Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads

User Tag List

Windows Update Continuously Searches for Updates

This is a discussion on Windows Update Continuously Searches for Updates within the Resolved HJT Threads forums, part of the Tech Support Forum category. I recently began experiencing a problem with Windows Updates. When doing a manual search, it searches for updates continuously and


 
 
Thread Tools Search this Thread
Old 02-27-2009, 05:02 PM   #1
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



I recently began experiencing a problem with Windows Updates. When doing a manual search, it searches for updates continuously and seems to be stuck in a loop. I have been able to work around this occasionally by stopping and starting "wuauserv" or unregistering and re-registering "msiexec". Obviously this isn't normal and I'm afraid it is interfering with automatic critical updates.

I ran a Malwarebytes scan the other night and it was clean. I've also run Panda Active Scan 2.0 recentlyand other than a couple of tracking cookies it was clean as well. I also run both Ad-Aware and Spybot S&D pretty regularly.

I'de like to rule out spyware/malware before looking for other solutions.

Here are the logs. Thanks in advance for any help that you can provide.


DDS (Ver_09-02-01.01) - NTFSx86
Run by John at 19:13:24.90 on Fri 02/27/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1452 [GMT -5:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hide My IP 2008\SecureSrv.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\John\LOCALS~1\Temp\Rar$EX00.110\gmer.exe
C:\Documents and Settings\John\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.my.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://myspace.com/
mStart Page = hxxp://myspace.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AVGTOOLBAR: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: AVGTOOLBAR: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll
TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [Creative Detector] "c:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\john\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
uPolicies-system: NoColorChoice = 0 (0x0)
uPolicies-system: NoSizeChoice = 0 (0x0)
uPolicies-system: NoVisualStyleChoice = 0 (0x0)
uPolicies-system: DisableRegedit = 0 (0x0)
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: Download Link Using Mega Manager... - c:\program files\megaupload\mega manager\mm_file.htm
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\system32\securenet.dll
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
SEH: CShellExecuteHookImpl Object: {57b86673-276a-48b2-bae7-c6dbb3020eb8} - c:\program files\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\john\applic~1\mozilla\firefox\profiles\3ndtzi57.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-3-29 12552]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-2-1 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-2-8 28544]
R1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver;c:\program files\grisoft\avg anti-spyware 7.5\guard.sys [2006-9-28 11000]
R1 AvgAsCln;AVG Anti-Spyware Clean Driver;c:\windows\system32\drivers\AvgAsCln.sys [2007-2-9 3968]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-3-29 325128]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-5-8 27656]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-3-29 107272]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-9-3 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-9-3 55024]
R2 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard;c:\program files\grisoft\avg anti-spyware 7.5\guard.exe [2006-9-28 312880]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-7 298264]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 950096]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 SecureSrv;SecureSrv;c:\program files\hide my ip 2008\SecureSrv.exe [2009-1-21 110880]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-1-25 42000]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys [2006-3-20 1452032]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-9-3 7408]
S3 SMALUSB;Digital Camera Driver;c:\windows\system32\drivers\smalidt.sys [2008-3-29 9216]
S4 Ipn280vcr;Ipn280vcr; [x]

=============== Created Last 30 ================

2009-02-27 18:16 130,337 a------- C:\getservices.zip
2009-02-25 08:48 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-22 23:12 <DIR> --d----- C:\World of Warcraft Public Test
2009-02-15 15:51 73,728 a------- c:\windows\system32\javacpl.cpl
2009-02-15 14:09 <DIR> --d----- C:\fcba8d8f314c2be87283fbc61c
2009-02-11 22:34 <DIR> --d----- c:\program files\Savage 2 - A Tortured Soul
2009-02-09 00:25 <DIR> --d----- c:\docume~1\john\applic~1\ErrorFix
2009-02-08 18:15 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2009-02-06 23:57 188,480 ac------ c:\windows\system32\dllcache\OLD156.tmp
2009-02-06 23:57 76,288 ac------ c:\windows\system32\dllcache\OLD159.tmp
2009-02-06 23:57 275,968 ac------ c:\windows\system32\dllcache\OLD153.tmp
2009-02-06 23:57 20,540 ac------ c:\windows\system32\dllcache\OLD14D.tmp
2009-02-06 23:57 16,439 ac------ c:\windows\system32\dllcache\OLD150.tmp
2009-02-06 23:57 290,816 ac------ c:\windows\system32\dllcache\OLD14A.tmp
2009-02-06 23:57 43,520 ac------ c:\windows\system32\dllcache\OLD147.tmp
2009-02-06 23:57 20,540 ac------ c:\windows\system32\dllcache\OLD141.tmp
2009-02-06 23:57 16,439 ac------ c:\windows\system32\dllcache\OLD144.tmp
2009-02-01 20:34 15,688 a------- c:\windows\system32\lsdelete.exe
2009-02-01 18:26 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-02-01 18:22 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}

==================== Find3M ====================

2009-02-15 15:50 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-11 10:19 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 10:19 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-20 15:29 31,816 a------- c:\docume~1\john\applic~1\GDIPFONTCACHEV1.DAT
2009-01-15 09:02 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-01-07 14:35 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-01-07 14:35 12,552 a------- c:\windows\system32\drivers\avgrkx86.sys
2009-01-07 14:35 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2008-12-21 16:01 5,058 a------- c:\windows\help\hhcolreg.dat
2008-12-20 18:15 826,368 a------- c:\windows\system32\wininet.dll
2007-08-15 12:46 3,751 a------- c:\docume~1\john\applic~1\perfc012.dat
2007-08-15 12:46 44,164 a------- c:\docume~1\john\applic~1\FNTCACHE.BIN
2005-09-04 12:44 774,144 a------- c:\program files\RngInterstitial.dll
2004-08-20 19:15 1,355,776 -------- c:\documents and settings\john\EverQuest.exe
2004-08-13 18:37 1,409,024 -------- c:\documents and settings\john\TestEverQuest.exe
2004-08-13 13:06 3,194,880 -------- c:\documents and settings\john\eqgame.exe
2004-08-11 01:25 1,875,968 -------- c:\documents and settings\john\EQGraphicsDX9.dll
2004-08-10 13:50 1,409,024 -------- c:\documents and settings\john\BetaEverQuest.exe
2004-08-02 08:46 1,318,912 -------- c:\documents and settings\john\eqmain.dll
2004-07-14 05:25 901,120 -------- c:\documents and settings\john\EQGfx_Dx8.dll
2004-06-22 01:16 282,624 -------- c:\documents and settings\john\OptionsEditor.exe
2003-07-15 12:02 81,920 -------- c:\documents and settings\john\Win32Bitmap.dll
2003-01-15 03:36 249,856 -------- c:\documents and settings\john\installerconfig.exe
2002-09-04 02:35 349,696 -------- c:\documents and settings\john\mss32.dll
2002-07-24 00:28 1,296 -------- c:\documents and settings\john\load2_switches.dat
2002-01-17 11:29 133,120 -------- c:\documents and settings\john\dpvs.dll
2000-10-30 16:10 81,920 -------- c:\documents and settings\john\eaxman.dll
1999-01-25 17:40 95,232 -------- c:\documents and settings\john\smackw32.dll

