 2009-05-18 04:39 . 2008-04-13 17:41 26112 ----a-w c:\windows\system32\dllcache\memstpci.sys 2009-05-18 04:39 . 2001-08-18 05:36 47616 ----a-w c:\windows\system32\dllcache\memgrp.dll 2009-05-18 04:37 . 2001-08-17 20:51 15744 ----a-w c:\windows\system32\dllcache\lit220p.sys 2009-05-18 04:36 . 2001-08-17 21:55 6144 ----a-w c:\windows\system32\dllcache\kbd101b.dll 2009-05-18 04:35 . 2001-08-18 05:36 372824 ----a-w c:\windows\system32\dllcache\iconf32.dll 2009-05-18 04:34 . 2008-04-13 17:41 8576 ----a-w c:\windows\system32\dllcache\i2omgmt.sys 2009-05-18 04:33 . 2001-08-17 20:52 5760 ----a-w c:\windows\system32\dllcache\hpt4qic.sys 2009-05-18 04:32 . 2001-08-17 20:28 907456 ----a-w c:\windows\system32\dllcache\hcf_msft.sys 2009-05-18 04:31 . 2001-08-17 19:14 444416 ----a-w c:\windows\system32\dllcache\fpcibase.sys 2009-05-18 04:30 . 2001-08-17 19:19 174464 ----a-w c:\windows\system32\dllcache\es198x.sys 2009-05-18 04:29 . 2001-08-17 19:20 334208 ----a-w c:\windows\system32\dllcache\ds1wdm.sys 2009-05-18 04:28 . 2001-08-17 19:11 24649 ----a-w c:\windows\system32\dllcache\dfe650d.sys 2009-05-18 04:27 . 2001-08-17 20:51 6656 ----a-w c:\windows\system32\dllcache\cmdide.sys 2009-05-18 04:26 . 2001-08-17 20:51 13824 ----a-w c:\windows\system32\dllcache\bulltlp3.sys 2009-05-18 04:25 . 2001-08-17 19:49 49920 ----a-w c:\windows\system32\dllcache\atirtcap.sys 2009-05-18 04:24 . 2001-08-17 21:56 66048 ----a-w c:\windows\system32\dllcache\s3legacy.dll 2009-05-18 03:46 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys 2009-05-18 03:45 . 2009-05-18 03:45 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F} 2009-05-18 03:44 . 2009-05-18 03:44 -------- d-----w c:\program files\Lavasoft 2009-05-18 03:44 . 2009-05-18 03:46 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft 2009-05-17 21:33 . 2009-05-17 21:33 4212 ---ha-w c:\windows\system32\zllictbl.dat 2009-05-17 21:32 . 2009-02-16 07:10 1221512 ----a-w c:\windows\system32\zpeng25.dll 2009-05-17 21:32 . 2009-05-17 21:33 -------- d-----w c:\windows\system32\ZoneLabs 2009-05-17 21:32 . 2009-05-17 21:32 -------- d-----w c:\program files\Zone Labs 2009-05-17 21:31 . 2009-05-18 14:43 -------- d-----w c:\windows\Internet Logs 2009-05-17 19:18 . 2008-04-13 17:12 1033728 ----a-w c:\windows\system32\dllcache\explorer.exe 2009-05-17 19:18 . 2008-04-13 17:12 1033728 ------w c:\windows\explorer.exe 2009-05-16 04:20 . 2002-01-01 10:28 860211 --s-a-w c:\windows\system32\XSIFtk-3.6.2.1.dll 2009-05-16 04:20 . 2009-05-16 04:20 -------- d-----w c:\program files\NaturalMotion 2009-05-15 06:04 . 2009-05-15 06:04 -------- d-----w c:\program files\NewtonSDK 2009-05-15 03:37 . 2009-05-15 03:37 410984 ----a-w c:\windows\system32\deploytk.dll 2009-05-10 02:37 . 2009-05-10 02:37 -------- d-----w c:\documents and settings\David\Application Data\Wings3D 2009-05-10 02:29 . 2009-05-10 02:29 -------- d-----w c:\program files\wings3d_0.99.04a 2009-05-07 04:58 . 2009-05-17 05:09 -------- d-----w c:\documents and settings\David\Application Data\Move Networks 2009-05-04 01:21 . 2009-05-04 01:21 -------- d-----w c:\documents and settings\David\Application Data\TeamViewer 2009-05-04 01:20 . 2009-05-04 01:20 -------- d-----w c:\documents and settings\David\temp 2009-05-03 18:20 . 2009-05-04 01:00 -------- d-----w c:\program files\fragMOTION 0.9.6 2009-05-03 18:02 . 2009-05-03 18:03 -------- d-----w c:\documents and settings\David\Application Data\MilkShape 3D 1.x.x 2009-05-03 18:02 . 