============= FINISH: 19:14:12.59 ===============
Attached Files
File Type: zip ark.zip (6.2 KB, 19 views)
marley07712 is offline  
Sponsored Links
Advertisement
 
Old 03-02-2009, 05:58 AM   #2
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



Hello marley07712,

Apologies for the late response.

If you still require assistance, we would like to see the latest state of your system. So, please post a fresh DDS log as it has been a while since you posted, and we'll take it from there.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Please note that the forum is very busy and if I donít hear from you in three days this thread will be closed.
__________________

amateur is offline  
Old 03-02-2009, 08:43 AM   #3
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



Thanks for the response. Here is the revised DDS log. I also attached the others if necessary.


DDS (Ver_09-02-01.01) - NTFSx86
Run by John at 10:23:38.69 on Mon 03/02/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1235 [GMT -5:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hide My IP 2008\SecureSrv.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SpywareGuard\sgmain.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\John\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.my.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://myspace.com/
mStart Page = hxxp://myspace.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\dlprotect.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: AVGTOOLBAR: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: AVGTOOLBAR: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: AOL Toolbar: {4982d40a-c53b-4615-b15b-b5b5e98d167c} - c:\program files\aol toolbar\toolbar.dll
TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [Creative Detector] "c:\program files\creative\mediasource\detector\CTDetect.exe" /R
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [P17Helper] Rundll32 P17.dll,P17Helper
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\john\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
uPolicies-system: NoColorChoice = 0 (0x0)
uPolicies-system: NoSizeChoice = 0 (0x0)
uPolicies-system: NoVisualStyleChoice = 0 (0x0)
uPolicies-system: DisableRegedit = 0 (0x0)
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: Download Link Using Mega Manager... - c:\program files\megaupload\mega manager\mm_file.htm
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\system32\securenet.dll
DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
SEH: CShellExecuteHookImpl Object: {57b86673-276a-48b2-bae7-c6dbb3020eb8} - c:\program files\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\spywareguard.dll

================= FIREFOX ===================

FF - ProfilePath -

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-3-29 12552]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-2-1 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-2-8 28544]
R1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver;c:\program files\grisoft\avg anti-spyware 7.5\guard.sys [2006-9-28 11000]
R1 AvgAsCln;AVG Anti-Spyware Clean Driver;c:\windows\system32\drivers\AvgAsCln.sys [2007-2-9 3968]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-3-29 325128]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-5-8 27656]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-3-29 107272]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-9-3 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-9-3 55024]
R2 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard;c:\program files\grisoft\avg anti-spyware 7.5\guard.exe [2006-9-28 312880]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-1-7 298264]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 950096]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 SecureSrv;SecureSrv;c:\program files\hide my ip 2008\SecureSrv.exe [2009-1-21 110880]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-1-25 42000]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys [2006-3-20 1452032]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-9-3 7408]
S3 SMALUSB;Digital Camera Driver;c:\windows\system32\drivers\smalidt.sys [2008-3-29 9216]
S4 Ipn280vcr;Ipn280vcr; [x]

=============== Created Last 30 ================

2009-02-27 18:16 130,337 a------- C:\getservices.zip
2009-02-25 08:48 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-22 23:12 <DIR> --d----- C:\World of Warcraft Public Test
2009-02-15 15:51 73,728 a------- c:\windows\system32\javacpl.cpl
2009-02-15 14:09 <DIR> --d----- C:\fcba8d8f314c2be87283fbc61c
2009-02-11 22:34 <DIR> --d----- c:\program files\Savage 2 - A Tortured Soul
2009-02-09 00:25 <DIR> --d----- c:\docume~1\john\applic~1\ErrorFix
2009-02-08 18:15 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2009-02-06 23:57 188,480 ac------ c:\windows\system32\dllcache\OLD156.tmp
2009-02-06 23:57 76,288 ac------ c:\windows\system32\dllcache\OLD159.tmp
2009-02-06 23:57 275,968 ac------ c:\windows\system32\dllcache\OLD153.tmp
2009-02-06 23:57 20,540 ac------ c:\windows\system32\dllcache\OLD14D.tmp
2009-02-06 23:57 16,439 ac------ c:\windows\system32\dllcache\OLD150.tmp
2009-02-06 23:57 290,816 ac------ c:\windows\system32\dllcache\OLD14A.tmp
2009-02-06 23:57 43,520 ac------ c:\windows\system32\dllcache\OLD147.tmp
2009-02-06 23:57 20,540 ac------ c:\windows\system32\dllcache\OLD141.tmp
2009-02-06 23:57 16,439 ac------ c:\windows\system32\dllcache\OLD144.tmp
2009-02-01 20:34 15,688 a------- c:\windows\system32\lsdelete.exe
2009-02-01 18:26 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-02-01 18:22 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}

==================== Find3M ====================

2009-02-15 15:50 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-11 10:19 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 10:19 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-20 15:29 31,816 a------- c:\docume~1\john\applic~1\GDIPFONTCACHEV1.DAT
2009-01-15 09:02 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-01-07 14:35 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-01-07 14:35 12,552 a------- c:\windows\system32\drivers\avgrkx86.sys
2009-01-07 14:35 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2008-12-21 16:01 5,058 a------- c:\windows\help\hhcolreg.dat
2008-12-20 18:15 826,368 a------- c:\windows\system32\wininet.dll
2007-08-15 12:46 3,751 a------- c:\docume~1\john\applic~1\perfc012.dat
2007-08-15 12:46 44,164 a------- c:\docume~1\john\applic~1\FNTCACHE.BIN
2005-09-04 12:44 774,144 a------- c:\program files\RngInterstitial.dll
2004-08-20 19:15 1,355,776 -------- c:\documents and settings\john\EverQuest.exe
2004-08-13 18:37 1,409,024 -------- c:\documents and settings\john\TestEverQuest.exe
2004-08-13 13:06 3,194,880 -------- c:\documents and settings\john\eqgame.exe
2004-08-11 01:25 1,875,968 -------- c:\documents and settings\john\EQGraphicsDX9.dll
2004-08-10 13:50 1,409,024 -------- c:\documents and settings\john\BetaEverQuest.exe
2004-08-02 08:46 1,318,912 -------- c:\documents and settings\john\eqmain.dll
2004-07-14 05:25 901,120 -------- c:\documents and settings\john\EQGfx_Dx8.dll
2004-06-22 01:16 282,624 -------- c:\documents and settings\john\OptionsEditor.exe
2003-07-15 12:02 81,920 -------- c:\documents and settings\john\Win32Bitmap.dll
2003-01-15 03:36 249,856 -------- c:\documents and settings\john\installerconfig.exe
2002-09-04 02:35 349,696 -------- c:\documents and settings\john\mss32.dll
2002-07-24 00:28 1,296 -------- c:\documents and settings\john\load2_switches.dat
2002-01-17 11:29 133,120 -------- c:\documents and settings\john\dpvs.dll
2000-10-30 16:10 81,920 -------- c:\documents and settings\john\eaxman.dll
1999-01-25 17:40 95,232 -------- c:\documents and settings\john\smackw32.dll

============= FINISH: 10:24:36.37 ===============
Attached Files
File Type: zip Attach.zip (6.2 KB, 24 views)
marley07712 is offline  
Sponsored Links
Advertisement
 
Old 03-02-2009, 11:06 AM   #4
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



Hi,

Before we proceed with malware cleaning, there's a couple of issues I'd like to address. Please remove the following programs via Add or Remove Programs in Control Panel:

ĶTorrent
BitTorrent
LimeWire 4.18.8
AVG Anti-Spyware 7.5
Spybot - Search & Destroy 1.5.2.20



uTorrent, BitTorrent and LimeWire are p2p programs. I would like to warn you that the nature of P2P filesharing is so that even if one is using a "clean" program, many of the files downloaded from non-documented sources have the potential of being infected. So, regardless of whether one is using a "clean" program, one may still be prone to infection by malware because more than half of all files available for download from peer-to-peer networks have been deliberately infected with some form of malware. Also by default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple, file sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. Please read this sticky:

Perils of P2P File Sharing

AVG Anti-Spyware 7.5 does not exist anymore and there's no support or update for it. It's incorporated into AVG8.

Spybot - Search & Destroy 1.5.2.20 is an old version. You can download the latest version later when we are done with the cleaning process because we don't want TeaTimer to interfere with the fixes.

===================

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

https://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.
__________________

amateur is offline  
Old 03-02-2009, 01:36 PM   #5
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



Thanks again. I uninstalled all of the programs but bittorrent from control panel as bittorrent was not listed. I deleted it manually from the program files folder after closing bittorrent.exe. Here is the combofix log.


ComboFix 09-03-02.01 - John 2009-03-02 16:19:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1490 [GMT -5:00]
Running from: c:\documents and settings\John\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\windows\patch.exe
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\open.ico

.
((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))
.