2009-05-15 15:02 -------- d-----w c:\program files\MilkShape 3D 1.8.4 2009-05-01 06:27 . 2009-05-01 07:03 -------- d-----w c:\documents and settings\David\Local Settings\Application Data\WMTools Downloaded Files 2009-04-27 02:03 . 2009-04-27 02:03 -------- d-----w c:\program files\Microsoft DirectX SDK (August 2007) 2009-04-26 03:52 . 2009-04-26 03:52 -------- d-----w c:\program files\Dark Basic Software 2009-04-26 03:52 . 2009-04-26 03:52 796672 ----a-w c:\windows\GPInstall.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-18 14:49 . 2008-11-28 07:31 -------- d-----w c:\program files\PeerGuardian2 2009-05-18 14:43 . 2008-12-11 00:29 -------- d-----w c:\program files\LogMeIn 2009-05-17 21:00 . 2008-11-28 07:48 -------- d-----w c:\program files\BitTorrent 2009-05-17 04:50 . 2008-11-28 22:19 -------- d-----w c:\program files\dvdSanta 2009-05-15 03:37 . 2005-11-17 16:47 -------- d-----w c:\program files\Java 2009-05-14 15:26 . 2009-04-01 19:30 11952 ----a-w c:\windows\system32\avgrsstx.dll 2009-05-14 15:26 . 2009-04-01 19:30 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-05-14 15:26 . 2009-04-01 19:30 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-05-11 15:44 . 2008-12-06 14:07 -------- d-----w c:\program files\SpiralFrog 2009-05-01 05:40 . 2008-11-28 04:36 -------- d-----w c:\program files\mIRC 2009-04-30 05:00 . 2008-11-28 09:30 -------- d-----w c:\program files\Unreal3.2 2009-04-29 06:13 . 2009-04-17 04:46 -------- d-----w c:\program files\Image-Line 2009-04-29 06:11 . 2009-04-03 06:59 -------- d-----w c:\program files\Persona 2009-04-29 06:03 . 2009-04-17 04:51 -------- d-----w c:\program files\VstPlugins 2009-04-27 02:07 . 2005-11-17 17:05 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-26 23:33 . 2009-03-15 00:40 65332 ---ha-w c:\windows\system32\mlfcache.dat 2009-04-19 23:23 . 2008-11-28 07:42 -------- d-----w c:\program files\Xvid 2009-04-19 07:00 . 2008-11-28 03:35 82320 ----a-w c:\documents and settings\David\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-19 00:40 . 2008-11-30 23:54 -------- d-----w c:\program files\Microsoft Visual Studio 9.0 2009-04-17 18:53 . 2009-01-13 06:51 -------- d-----w c:\program files\Crayon Physics Deluxe Demo 2009-04-17 04:49 . 2009-04-17 04:49 -------- d-----w c:\program files\Outsim 2009-04-14 19:50 . 2008-11-28 07:20 -------- d-----w c:\program files\CoreFTP 2009-04-07 14:01 . 2008-11-28 05:39 -------- d-----w c:\program files\iTunes 2009-04-07 14:00 . 2009-04-07 14:00 -------- d-----w c:\program files\iPod 2009-04-07 14:00 . 2008-11-28 05:37 -------- d-----w c:\program files\Common Files\Apple 2009-04-03 18:58 . 2009-04-03 18:58 -------- d-----w c:\program files\Common Files\INCA Shared 2009-04-02 03:33 . 2009-04-02 03:33 -------- d-----w c:\program files\BitPim 2009-03-30 08:25 . 2009-03-29 19:18 -------- d-----w c:\program files\DivX 2009-03-23 00:13 . 2008-11-28 05:52 -------- d-----w c:\program files\Desktop Tray Clock 2009-03-20 16:31 . 2008-11-28 07:48 -------- d-----w c:\program files\DNA 2009-03-19 23:32 . 2005-03-08 02:52 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys 2009-02-19 17:01 . 2009-02-13 16:56 664 ----a-w c:\windows\system32\d3d9caps.dat 2007-02-26 03:46 . 2008-11-28 01:23 22 --sha-w c:\windows\SMINST\HPCD.SYS . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Google Update"="c:\documents and settings\David\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-07 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2005-05-11 253952] "LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2003-07-01 188416] "LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2003-07-01 65536] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-25 63048] "HPHmon04"="c:\windows\system32\hphmon04.exe" [2006-01-06 348160] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-04-25 1273856] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-17 1947928] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384] "MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208] "WD Button Manager"="WDBtnMgr.exe" - c:\windows\system32\WDBtnMgr.exe [2008-12-15 364544] c:\documents and settings\David\Start Menu\Programs\Startup\ PeerGuardian.lnk - c:\program files\PeerGuardian2\pg2.exe [2008-11-28 1432064] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-14 15:26 11952 ----a-w c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-10-17 04:35 87352 ----a-w c:\windows\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\BitTorrent\\bittorrent.exe"= "c:\\xampp\\mysql\\bin\\mysqld.exe"= "c:\\xampp\\apache\\bin\\apache.exe"= "c:\\php\\php.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Team_Projects\\mta_server\\MTA Server.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\xampp\\MercuryMail\\mercury.exe"= "c:\\Ntreev\\Grand Chase\\main.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Unreal3.2\\wircd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "113:TCP"= 113:TCP:IDentd R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/17/2009 8:46 PM 64160] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/1/2009 12:30 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/1/2009 12:30 PM 108552] R1 SftpDrive;SftpDrive;c:\windows\system32\drivers\SftpDrive.sys [2/25/2008 9:20 PM 293696] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/17/2009 12:23 PM 298776] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2/19/2009 4:51 PM 55152] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 PM 951632] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 7:46 PM 12856] R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [1/14/2009 6:53 PM 226656] R3 wsvad_driver;WS Audio Device;c:\windows\system32\drivers\VirtualAudio.sys [1/10/2009 6:33 PM 16896] S2 XAMPP;XAMPP Service;c:\xampp\service.exe [11/28/2008 12:12 AM 60928] S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 7:08 PM 533360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [12/10/2008 12:27 AM 11520] S4 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [12/1/2008 8:41 AM 33752] S4 VB.net Webserver;VB.net Webserver;c:\documents and settings\david\desktop\vb.net webserver\bin\vb.net webserver.exe --> c:\documents and settings\david\desktop\vb.net webserver\bin\vb.net webserver.exe [?] --- Other Services/Drivers In Memory --- *Deregistered* - pgfilter . Contents of the 'Scheduled Tasks' folder 2009-05-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06] 2009-05-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3137594904-413972030-2587899486-1012.job - c:\documents and settings\David\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-07 03:39] 2009-05-18 c:\windows\Tasks\HP Usg Login.job - c:\program files\hp photosmart 11\printer\Hphusg04.exe [2008-12-24 19:07] . - - - - ORPHANS REMOVED - - - - HKLM-Run-HPHUPD04 - c:\program files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll DPF: {26ACAE6F-BC95-44B4-9150-61E4D20D5C2E} - hxxp://www.promotionsoft.com/web-game-builder/loadgame_et.