2009-02-27 18:16 . 2009-02-27 18:16 130,337 --a------ C:\getservices.zip
2009-02-27 17:40 . 2009-02-27 17:40 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-02-27 17:36 . 2009-02-27 17:52 <DIR> d-------- c:\program files\NOS
2009-02-27 17:36 . 2009-02-27 17:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2009-02-25 08:48 . 2009-01-09 14:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-22 23:12 . 2009-02-23 01:18 <DIR> d-------- C:\World of Warcraft Public Test
2009-02-15 15:51 . 2009-02-15 15:50 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-15 14:09 . 2009-02-15 14:10 <DIR> d-------- C:\fcba8d8f314c2be87283fbc61c
2009-02-11 22:34 . 2009-02-11 22:48 <DIR> d-------- c:\program files\Savage 2 - A Tortured Soul
2009-02-09 00:25 . 2009-02-09 00:25 <DIR> d-------- c:\documents and settings\John\Application Data\ErrorFix
2009-02-08 18:15 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-02-06 23:57 . 2008-04-13 19:11 290,816 --a--c--- c:\windows\system32\dllcache\OLD14A.tmp
2009-02-06 23:57 . 2008-04-13 19:09 275,968 --a--c--- c:\windows\system32\dllcache\OLD153.tmp
2009-02-06 23:57 . 2008-04-13 19:12 188,480 --a--c--- c:\windows\system32\dllcache\OLD156.tmp
2009-02-06 23:57 . 2008-04-13 19:09 76,288 --a--c--- c:\windows\system32\dllcache\OLD159.tmp
2009-02-06 23:57 . 2008-04-13 19:11 43,520 --a--c--- c:\windows\system32\dllcache\OLD147.tmp
2009-02-06 23:57 . 2008-04-13 19:11 20,540 --a--c--- c:\windows\system32\dllcache\OLD14D.tmp
2009-02-06 23:57 . 2008-04-13 19:11 20,540 --a--c--- c:\windows\system32\dllcache\OLD141.tmp
2009-02-06 23:57 . 2008-04-13 19:12 16,439 --a--c--- c:\windows\system32\dllcache\OLD150.tmp
2009-02-06 23:57 . 2008-04-13 19:12 16,439 --a--c--- c:\windows\system32\dllcache\OLD144.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-02 21:20 --------- d-----w c:\documents and settings\John\Application Data\DNA
2009-03-02 20:57 --------- d-----w c:\documents and settings\John\Application Data\BitTorrent
2009-03-02 20:27 --------- d-----w c:\program files\Warcraft III
2009-03-02 18:19 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-28 12:20 --------- d-----w c:\program files\DNA
2009-02-27 22:40 --------- d-----w c:\program files\Common Files\Adobe
2009-02-27 20:03 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-23 04:35 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2009-02-21 19:46 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-21 15:51 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-19 06:23 --------- d-----w c:\program files\World of Warcraft
2009-02-16 03:37 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-15 20:50 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-01 23:26 64,160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-02-01 23:26 15,688 ----a-w c:\windows\system32\lsdelete.exe
2009-02-01 23:22 --------- dc-h--w c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-01 23:22 --------- d-----w c:\program files\Lavasoft
2009-02-01 23:22 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-30 19:54 --------- d-----w c:\program files\SpywareGuard
2009-01-21 05:34 --------- d-----w c:\program files\Hide My IP 2008
2009-01-20 20:29 31,816 ----a-w c:\documents and settings\John\Application Data\GDIPFONTCACHEV1.DAT
2009-01-20 20:27 --------- d-----w c:\program files\MSECache
2009-01-15 14:02 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-11 08:42 --------- d-----w c:\documents and settings\John\Application Data\mIRC
2009-01-11 07:44 --------- d-----w c:\program files\mIRC
2009-01-10 19:07 --------- d-----w c:\program files\RegistryFix7
2009-01-07 19:35 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-01-07 19:35 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-01-07 19:35 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-01-07 19:35 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
2007-11-21 14:15 0 ----a-w c:\documents and settings\Patrick\Application Data\FNTCACHE.BIN
2007-08-15 17:46 44,164 ----a-w c:\documents and settings\John\Application Data\FNTCACHE.BIN
2007-08-15 17:46 3,751 ----a-w c:\documents and settings\John\Application Data\perfc012.dat
2007-08-01 00:38 14,472 ----a-w c:\documents and settings\Ashley\Application Data\perfc012.dat
2007-08-01 00:38 1,939 ----a-w c:\documents and settings\Ashley\Application Data\FNTCACHE.BIN
2005-09-04 17:44 774,144 ----a-w c:\program files\RngInterstitial.dll
2005-04-15 12:55 2,932,008 ------w c:\documents and settings\Patrick\sysclean.com
2004-08-21 00:15 1,355,776 ------w c:\documents and settings\John\EverQuest.exe
2004-08-13 23:37 1,409,024 ------w c:\documents and settings\John\TestEverQuest.exe
2004-08-13 18:06 3,194,880 ------w c:\documents and settings\John\eqgame.exe
2004-08-11 06:25 1,875,968 ------w c:\documents and settings\John\EQGraphicsDX9.dll
2004-08-10 18:50 1,409,024 ------w c:\documents and settings\John\BetaEverQuest.exe
2004-08-02 13:46 1,318,912 ------w c:\documents and settings\John\eqmain.dll
2004-07-14 10:25 901,120 ------w c:\documents and settings\John\EQGfx_Dx8.dll
2004-06-22 06:16 282,624 ------w c:\documents and settings\John\OptionsEditor.exe
2003-07-15 17:02 81,920 ------w c:\documents and settings\John\Win32Bitmap.dll
2003-01-15 08:36 249,856 ------w c:\documents and settings\John\installerconfig.exe
2002-09-04 07:35 349,696 ------w c:\documents and settings\John\mss32.dll
2002-07-24 05:28 1,296 ------w c:\documents and settings\John\load2_switches.dat
2002-01-17 16:29 133,120 ------w c:\documents and settings\John\dpvs.dll
2000-10-30 21:10 81,920 ------w c:\documents and settings\John\eaxman.dll
1999-01-25 22:40 95,232 ------w c:\documents and settings\John\smackw32.dll
2009-01-27 00:12 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2009-01-27 00:12 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2009-01-27 00:12 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2009-01-27 00:12 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2009-01-27 00:12 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 68856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-02-22 342848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-07 1601304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-11-20 178688]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-01 509784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"P17Helper"="P17.dll" [2005-05-03 c:\windows\system32\P17.dll]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

c:\documents and settings\John\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 15:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-07 14:35 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^John^Start Menu^Programs^Startup^Xfire.lnk]
backup=c:\windows\pss\Xfire.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gcasServ
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
--------- 2006-08-01 14:35 67112 c:\program files\AIM\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-06-12 15:47 50528 c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
--------- 2005-07-12 00:17 50776 c:\program files\America Online 9.0\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
-ra------ 2006-10-23 07:50 71216 c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-09-25 19:52 50736 c:\program files\Common Files\AOL\1124337897\EE\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--------- 2004-05-06 14:58 172032 c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe]
--a------ 2007-03-05 16:57 1103480 c:\program files\Download Manager\DLM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
--a------ 2007-08-31 12:01 1037736 c:\program files\Microsoft IntelliPoint\ipoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--------- 2005-10-12 17:13 7086080 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-09-17 22:55 13574144 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-09-17 22:55 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--------- 2005-08-17 23:06 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--------- 2009-01-26 15:31 2144088 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-02-15 15:50 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-09-03 13:07 1576176 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-12 12:00 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-09-17 22:55 1657376 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-11-15 05:20 77824 c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ACDaemon"=2 (0x2)
"CiSvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1124337897\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\1124337897\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\StubInstaller.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Nexon\\MapleStory\\Patcher.exe"=
"c:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Nexon\\MapleStory\\MapleStory.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Nexon\\Combat Arms\\NMService.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.1-to-3.0.2-enUS-Win-Update-downloader.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\CyberStep\\SplashFighters\\amped.exe"=
"c:\\Program Files\\Savage 2 - A Tortured Soul\\savage2.exe"=
"c:\\World of Warcraft Public Test\\Launcher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"47803:TCP"= 47803:TCP:null
"46854:TCP"= 46854:TCP:null
"26238:TCP"= 26238:TCP:BitComet 26238 TCP
"26238:UDP"= 26238:UDP:BitComet 26238 UDP
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager
"62488:TCP"= 62488:TCP:null
"6113:TCP"= 6113:TCP:Warcraft III Battle.net
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"39381:TCP"= 39381:TCP:*:Disabled:SolidNetworkManager
"39381:UDP"= 39381:UDP:*:Disabled:SolidNetworkManager
"37020:TCP"= 37020:TCP:*:Disabled:SolidNetworkManager
"37020:UDP"= 37020:UDP:*:Disabled:SolidNetworkManager