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-18 07:48 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL] "ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(916) c:\windows\system32\LMIinit.dll - - - - - - - > 'explorer.exe'(1704) c:\windows\system32\nview.dll c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll c:\program files\TortoiseSVN\bin\TortoiseStub.dll c:\program files\TortoiseSVN\bin\TortoiseSVN.dll c:\program files\TortoiseSVN\bin\intl3_tsvn.dll c:\program files\iTunes\iTunesMiniPlayer.dll c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll c:\windows\system32\SftpDriveNP.dll c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll c:\windows\system32\nvwddi.dll c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ZoneLabs\vsmon.exe c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\BCMWLTRY.EXE c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\LogMeIn\x86\ramaint.exe c:\program files\LogMeIn\x86\LogMeIn.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\program files\LogMeIn\x86\LMIGuardian.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\program files\TortoiseSVN\bin\TSVNCache.exe c:\windows\system32\wscntfy.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\rundll32.exe c:\program files\LogMeIn\x86\LMIGuardian.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\verclsid.exe . ************************************************************************** . Completion time: 2009-05-18 7:55 - machine was rebooted ComboFix-quarantined-files.txt 2009-05-18 14:54 Pre-Run: 76,215,840,768 bytes free Post-Run: 78,241,730,560 bytes free 394 --- E O F --- 2009-03-27 21:32 While I have it up, Here is my new DDS.txt too: DDS (Ver_09-05-14.01) - NTFSx86 Run by David at 23:51:46.17 on Mon 05/18/2009 Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.200 [GMT -7:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\LogMeIn\x86\RaMaint.exe C:\Program Files\LogMeIn\x86\LogMeIn.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\Explorer.EXE C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe C:\Program Files\LogMeIn\x86\LogMeInSystray.exe C:\WINDOWS\system32\WDBtnMgr.exe C:\WINDOWS\system32\hphmon04.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\LogMeIn\x86\LMIGuardian.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\HPHipm11.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WhatPulse\WhatPulse.exe C:\Program Files\mIRC\mirc.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\iTunes\iTunes.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\StarPhP\StarPhP.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\xampp\xampp-control.exe C:\xampp\apache\bin\apache.exe C:\xampp\apache\bin\apache.exe C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\David\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\david\local settings\application data\google\update\GoogleUpdate.exe" /c mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe mRun: [nwiz] nwiz.exe /install mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe" mRun: [WD Button Manager] WDBtnMgr.exe mRun: [HPHmon04] c:\windows\system32\hphmon04.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe" mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [PS2] c:\windows\system32\ps2.exe StartupFolder: c:\docume~1\david\startm~1\programs\startup\peergu~1.lnk - c:\program files\peerguardian2\pg2.exe IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckControl.cab DPF: {26ACAE6F-BC95-44B4-9150-61E4D20D5C2E} - hxxp://www.promotionsoft.com/web-game-builder/loadgame_et.