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-03-29 12552]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-01 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-08 28544]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-03-29 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-03-29 107272]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-09-03 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-09-03 55024]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-07 298264]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SecureSrv;SecureSrv;c:\program files\Hide My IP 2008\SecureSrv.exe [2009-01-21 110880]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-01-25 42000]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys [2006-03-20 1452032]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]
S3 SMALUSB;Digital Camera Driver;c:\windows\system32\drivers\smalidt.sys [2008-03-29 9216]
S4 Ipn280vcr;Ipn280vcr; [x]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25a1aa88-d187-11dd-945b-00038a000015}]
\Shell\AutoRun\command - f:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - f:\system\viewer\FlipVideoforPC.exe
.
Contents of the 'Scheduled Tasks' folder

2009-03-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-01 18:26]

2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-21 c:\windows\Tasks\EasyShare Registration Task.job
- c:\docume~1\ALLUSE~1\APPLIC~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.9.30.1.sxt [email protected] []

2009-03-02 c:\windows\Tasks\ErrorFix Scan.job
- c:\program files\ErrorFix\ErrorFix.exe []

2009-03-02 c:\windows\Tasks\ErrorFix Scan.job
- c:\program files\ErrorFix []

2009-03-02 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.my.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://myspace.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
LSP: c:\windows\system32\securenet.dll
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2009-03-02 16:21:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(712)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'lsass.exe'(768)
c:\windows\system32\securenet.dll
.
Completion time: 2009-03-02 16:24:18
ComboFix-quarantined-files.txt 2009-03-02 21:24:16
ComboFix2.txt 2007-05-01 19:40:42

Pre-Run: 79,280,578,560 bytes free
Post-Run: 79,264,432,128 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

338 --- E O F --- 2009-02-27 00:19:17
marley07712 is offline  
Old 03-02-2009, 04:28 PM   #6
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



Hi,

I would recommend that you remove ErrorFix via Add or Remove Programs in Control Panel, if you haven't already. We don't recommend the use of such tools.

Here is a good link about the registry cleaners and boosters by our colleague, Miekiemoes:

https://miekiemoes.blogspot.com/2008/...eaking_13.html

and another one by Bill Castner:

https://aumha.net/viewtopic.php?t=28099

=============================
  • Open notepad (Start>All programs>accessories>notepad ) (It must be notepad, not wordpad, or it won't work)
  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as CFScript.txt
  • Change the Save as Type to All Files
  • and Save it on the desktop
  • Click Format and ensure Wordwrap is unchecked.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Code:
DirLook::
C:\fcba8d8f314c2be87283fbc61c

File::
c:\windows\system32\dllcache\OLD14A.tmp
c:\windows\system32\dllcache\OLD153.tmp
c:\windows\system32\dllcache\OLD156.tmp
c:\windows\system32\dllcache\OLD159.tmp
c:\windows\system32\dllcache\OLD147.tmp
c:\windows\system32\dllcache\OLD14D.tmp
c:\windows\system32\dllcache\OLD141.tmp
c:\windows\system32\dllcache\OLD150.tmp
c:\windows\system32\dllcache\OLD144.tmp
c:\windows\Tasks\ErrorFix Scan.job

Folder::
c:\documents and settings\John\Application Data\ErrorFix
c:\documents and settings\John\Application Data\DNA
c:\documents and settings\John\Application Data\BitTorrent
c:\program files\ErrorFix
c:\program files\DNA

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=-
"BitTorrent DNA"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Network Associates Error Reporting Service]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\DNA\\btdna.exe"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26238:TCP"=-
"26238:UDP"=-

Driver::
Ipn280vcr
Save this as CFScript.txt, in the same location as ComboFix.exe



Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

=============================

Perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner

**Note**

To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan.
Click Accept, when prompted to download and install the program files and database of malware definitions.
  • Click Run at the Security prompt.
  • The program will then begin downloading and installing and will also update the database.
  • Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
  • Click the Save Report As... button.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

=============================

Please post back the Kaspersky report and the Combofix.txt. Also, let me know how things are now.
__________________

amateur is offline  
Old 03-03-2009, 06:22 PM   #7
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



Thanks amateur. Sorry for the delay. I know the instructions say not to be worried but the two WMA.GetCodec.v make me very nervous but I will leave them alone until seeing your instructions.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, March 3, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, March 03, 2009 22:54:45
Records in database: 1866576
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 154931
Threat name: 3
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 02:29:45


File name / Threat name / Threats count
C:\Documents and Settings\John\.housecall6.6\Quarantine\lphc3ucj0ee2n.exe.bac_a05256 Infected: Trojan-Downloader.Win32.Small.abge 1
C:\Documents and Settings\John\.housecall6.6\Quarantine\lphc3ucj0ee2n.exe.bac_a05256 Infected: Trojan-Downloader.Win32.Small.ajgs 1
C:\Documents and Settings\John\My Documents\LimeWire\Saved\keep customer satisfied simon HIT TOP50.mp3 Infected: Trojan-Downloader.WMA.GetCodec.v 1
C:\Documents and Settings\John\My Documents\LimeWire\Saved\keep customer satisfied simon-HQ.mp3 Infected: Trojan-Downloader.WMA.GetCodec.v 1

The selected area was scanned.


And the combofix log:

ComboFix 09-03-02.01 - John 2009-03-02 20:03:14.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1473 [GMT -5:00]
Running from: c:\documents and settings\John\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\John\Desktop\CFScript.txt
AV: AVG Internet Security *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\dllcache\OLD141.tmp
c:\windows\system32\dllcache\OLD144.tmp
c:\windows\system32\dllcache\OLD147.tmp
c:\windows\system32\dllcache\OLD14A.tmp
c:\windows\system32\dllcache\OLD14D.tmp
c:\windows\system32\dllcache\OLD150.tmp
c:\windows\system32\dllcache\OLD153.tmp
c:\windows\system32\dllcache\OLD156.tmp
c:\windows\system32\dllcache\OLD159.tmp
c:\windows\Tasks\ErrorFix Scan.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\John\Application Data\BitTorrent
c:\documents and settings\John\Application Data\BitTorrent\dht.dat
c:\documents and settings\John\Application Data\BitTorrent\dht.dat.old
c:\documents and settings\John\Application Data\BitTorrent\maplestory.1.torrent
c:\documents and settings\John\Application Data\BitTorrent\maplestory.2.torrent
c:\documents and settings\John\Application Data\BitTorrent\MapleStory.3.torrent
c:\documents and settings\John\Application Data\BitTorrent\maplestory.torrent
c:\documents and settings\John\Application Data\BitTorrent\Mayday Parade - A Lesson In Romantics.torrent
c:\documents and settings\John\Application Data\BitTorrent\resume.dat
c:\documents and settings\John\Application Data\BitTorrent\resume.dat.old
c:\documents and settings\John\Application Data\BitTorrent\rss.dat
c:\documents and settings\John\Application Data\BitTorrent\settings.dat
c:\documents and settings\John\Application Data\BitTorrent\settings.dat.old
c:\documents and settings\John\Application Data\DNA
c:\documents and settings\John\Application Data\DNA\dht.dat
c:\documents and settings\John\Application Data\DNA\dht.dat.old
c:\documents and settings\John\Application Data\DNA\dna.lng
c:\documents and settings\John\Application Data\DNA\resume.dat
c:\documents and settings\John\Application Data\DNA\resume.dat.old
c:\documents and settings\John\Application Data\DNA\rss.dat
c:\documents and settings\John\Application Data\DNA\rss.dat.old
c:\documents and settings\John\Application Data\DNA\settings.dat
c:\documents and settings\John\Application Data\DNA\settings.dat.old
c:\documents and settings\John\Application Data\ErrorFix
c:\documents and settings\John\Application Data\ErrorFix\Logs\2009-02-09 00-25-440.log
c:\program files\DNA
c:\program files\DNA\btdna.exe
c:\program files\DNA\DNAcpl.cpl
c:\program files\DNA\plugins\npbtdna.dll
c:\windows\system32\dllcache\OLD141.tmp
c:\windows\system32\dllcache\OLD144.tmp
c:\windows\system32\dllcache\OLD147.tmp
c:\windows\system32\dllcache\OLD14A.tmp
c:\windows\system32\dllcache\OLD14D.tmp
c:\windows\system32\dllcache\OLD150.tmp
c:\windows\system32\dllcache\OLD153.tmp
c:\windows\system32\dllcache\OLD156.tmp
c:\windows\system32\dllcache\OLD159.tmp
c:\windows\Tasks\ErrorFix Scan.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Ipn280vcr


((((((((((((((((((((((((( Files Created from 2009-02-03 to 2009-03-03 )))))))))))))))))))))))))))))))
.

2009-02-27 18:16 . 2009-02-27 18:16 130,337 --a------ C:\getservices.zip
2009-02-27 17:40 . 2009-02-27 17:40 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-02-27 17:36 . 2009-02-27 17:52 <DIR> d-------- c:\program files\NOS
2009-02-27 17:36 . 2009-02-27 17:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2009-02-25 08:48 . 2009-01-09 14:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-22 23:12 . 2009-02-23 01:18 <DIR> d-------- C:\World of Warcraft Public Test
2009-02-15 15:51 . 2009-02-15 15:50 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-15 14:09 . 2009-02-15 14:10 <DIR> d-------- C:\fcba8d8f314c2be87283fbc61c
2009-02-11 22:34 . 2009-02-11 22:48 <DIR> d-------- c:\program files\Savage 2 - A Tortured Soul
2009-02-08 18:15 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-03 00:55 --------- d-----w c:\program files\RegistryFix7
2009-03-02 20:27 --------- d-----w c:\program files\Warcraft III
2009-03-02 18:19 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-27 22:40 --------- d-----w c:\program files\Common Files\Adobe
2009-02-27 20:03 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-23 04:35 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2009-02-21 19:46 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-21 15:51 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-19 06:23 --------- d-----w c:\program files\World of Warcraft
2009-02-16 03:37 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-01 23:26 64,160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-02-01 23:22 --------- dc-h--w c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-01 23:22 --------- d-----w c:\program files\Lavasoft
2009-02-01 23:22 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-30 19:54 --------- d-----w c:\program files\SpywareGuard
2009-01-21 05:34 --------- d-----w c:\program files\Hide My IP 2008
2009-01-20 20:29 31,816 ----a-w c:\documents and settings\John\Application Data\GDIPFONTCACHEV1.DAT
2009-01-20 20:27 --------- d-----w c:\program files\MSECache
2009-01-15 14:02 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-11 08:42 --------- d-----w c:\documents and settings\John\Application Data\mIRC
2009-01-11 07:44 --------- d-----w c:\program files\mIRC
2009-01-07 19:35 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-01-07 19:35 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-01-07 19:35 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2007-11-21 14:15 0 ----a-w c:\documents and settings\Patrick\Application Data\FNTCACHE.BIN
2007-08-15 17:46 44,164 ----a-w c:\documents and settings\John\Application Data\FNTCACHE.BIN
2007-08-15 17:46 3,751 ----a-w c:\documents and settings\John\Application Data\perfc012.dat
2007-08-01 00:38 14,472 ----a-w c:\documents and settings\Ashley\Application Data\perfc012.dat
2007-08-01 00:38 1,939 ----a-w c:\documents and settings\Ashley\Application Data\FNTCACHE.BIN
2005-09-04 17:44 774,144 ----a-w c:\program files\RngInterstitial.dll
2005-04-15 12:55 2,932,008 ------w c:\documents and settings\Patrick\sysclean.com
2004-08-21 00:15 1,355,776 ------w c:\documents and settings\John\EverQuest.exe
2004-08-13 23:37 1,409,024 ------w c:\documents and settings\John\TestEverQuest.exe
2004-08-13 18:06 3,194,880 ------w c:\documents and settings\John\eqgame.exe
2004-08-11 06:25 1,875,968 ------w c:\documents and settings\John\EQGraphicsDX9.dll
2004-08-10 18:50 1,409,024 ------w c:\documents and settings\John\BetaEverQuest.exe
2004-08-02 13:46 1,318,912 ------w c:\documents and settings\John\eqmain.dll
2004-07-14 10:25 901,120 ------w c:\documents and settings\John\EQGfx_Dx8.dll
2004-06-22 06:16 282,624 ------w c:\documents and settings\John\OptionsEditor.exe
2003-07-15 17:02 81,920 ------w c:\documents and settings\John\Win32Bitmap.dll
2003-01-15 08:36 249,856 ------w c:\documents and settings\John\installerconfig.exe
2002-09-04 07:35 349,696 ------w c:\documents and settings\John\mss32.dll
2002-07-24 05:28 1,296 ------w c:\documents and settings\John\load2_switches.dat
2002-01-17 16:29 133,120 ------w c:\documents and settings\John\dpvs.dll
2000-10-30 21:10 81,920 ------w c:\documents and settings\John\eaxman.dll
1999-01-25 22:40 95,232 ------w c:\documents and settings\John\smackw32.dll
2009-01-27 00:12 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2009-01-27 00:12 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2009-01-27 00:12 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2009-01-27 00:12 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2009-01-27 00:12 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\fcba8d8f314c2be87283fbc61c ----