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll Notify: avgrsstarter - avgrsstx.dll Notify: LMIinit - LMIinit.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-1 325896] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-1 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-1 108552] R1 SftpDrive;SftpDrive;c:\windows\system32\drivers\SftpDrive.sys [2008-2-25 293696] R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-5-17 353672] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-5-17 298776] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-2-19 55152] R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856] R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656] R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?] R3 wsvad_driver;WS Audio Device;c:\windows\system32\drivers\VirtualAudio.sys [2009-1-10 16896] S2 XAMPP;XAMPP Service;c:\xampp\service.exe [2008-11-28 60928] S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-12-10 11520] S4 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-12-1 33752] S4 VB.net Webserver;VB.net Webserver;c:\documents and settings\david\desktop\vb.net webserver\bin\vb.net webserver.exe --> c:\documents and settings\david\desktop\vb.net webserver\bin\vb.net webserver.exe [?] =============== Created Last 30 ================ 2009-05-18 07:41 161,792 a------- c:\windows\SWREG.exe 2009-05-18 07:41 98,816 a------- c:\windows\sed.exe 2009-05-17 21:58 116,224 a------- c:\windows\system32\dllcache\xrxwiadr.dll 2009-05-17 21:58 23,040 a------- c:\windows\system32\dllcache\xrxwbtmp.dll 2009-05-17 21:58 18,944 a------- c:\windows\system32\dllcache\xrxscnui.dll 2009-05-17 21:58 27,648 a------- c:\windows\system32\dllcache\xrxftplt.exe 2009-05-17 21:58 4,608 a------- c:\windows\system32\dllcache\xrxflnch.exe 2009-05-17 21:58 99,865 a------- c:\windows\system32\dllcache\xlog.exe 2009-05-17 21:58 16,970 a------- c:\windows\system32\dllcache\xem336n5.sys 2009-05-17 21:58 19,455 a------- c:\windows\system32\dllcache\wvchntxx.sys 2009-05-17 21:57 12,063 a------- c:\windows\system32\dllcache\wsiintxx.sys 2009-05-17 21:57 8,192 a------- c:\windows\system32\dllcache\wshirda.dll 2009-05-17 21:56 8,832 a------- c:\windows\system32\dllcache\wmiacpi.sys 2009-05-17 21:56 154,624 a------- c:\windows\system32\dllcache\wlluc48.sys 2009-05-17 21:56 34,890 a------- c:\windows\system32\dllcache\wlandrv2.sys 2009-05-17 21:56 771,581 a------- c:\windows\system32\dllcache\winacisa.sys 2009-05-17 21:56 53,760 a------- c:\windows\system32\dllcache\wiamsmud.dll 2009-05-17 21:56 701,386 a------- c:\windows\system32\dllcache\wdhaalba.sys 2009-05-17 21:56 23,615 a------- c:\windows\system32\dllcache\wch7xxnt.sys 2009-05-17 21:56 31,744 a------- c:\windows\system32\dllcache\wceusbsh.sys 2009-05-17 21:56 35,871 a------- c:\windows\system32\dllcache\wbfirdma.sys 2009-05-17 21:54 687,999 a------- c:\windows\system32\dllcache\usrwdxjs.sys 2009-05-17 21:53 69,632 a------- c:\windows\system32\dllcache\umaxu12.dll 2009-05-17 21:52 34,375 a------- c:\windows\system32\dllcache\tpro4.sys 2009-05-17 21:52 42,496 a------- c:\windows\system32\dllcache\tp4res.dll 2009-05-17 21:52 82,944 a------- c:\windows\system32\dllcache\tp4mon.exe 2009-05-17 21:52 31,744 a------- c:\windows\system32\dllcache\tp4.dll 2009-05-17 21:52 4,992 a------- c:\windows\system32\dllcache\toside.sys 2009-05-17 21:52 230,912 a------- c:\windows\system32\dllcache\tosdvd03.sys 2009-05-17 21:52 241,664 a------- c:\windows\system32\dllcache\tosdvd02.sys 2009-05-17 21:52 28,232 a------- c:\windows\system32\dllcache\tos4mo.sys 2009-05-17 21:52 123,995 a------- c:\windows\system32\dllcache\tjisdn.sys 2009-05-17 21:52 138,528 a------- c:\windows\system32\dllcache\tgiulnt5.sys 2009-05-17 21:52 81,408 a------- c:\windows\system32\dllcache\tgiul50.dll 2009-05-17 21:52 149,376 a------- c:\windows\system32\dllcache\tffsport.sys 2009-05-17 21:50 10,240 a------- c:\windows\system32\dllcache\swpdflt2.dll 2009-05-17 21:50 53,760 a------- c:\windows\system32\dllcache\sw_wheel.dll 2009-05-17 21:50 41,472 a------- c:\windows\system32\dllcache\sw_effct.dll 2009-05-17 21:50 155,648 a------- c:\windows\system32\dllcache\stlnprop.dll 2009-05-17 21:50 53,248 a------- c:\windows\system32\dllcache\stlncoin.dll 2009-05-17 21:50 285,760 a------- c:\windows\system32\dllcache\stlnata.sys 2009-05-17 21:50 16,896 a------- c:\windows\system32\dllcache\stcusb.sys 2009-05-17 21:50 48,736 a------- c:\windows\system32\dllcache\srwlnd5.sys 2009-05-17 21:50 99,328 a------- c:\windows\system32\dllcache\srusd.dll 2009-05-17 21:50 24,660 a------- c:\windows\system32\dllcache\spxupchk.dll 2009-05-17 21:50 61,824 a------- c:\windows\system32\dllcache\speed.sys 2009-05-17 21:50 106,584 a------- c:\windows\system32\dllcache\spdports.dll 2009-05-17 21:48 6,912 a------- c:\windows\system32\dllcache\smbclass.sys 2009-05-17 21:47 161,568 a------- c:\windows\system32\dllcache\sgsmusb.sys 2009-05-17 21:46 75,392 a------- c:\windows\system32\dllcache\s3savmxm.sys 2009-05-17 21:45 3,840 a------- c:\windows\system32\dllcache\rpfun.sys 2009-05-17 21:44 130,942 a------- c:\windows\system32\dllcache\ptserlv.sys 2009-05-17 21:43 211,584 a------- c:\windows\system32\dllcache\perm2dll.dll 2009-05-17 21:42 48,000 a------- c:\windows\system32\dllcache\ovcam2.sys 2009-05-17 21:42 25,088 a------- c:\windows\system32\dllcache\ovca.sys 2009-05-17 21:42 54,186 a------- c:\windows\system32\dllcache\otcsercb.sys 2009-05-17 21:42 43,689 a------- c:\windows\system32\dllcache\otceth5.sys 2009-05-17 21:42 27,209 a------- c:\windows\system32\dllcache\otc06x5.sys 2009-05-17 21:42 54,528 a------- c:\windows\system32\dllcache\opl3sax.sys 2009-05-17 21:42 198,144 a------- c:\windows\system32\dllcache\nv3.sys 2009-05-17 21:42 123,776 a------- c:\windows\system32\dllcache\nv3.dll 2009-05-17 21:42 51,552 a------- c:\windows\system32\dllcache\ntgrip.sys 2009-05-17 21:42 9,344 a------- c:\windows\system32\dllcache\ntapm.sys 2009-05-17 21:42 7,552 a------- c:\windows\system32\dllcache\nsmmc.sys 2009-05-17 21:42 28,672 a------- c:\windows\system32\dllcache\nscirda.sys 2009-05-17 21:40 19,968 a------- c:\windows\system32\dllcache\mxnic.sys 2009-05-17 21:40 19,968 a------- c:\windows\system32\dllcache\mxicfg.dll 2009-05-17 21:40 229,439 a------- c:\windows\system32\dllcache\multibox.dll 2009-05-17 21:40 21,888 a------- c:\windows\system32\dllcache\mxcard.sys 2009-05-17 21:40 103,296 a------- c:\windows\system32\dllcache\mtxvideo.sys 2009-05-17 21:40 49,024 a------- c:\windows\system32\dllcache\mstape.sys 2009-05-17 21:40 12,416 a------- c:\windows\system32\dllcache\msriffwv.sys 2009-05-17 21:40 2,944 a------- c:\windows\system32\dllcache\msmpu401.sys 2009-05-17 21:40 1,875,968 a------- c:\windows\system32\dllcache\msir3jp.lex 2009-05-17 21:40 22,016 a------- c:\windows\system32\dllcache\msircomm.sys 2009-05-17 21:40 98,304 a------- c:\windows\system32\dllcache\msir3jp.dll 