2008-07-06 17:36 2936832 --------- c:\fcba8d8f314c2be87283fbc61c\amd64\xpssvcs.dll
2008-07-06 07:06 89088 --------- c:\fcba8d8f314c2be87283fbc61c\i386\filterpipelineprintproc.dll
2008-07-06 07:06 765440 --------- c:\fcba8d8f314c2be87283fbc61c\i386\mxdwdrv.dll
2008-07-06 07:06 748032 --------- c:\fcba8d8f314c2be87283fbc61c\amd64\mxdwdrv.dll
2008-07-06 07:06 1676288 --------- c:\fcba8d8f314c2be87283fbc61c\i386\xpssvcs.dll
2008-07-06 07:06 147456 --------- c:\fcba8d8f314c2be87283fbc61c\amd64\filterpipelineprintproc.dll
2008-07-06 07:06 10929 --------- c:\fcba8d8f314c2be87283fbc61c\i386\msxpsdrv.cat
2008-07-06 07:06 10929 --------- c:\fcba8d8f314c2be87283fbc61c\amd64\msxpsdrv.cat
2008-06-19 11:03 73 --------- c:\fcba8d8f314c2be87283fbc61c\i386\msxpsinc.gpd
2008-06-19 11:03 73 --------- c:\fcba8d8f314c2be87283fbc61c\amd64\msxpsinc.gpd
2008-06-19 00:33 72 --------- c:\fcba8d8f314c2be87283fbc61c\i386\msxpsinc.ppd
2008-06-19 00:33 72 --------- c:\fcba8d8f314c2be87283fbc61c\amd64\msxpsinc.ppd
2008-06-19 00:33 2204 --------- c:\fcba8d8f314c2be87283fbc61c\i386\msxpsdrv.inf
2008-06-19 00:33 2204 --------- c:\fcba8d8f314c2be87283fbc61c\amd64\msxpsdrv.inf


((((((((((((((((((((((((((((( [email protected]_16.22.18.79 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 01:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-02-27 22:36:29 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-03-02 21:54:00 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-02-27 22:36:29 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-03-02 21:54:00 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-02-27 22:36:29 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-02 21:54:00 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-03 01:07:20 16,384 ----atw c:\windows\temp\Perflib_Perfdata_274.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-07 1601304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-11-20 178688]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-01 509784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"P17Helper"="P17.dll" [2005-05-03 c:\windows\system32\P17.dll]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

c:\documents and settings\John\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 15:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-07 14:35 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^John^Start Menu^Programs^Startup^Xfire.lnk]
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
--------- 2006-08-01 14:35 67112 c:\program files\AIM\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2008-06-12 15:47 50528 c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
--------- 2005-07-12 00:17 50776 c:\program files\America Online 9.0\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
-ra------ 2006-10-23 07:50 71216 c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-09-25 19:52 50736 c:\program files\Common Files\AOL\1124337897\EE\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--------- 2004-05-06 14:58 172032 c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe]
--a------ 2007-03-05 16:57 1103480 c:\program files\Download Manager\DLM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
--a------ 2007-08-31 12:01 1037736 c:\program files\Microsoft IntelliPoint\ipoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--------- 2005-10-12 17:13 7086080 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--------- 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-09-17 22:55 13574144 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-09-17 22:55 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--------- 2005-08-17 23:06 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-02-15 15:50 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-09-03 13:07 1576176 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-12 12:00 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-09-17 22:55 1657376 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2004-11-15 05:20 77824 c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ACDaemon"=2 (0x2)
"CiSvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1124337897\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\1124337897\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\StubInstaller.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Nexon\\MapleStory\\Patcher.exe"=
"c:\\Program Files\\World of Warcraft\\Repair.exe"=
"c:\\Nexon\\MapleStory\\MapleStory.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Nexon\\Combat Arms\\NMService.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.1-to-3.0.2-enUS-Win-Update-downloader.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\CyberStep\\SplashFighters\\amped.exe"=
"c:\\Program Files\\Savage 2 - A Tortured Soul\\savage2.exe"=
"c:\\World of Warcraft Public Test\\Launcher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"47803:TCP"= 47803:TCP:null
"46854:TCP"= 46854:TCP:null
"9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager
"62488:TCP"= 62488:TCP:null
"6113:TCP"= 6113:TCP:Warcraft III Battle.net
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"39381:TCP"= 39381:TCP:*:Disabled:SolidNetworkManager
"39381:UDP"= 39381:UDP:*:Disabled:SolidNetworkManager
"37020:TCP"= 37020:TCP:*:Disabled:SolidNetworkManager
"37020:UDP"= 37020:UDP:*:Disabled:SolidNetworkManager

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-03-29 12552]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-01 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-08 28544]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-03-29 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-03-29 107272]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-09-03 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-09-03 55024]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-07 298264]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R3 SecureSrv;SecureSrv;c:\program files\Hide My IP 2008\SecureSrv.exe [2009-01-21 110880]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-01-25 42000]
S3 p17filt;p17filt;c:\windows\system32\drivers\p17filt.sys [2006-03-20 1452032]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]
S3 SMALUSB;Digital Camera Driver;c:\windows\system32\drivers\smalidt.sys [2008-03-29 9216]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{25a1aa88-d187-11dd-945b-00038a000015}]
\Shell\AutoRun\command - f:\system\viewer\FlipVideoforPC.exe
\Shell\Flip Video for PC\command - f:\system\viewer\FlipVideoforPC.exe
.
Contents of the 'Scheduled Tasks' folder

2009-03-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-01 18:26]

2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-21 c:\windows\Tasks\EasyShare Registration Task.job
- c:\docume~1\ALLUSE~1\APPLIC~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.9.30.1.sxt [email protected] []