2009-05-17 21:39 35,200 a------- c:\windows\system32\dllcache\msgame.sys 2009-05-17 21:39 6,016 a------- c:\windows\system32\dllcache\msfsio.sys 2009-05-17 21:39 56,832 a------- c:\windows\system32\dllcache\msdvbnp.ax 2009-05-17 21:39 51,200 a------- c:\windows\system32\dllcache\msdv.sys 2009-05-17 21:39 17,280 a------- c:\windows\system32\dllcache\mraid35x.sys 2009-05-17 21:39 15,232 a------- c:\windows\system32\dllcache\mpe.sys 2009-05-17 21:39 16,128 a------- c:\windows\system32\dllcache\modemcsa.sys 2009-05-17 21:39 6,528 a------- c:\windows\system32\dllcache\miniqic.sys 2009-05-17 21:39 320,384 a------- c:\windows\system32\dllcache\mgaum.sys 2009-05-17 21:39 235,648 a------- c:\windows\system32\dllcache\mgaud.dll 2009-05-17 21:39 26,112 a------- c:\windows\system32\dllcache\memstpci.sys 2009-05-17 21:39 47,616 a------- c:\windows\system32\dllcache\memgrp.dll 2009-05-17 21:37 15,744 a------- c:\windows\system32\dllcache\lit220p.sys 2009-05-17 21:36 6,144 a------- c:\windows\system32\dllcache\kbd101b.dll 2009-05-17 21:35 372,824 a------- c:\windows\system32\dllcache\iconf32.dll 2009-05-17 21:34 8,576 a------- c:\windows\system32\dllcache\i2omgmt.sys 2009-05-17 21:33 5,760 a------- c:\windows\system32\dllcache\hpt4qic.sys 2009-05-17 21:32 907,456 a------- c:\windows\system32\dllcache\hcf_msft.sys 2009-05-17 21:31 444,416 a------- c:\windows\system32\dllcache\fpcibase.sys 2009-05-17 21:30 174,464 a------- c:\windows\system32\dllcache\es198x.sys 2009-05-17 21:29 20,992 a------- c:\windows\system32\dllcache\dshowext.ax 2009-05-17 21:28 24,649 a------- c:\windows\system32\dllcache\dfe650d.sys 2009-05-17 21:27 6,656 a------- c:\windows\system32\dllcache\cmdide.sys 2009-05-17 21:26 13,824 a------- c:\windows\system32\dllcache\bulltlp3.sys 2009-05-17 21:25 49,920 a------- c:\windows\system32\dllcache\atirtcap.sys 2009-05-17 21:24 66,048 a------- c:\windows\system32\dllcache\s3legacy.dll 2009-05-17 14:33 4,212 a---h--- c:\windows\system32\zllictbl.dat 2009-05-17 14:32 1,221,512 a------- c:\windows\system32\zpeng25.dll 2009-05-17 14:32 <DIR> --d----- c:\windows\system32\ZoneLabs 2009-05-17 14:32 <DIR> --d----- c:\program files\Zone Labs 2009-05-17 14:32 350,192 a------- c:\windows\system32\vsconfig.xml 2009-05-17 14:31 <DIR> --d----- c:\windows\Internet Logs 2009-05-17 12:18 1,033,728 a------- c:\windows\system32\dllcache\explorer.exe 2009-05-17 12:18 1,033,728 -------- c:\windows\explorer.exe 2009-05-15 21:20 860,211 a--s---- c:\windows\system32\XSIFtk-3.6.2.1.dll 2009-05-14 23:04 <DIR> --d----- c:\program files\NewtonSDK 2009-05-14 20:37 410,984 a------- c:\windows\system32\deploytk.dll 2009-05-14 20:37 73,728 a------- c:\windows\system32\javacpl.cpl 2009-05-09 19:37 <DIR> --d----- c:\docume~1\david\applic~1\Wings3D 2009-05-09 19:29 <DIR> --d----- c:\program files\wings3d_0.99.04a 2009-05-03 18:21 <DIR> --d----- c:\docume~1\david\applic~1\TeamViewer 2009-05-03 18:20 <DIR> --d----- c:\documents and settings\david\temp 2009-05-03 11:20 <DIR> --d----- c:\program files\fragMOTION 0.9.6 2009-05-03 11:02 <DIR> --d----- c:\docume~1\david\applic~1\MilkShape 3D 1.x.x 2009-05-03 11:02 <DIR> --d----- c:\program files\MilkShape 3D 1.8.4 2009-04-26 19:03 <DIR> --d----- c:\program files\Microsoft DirectX SDK (August 2007) 2009-04-25 20:52 <DIR> --d----- c:\program files\Dark Basic Software 2009-04-25 20:52 7,883 a------- c:\windows\Eng_UK.gpl 2009-04-25 20:52 796,672 a------- c:\windows\GPInstall.exe 2009-04-25 20:44 <DIR> --d----- c:\program files\The Game Creators 2009-04-19 16:23 765,952 a------- c:\windows\system32\xvidcore.dll 2009-04-19 16:23 180,224 a------- c:\windows\system32\xvidvfw.dll ==================== Find3M ==================== 2009-05-14 08:26 11,952 a------- c:\windows\system32\avgrsstx.dll 2009-05-14 08:26 325,896 a------- c:\windows\system32\drivers\avgldx86.sys 2009-05-14 08:26 108,552 a------- c:\windows\system32\drivers\avgtdix.sys 2009-04-26 16:33 65,332 a---h--- c:\windows\system32\mlfcache.dat 2007-02-25 20:46 22 a--sh--- c:\windows\sminst\HPCD.SYS 2008-11-30 12:16 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008113020081201\index.dat ============= FINISH: 23:53:08.54 =============== |
|
|
|
|
05-19-2009, 10:00 AM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: Wierd One Here
Hello again, dabberz. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ I see you have P2P software ( BitTorrent ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad (don't forget to copy and paste REGEDIT4): Code:
REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000000 It should look like this:  Double-click on fix.reg and choose Yes to merge/add it to the registry. Please delete the file afterwards. ------------------------------------------------------ Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs): J2SE Runtime Environment 5.0 These are all outdated, and security risks by having them installed still. Leave this one as it has the latest definitions: Java(TM) 6 Update 13 Going forward, Java will overwrite existing installs, so removing older versions should not be required after this. When updating in the future, make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior |
|
|
|
|
05-19-2009, 04:31 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 25
OS: Windows Vista SP1/XP Home SP3
|
Re: Wierd One Here
My system seems to be running perfectly fine. If anything it might be running a tad slower, but that might be due to the added firewall. Would you still like me to run each requested step in your post above?
|
|
|
|
|
05-20-2009, 11:38 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 25
OS: Windows Vista SP1/XP Home SP3
|
Re: Wierd One Here
I ran the scan, but the Save Log As button was grayed out. I'll try running it again. And post tomorrow (I saw 1 item there I think... but the results disappeared :S ).
Oh! It isn't done running! Ok. I'll re-edit/post when it is finished :P Last edited by dabberz; 05-20-2009 at 11:39 PM. |
|
|
|
|
05-21-2009, 09:32 AM
|
#10 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 25
OS: Windows Vista SP1/XP Home SP3
|
Re: Wierd One Here
Meh I wanted to edit my last post, but I can't find the edit button again :S
Aw, it didn't save as a txt file.... oh well. Hopefully you can still read it regardless. |
|
|
|
|
05-21-2009, 10:02 AM
|
#11 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,647
OS: XP SP3
|
Re: Wierd One Here
Hello again, dabberz. System Volume Information is where Windows keeps old system restore points. They will get deleted when we uninstall ComboFix.
HPSummer2005.exe came factory installed on your recovery partition. We will leave that one alone. Go to Start > Run and copy/paste the following text into the Run box and click OK: Code:
cmd /c del /a/f/q "C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_001ac4" ------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable AVG before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