2009-03-03 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.my.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://myspace.com/
mStart Page = hxxp://myspace.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Download Link Using Mega Manager... - c:\program files\Megaupload\Mega Manager\mm_file.htm
LSP: c:\windows\system32\securenet.dll
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2009-03-02 20:07:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'lsass.exe'(780)
c:\windows\system32\securenet.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\searchindexer.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\rundll32.exe
c:\program files\Microsoft IntelliType Pro\dpupdchk.exe
c:\program files\SpywareGuard\sgbhp.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-03-02 20:15:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-03 01:15:00
ComboFix2.txt 2009-03-02 21:24:20
ComboFix3.txt 2007-05-01 19:40:42

Pre-Run: 79,238,270,976 bytes free
Post-Run: 79,107,874,816 bytes free

404 --- E O F --- 2009-02-27 00:19:17
marley07712 is offline  
Old 03-03-2009, 06:43 PM   #8
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



Hi,

Looks like a couple of mp3 files downloaded via LimeWire are infected. You can locate and delete them, using Windows explorer (right click on Start, click on Explore):

C:\Documents and Settings\John\My Documents\LimeWire\Saved\keep customer satisfied simon HIT TOP50.mp3
C:\Documents and Settings\John\My Documents\LimeWire\Saved\keep customer satisfied simon-HQ.mp3

You can delete the contents of the following folder where the other two infected files are:
C:\Documents and Settings\John\.housecall6.6\Quarantine

How is the computer running now?
__________________

amateur is offline  
Old 03-03-2009, 06:54 PM   #9
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



Thanks. I deleted the files. The computer is running okay but the windows update issue still exists (it does not locate updates -- just keeps looping). Is that an issue for the XP forum at this point?
marley07712 is offline  
Old 03-03-2009, 07:04 PM   #10
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



See if this helps:
  1. Download Dial-A-Fix from one of the following mirrors:
  2. Extract the zip file to your desktop.
  3. Double click Dial-a-Fix.exe to start the program.
  4. Press the green double checkmark box (Looks like this: )
  5. UNcheck "Empty Temp Folders", as well as "Adjust Time/Date" in the prep section. The prep section should then look like this:
  6. When the window looks like this, press the GO button in the bottom of the window.
  7. Wait for the program to repair window's internals.
  8. Exit/Close Dial-A-Fix

Restart and see if Windows updates.
__________________

amateur is offline  
Old 03-04-2009, 03:13 PM   #11
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



amateur,

I do appreciate the help -- unfortunately the last fix did not work. I ran WU this morning and it was hanging when I got home from work.

I did save the text file that was sent with the Microsoft Error Report, I don't know if that would help you or not.

Again, I'm just concerned that auto updates will misss critical updates.

Thanks again.
marley07712 is offline  
Old 03-04-2009, 03:49 PM   #12
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



Quote:
I did save the text file that was sent with the Microsoft Error Report, I don't know if that would help you or not.
Hopefully they'll contact you. In the mean time, yes I would like to see the report.

I suppose you've checked that your firewall is not blocking it. How do you go about updating, Internet Explorer>Tools>Windows Update?

Let's also try this:

1. Click Start->Run, type "services.msc" (without quotation marks) in the
open box and click OK.

2. Double click the service "Background Intelligent Transfer Service".

3. Click on the Log On tab, please ensure the option "Local System account"
is selected and the option "Allow service to interact with desktop" is
unchecked.

4. Check if this service has been enabled on the listed Hardware Profile.
If not, please click the Enable button to enable it.
5. Click on the "General" tab; make sure the "Startup Type" is "Automatic"
or "Manual". Then please click the button "Start" under "Service Status" to
start the service.

6. Please repeat the above steps with another service:

Automatic Updates

If that doesn't work, try cleaning up Windows Update temporary folder and see if that helps:

1. Click Start, Run, type: cmd and press Enter. Please run the following command in the opened window.

Net stop WuAuServ

2. Click Start, Run, type: %windir% and press Enter.

3. In the opened folder, rename the folder SoftwareDistribution to Sdold.

4. Click Start, Run, type: cmd and press Enter. Please run the following
command in the opened window.

Net start WuAuServ
__________________

amateur is offline  
Old 03-04-2009, 05:26 PM   #13
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



I did check that my router firewall was not causing the problem but I didn't suspect this because it wasn't a problem before.

In steps 1-6 everything was already according to your instructions.

The Windows Update was sucessful atfer executing the WuAuServ fix. But I then ran it a second time and the issue was back.

So I executed it again and it was unsuccesful. I was hoping that I would just need to execute this fix after running Updates every time but that doesn't appear to be the case (this is very frustrating and I hate taking up your time with this).

I just realized this started ocurring after I ran a system file check a few weeks ago. I wish I remembered that before but I just made the connection.

I also attached the error file.
Attached Files
File Type: txt appcompat.txt (41.8 KB, 16 views)
marley07712 is offline  
Old 03-05-2009, 08:51 AM   #14
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



Hi,

I am sorry that it only worked temporarily. Since this is a non-malware issue, I would suggest that you visit our Windows XP Support forum. Now, some final steps for house cleaning:
  • Click Start then Run
  • Now type Combofix /u in the runbox and click OK. Notice the space between the Combofix and the /




This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore to prevent reinfection from old restore points.

Itís vital that you keep all your software up-to-date as older versions may have some security vulnerabilities. Secunia Software Inspector Scan can help you find out which programs need to be updated.

Please respond to this thread one more time so we can mark this thread as resolved.

Surf Safely and Think Prevention!
__________________

amateur is offline  
Old 03-05-2009, 06:11 PM   #15
I helped the forums.
 
marley07712's Avatar
 
Join Date: Nov 2004
Posts: 175
OS: XP



Thanks again for your all of your help. ComboFix was uninstalled and programs were updated so this is resolved. I will see if the XP forum has solution.
marley07712 is offline  
Old 03-05-2009, 06:35 PM   #16
TSF-Emeritus
 
amateur's Avatar
 
Join Date: Jun 2006
Location: here & there and everywhere
Posts: 15,384
OS: XP Win7 Win 8.1 Ubuntu 10.10



You're welcome. Take care!
__________________

amateur is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 07:46 PM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts