|
Donation/Premium |
|
 |
|
|
|
|
|
|
|
|
|
| View previous topic :: View next topic |
| Author |
Message |
MauriceN
1st Responder
Premium Member
Joined: May 20, 2006
Posts: 1093
Location: USA
|
 Posted: Wed May 21, 2008 5:37 pm Post subject: |
|
|
Avira's AntiVir has done a good job, and also placed some items in quarantine. Excellent !
Bring up Control Panel, then Add-Remove Programs. Wait for the list of installed apps to populate the screen.
Look for Free-SpyHunter
or SpyHunter
Freeze-SmartShopper
or SmartShopper, and de-install them if found. Close Add-Remove & Control Panel when done.
Take a look at your downloads folder at
C:\Documents and Settings\HP_Administrator\My Documents\My Downloads
Look for Free-SpyHunter-Scanner-Install.exe
or anything Spyhunter
also look for ezvidstvbuzzfree.exe
If any is found, delete them.
You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!
These steps are for this OP only. If you are a lurker, do NOT try this on your system!
If at any point, if you have a question or problem, STOP & make a post to the forum.
Also, do not run or start any other programs while these utilities and tools are in use!
If you ever used Combofix or Smitfraudfix or Vundofix tools before this, delete them now!
 Delete any prior copy of ComboFix and download a fresh copy.
Download and SAVE ComboFix to your Desktop Do NOT run the program straight away from download.
Download this file -- And RENAME it to Combo-fix.exe from one of these sources:
http://subs.geekstogo.com/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
:Note: It is important that it is saved directly to, and run from your desktop.
- Close any open browsers.
- Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.
:1. Double click on Combo-fix.exe & follow the prompts.
:2. When finished, it will produce a logfile located at C:\ComboFix.txt.
Note:
Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
Take a break and grab a favorite cold drink!
Do not proceed with the rest of the fix if you fail to run combofix.
Once Complete, logoff & retstart Windows
> Please download SmitfraudFix (by S!Ri)  Don't download SmitfraudFix until you're ready to run/use it. It's very important that you be using the most recent version. Current version is ver 2.320 or later Save SmitfraudFix) to your Desktop.
> Please download and save VundoFix to your desktop. Current version is ver 7
Remove Smitfraud and Vundo
You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!
> Reboot into Safe Mode (Restart your computer, then continually tap F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. More at http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406.)
>. Once in Safe Mode, double-click Smitfraudfix.exe
>. Select option #2 - Clean by typing 2 and pressing Enter to delete infected files.
> You will be prompted: "Registry cleaning - Do you want to clean the registry ?" Answer "Yes" by typing Y and pressing Enter in order to remove the desktop background and clean registry keys associated with the infection.
> The tool will then check if wininet.dll is infected. If prompted to replace the infected file (if found), answer "Yes" by typing Y and pressing Enter.
> The tool may need to restart your computer to finish the cleaning process, restart to safe mode when it does; if it doesn't, please manually restart in safe mode.
> A text file will appear onscreen with results from the cleaning process. I shall want to see these results. A copy of the report will be found at the root of the system drive, usually at C:\rapport.txt. process.exe, a file installed by SmitFraudFix, is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. More on this at http://www.beyondlogic.org/consulting/processutil/processutil.htm Vundofix
- Double-click VundoFix.exe to run it.
- Click the Scan for Vundo button.
- Once it's done scanning, click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click YES
- Once you click yes, your desktop will go blank as it starts removing Vundo.
- When completed, it will prompt that it will reboot your computer, click OK.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.
A file will be automatically created as C:\vundofix.txt. I'll need to see this file in your next post, please.
Note: You can reboot to normal mode now.
Re-enable any antivirus or anti-malware that you had temporarily disabled from steps above
> Run hijackthis and save the log
With all windows/browsers/applications closed, run hijackthis and save the log.
Post back
Please post back with the following, in order: -Contents of the Combofix report;
-Contents of C:\rapport.txt;
-Contents of C:\vundofix.txt;
-New hijackthis log;
-Tell us, How are things now  Since these will be quite lengthy reports that would not fit in a single response, you need to do a PREVIEW before pressing Submit button. I would even suggest you post each report in a separate reply.
_________________
~Maurice Naggar
MS-MVP
|
|
| Back to top |
|
 |
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Thu May 22, 2008 5:12 pm Post subject: |
|
|
hello Maurice...~~smiles~~...did not find any of those files you said to look for, not even through search....hope that is a good thing.....
here is the combofix report and moving on to the next thing.....
ComboFix 08-05-21.2 - HP_Administrator 2008-05-22 11:38:04.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3033 [GMT -5:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\Combo-fix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-04-22 to 2008-05-22 )))))))))))))))))))))))))))))))
.
2008-05-20 17:01 . 2008-05-20 17:01 <DIR> d-------- C:\Program Files\Avira
2008-05-20 17:01 . 2008-05-20 17:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-05-20 14:32 . 2008-05-20 14:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-20 14:32 . 2008-05-20 14:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-20 13:44 . 2008-05-20 13:49 <DIR> d-------- C:\!KillBox
2008-05-16 19:13 . 2008-05-16 19:13 <DIR> d-------- C:\Deckard
2008-05-16 19:01 . 2008-05-16 19:01 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-16 19:01 . 2008-05-16 19:01 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Malwarebytes
2008-05-16 19:01 . 2008-05-16 19:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-16 19:01 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-16 19:01 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-15 18:02 . 2008-05-15 18:02 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-05-15 18:02 . 2003-07-19 10:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-05-15 18:02 . 2005-01-03 01:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-05-15 17:52 . 2008-05-15 17:52 <DIR> d-------- C:\Program Files\Xfire
2008-05-15 17:52 . 2008-05-15 17:52 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Xfire
2008-05-14 10:13 . 2008-05-14 10:22 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-05-08 19:55 . 2008-05-19 17:03 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-05-08 19:38 . 2008-05-08 19:38 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-05-08 19:38 . 2008-05-08 19:38 <DIR> d-------- C:\WINDOWS\system32\en
2008-05-08 19:38 . 2008-05-08 19:38 <DIR> d-------- C:\WINDOWS\system32\bits
2008-05-08 19:38 . 2008-05-08 19:38 <DIR> d-------- C:\WINDOWS\l2schemas
2008-05-08 19:36 . 2008-05-08 19:38 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-05-08 19:22 . 2008-04-13 19:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2008-05-08 17:04 . 2008-05-08 17:04 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-08 17:04 . 2008-05-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-08 16:47 . 2008-05-08 16:47 <DIR> d-------- C:\Program Files\CCleaner
2008-05-08 13:28 . 2008-05-08 13:28 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-08 10:59 . 2008-05-08 10:59 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Uniblue
2008-05-08 10:59 . 2008-05-08 10:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Uniblue
2008-05-05 16:30 . 2008-05-05 16:30 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-05-05 16:09 . 2008-05-18 22:22 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Skype
2008-05-05 16:07 . 2008-05-05 16:07 <DIR> d-------- C:\Program Files\Skype
2008-05-05 16:07 . 2008-05-05 16:07 <DIR> d-------- C:\Program Files\Common Files\Skype
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-22 16:40 27,951,136 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-22 03:30 328,124 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-20 19:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-19 02:49 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\skypePM
2008-05-15 22:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-14 11:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-11 16:30 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\AdobeUM
2008-05-09 00:41 61,440 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll
2008-05-09 00:41 45,056 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2008-05-09 00:41 44,032 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2008-05-09 00:41 40,960 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll
2008-05-09 00:41 341,048 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll
2008-05-09 00:41 32,768 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll
2008-05-09 00:41 32,768 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll
2008-05-09 00:41 208,896 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
2008-05-09 00:41 163,840 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll
2008-05-08 22:28 --------- d-----w C:\Program Files\BitTorrent
2008-05-08 21:21 --------- d-----w C:\Program Files\WildTangent
2008-05-08 21:19 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-08 21:17 --------- d-----w C:\Program Files\SoundSpectrum
2008-05-08 20:59 --------- d-----w C:\Program Files\DivX
2008-05-07 03:39 --------- d-----w C:\Program Files\Lx_cats
2008-05-05 21:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-05-01 22:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-04-27 04:50 19,786 ----a-w C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
2008-04-24 04:23 1,477,632 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-04-18 01:45 2,685,440 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-04-18 01:45 1,456,128 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-04-15 16:21 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-15 16:04 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-04-15 16:04 --------- d-----w C:\Program Files\Adobe Media Player
2008-04-14 21:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\WildTangent
2008-04-14 21:02 --------- d-----w C:\Program Files\IMVU
2008-04-14 10:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 10:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 10:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:19 --------- d-----w C:\Program Files\HP
2008-04-14 00:19 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-14 00:17 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\WinBatch
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 00:13 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 00:13 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:13 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 67,584 ----a-w C:\WINDOWS\system32\dllcache\pmigrate.dll
2008-04-14 00:10 53,760 ----a-w C:\WINDOWS\system32\dllcache\pintlcsd.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\dllcache\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-14 00:10 175,104 ----a-w C:\WINDOWS\system32\dllcache\pintlcsa.dll
2008-04-14 00:10 15,872 ----a-w C:\WINDOWS\system32\dllcache\padrs404.dll
2008-04-14 00:10 15,360 ----a-w C:\WINDOWS\system32\dllcache\padrs804.dll
2008-04-14 00:10 10,240 ----a-w C:\WINDOWS\system32\dllcache\tmigrate.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-04-13 19:18 52,480 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
2008-04-13 19:15 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 19:00 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 18:56 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
.
((((((((((((((((((((((((((((( snapshot@2008-05-19_13.22.17.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-19 17:44:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-22 15:58:37 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-01-21 23:12:56 41,792 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 23:11:28 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-03-04 18:28:53 79,424 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 15:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2008-04-10 13:25 262144]
[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 09:59 224248]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 16:01 67584]
"ftutil2"="ftutil2.dll" [2004-06-07 09:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-21 11:59 143360]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 10:51 442455]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-02 19:54 185896]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19 129536]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"lxcimon.exe"="C:\Program Files\Lexmark 7300 Series\lxcimon.exe" [2007-02-01 21:14 205744]
"EzPrint"="C:\Program Files\Lexmark 7300 Series\ezprint.exe" [2007-02-01 21:15 103344]
"WrtMon.exe"="C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 08:35 20480]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 09:59 224248]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 04:57 16855552 C:\WINDOWS\RTHDCPL.EXE]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 14:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 08:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 08:17 118784]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 03:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"LXCICATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCItime.dll" [2006-11-21 12:27 106496]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 23:11 919016]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\
Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-09-16 23:52:15 27136]
PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-09-16 23:52:15 27136]
C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\
wkcalrem.LNK - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-06-23 12:23:00 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-100000000002}\SC_Acrobat.exe [2007-08-17 18:16:24 25214]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-02-18 22:24:54 113664]
AT&T Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2007-01-24 01:57:00 217088]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-02-25 19:12:05 789008]
Updates From HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-09-17 00:46:35 36903]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 13:30 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ReSchedHPSU.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ReSchedHPSU.lnk
backup=C:\WINDOWS\pss\ReSchedHPSU.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
--a------ 2006-04-13 04:05 90112 c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
--a------ 2006-02-15 17:34 249856 C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]
--a------ 2006-04-06 13:17 53248 C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
--a------ 2005-07-22 17:14 237568 C:\WINDOWS\SMINST\RECGUARD.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
--a------ 2004-12-13 21:23 663552 C:\Windows\Creator\Remind_XP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"srservice"=2 (0x2)
"dmadmin"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DISC\\DISCover.exe"=
"C:\\Program Files\\DISC\\DiscStreamHub.exe"=
"C:\\Program Files\\DISC\\myFTP.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\system32\\lxcicoms.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\SecondLife\\SLVoice.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 BCMNTIO;BCMNTIO;C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 19:09]
R2 lxci_device;lxci_device;C:\WINDOWS\system32\lxcicoms.exe [2007-02-01 21:13]
R2 MAPMEM;MAPMEM;C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 19:09]
S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys []
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-22 11:40:09
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\ATL.DLL
.
Completion time: 2008-05-22 11:41:15
ComboFix-quarantined-files.txt 2008-05-22 16:41:01
ComboFix2.txt 2008-05-19 19:32:23
ComboFix3.txt 2008-05-19 18:42:20
ComboFix4.txt 2008-05-19 18:22:54
Pre-Run: 342,748,569,600 bytes free
Post-Run: 342,749,388,800 bytes free
286 --- E O F --- 2008-05-19 22:03:12
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Thu May 22, 2008 5:52 pm Post subject: |
|
|
here is the smitfraud report......
SmitFraudFix v2.320
Scan done at 12:03:35.03, Thu 05/22/2008
Run from C:\Documents and Settings\HP_Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AFE40468-EEFF-44C0-9DF8-52938464DA5C}: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AFE40468-EEFF-44C0-9DF8-52938464DA5C}: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
HKLM\SYSTEM\CS2\Services\Tcpip\..\{AFE40468-EEFF-44C0-9DF8-52938464DA5C}: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 192.168.0.1
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Thu May 22, 2008 5:53 pm Post subject: |
|
|
here is the vundo report....
VundoFix V7.0.5
Scan started at 12:13:34 PM 5/22/2008
Listing files found while scanning....
No infected files were found.
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Thu May 22, 2008 5:59 pm Post subject: |
|
|
and here is my HJT log......
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40:04 PM, on 5/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxcicoms.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Lexmark 7300 Series\ezprint.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [lxcimon.exe] "C:\Program Files\Lexmark 7300 Series\lxcimon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7300 Series\ezprint.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [LXCICATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCItime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcStd7_0_9 -reboot 1
O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\HP_Administrator\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.west.com
O15 - Trusted Zone: *.westathome.com
O15 - Trusted Zone: *.westathome.net
O15 - Trusted Zone: *.workathomeagent.net
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://www.installshield.com/install/iftwclix.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9563.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD39/JSCDL/jdk/6u5b/jinstall-6u5-windows-i586-jc.cab?AuthParam=1205645740_c4eeb9878f9df32e268199999c91363e&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD39/JSCDL/jdk/6u5b/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://petcam.ci.irving.tx.us/activex/AxisCamControl.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxci_device - - C:\WINDOWS\system32\lxcicoms.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 15081 bytes
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Thu May 22, 2008 6:17 pm Post subject: |
|
|
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
I do not know why this shows up. I did run the Norton removal tool when you told me to. Why didn't this get deleted?
And just noticed, Happy Belated 2nd CastleCops Anniversary, Maurice 
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Thu May 22, 2008 8:47 pm Post subject: |
|
|
Hello Maurice,
You had asked for a report on how my PC runs now. It does appear to be running more smoothly....have not had a random restart since starting the entire cleaning process and now my IE7 does not tell me it cannot open a page, then do so anyways.
I have been having another problem but did not think it relevent to the HJT threads, but will report it here since you did ask how the PC runs now.
When I try to run DVDs, the playback stutters throughout. The sound, the images, everything stutters. When I play a CD with music on it, the playback is smooth, no errors detected at all. Could this just be a driver malfunction?
|
|
| Back to top |
|
|
MauriceN
1st Responder
Premium Member
Joined: May 20, 2006
Posts: 1093
Location: USA
|
| Posted: Mon May 26, 2008 2:40 pm Post subject: |
|
|
Hello Wyntarra,
My apologies for the delay in responding. Have you had any random restarts lately?
I'm going to have you attempt to remove 1 reference to Symantec, plus remove 4 of "auto-start" entries that are not needed with each Windows start: Quick Time and Adobe Reader, Photoshop album starter, & Real update scheduler. You'll still have the programs around.
Close all browsers and all other programs that you have started.
Start HijackThis. Look for these lines and place a checkmark against each of the following, if still present | Quote: | O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
|
Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer (& or any other browser) is closed when you click Fix Checked!
>
Please make sure you have a good system restore point of the system before you run RVAXO even if you have to create one now:
- Download RVAXO.exe to your Desktop.
- Double click on it and it will unzip to a folder called RVAXO
- Now open up RVAXO folder on your desktop.
- For XP users: Double click on RunMe.cmd
- For Vista Only: Rightclick RunMe.cmd and choose Run as Administrator.
- RVAXO will install and run...please be patient!
- You will see a small window pop up, and quickly some lines will run, this is normal behavior.
- Then it is possible for an uninstaller of some roque scanner to start up, do not close this but follow all prompts there, and let it run its course.
- When it's done the computer will reboot. (Press any key to reboot)
- After reboot RVAXO will run again, let it finish
- After it's done it will create a file called RVAXO-results.log in C:\RVAXO-results.log
- Please post the C:\RVAXO-results.log in your reply.
- Please also post the contents of this file: C:\RVAXO-Vfind
(It will open up with notepad)
Note for much later: You can use Uninstall.cmd to remove everything from RVAXO, it will be found in the RVAXO-folder on your desktop.
>
With your Internet Explorer, go to & run the ESET Online Scanner
http://www.eset.com/onlinescan/
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt.
>
Run a fresh HijackThis Scan and Save.
Reply with- C:\RVAXO-results.log,
- C:\RVAXO-Vfind,
- the copy of Eset log.txt,
- the new HJT log,
- and tell us, How is the system now
If things look good, I believe we can proceed to cleanup of tools and closure.
RE: | Quote: | | When I try to run DVDs, the playback stutters throughout. The sound, the images, everything stutters. When I play a CD with music on it, the playback is smooth, no errors detected at all. Could this just be a driver malfunction? |
Could well be a driver issue. Do you recall downloading any drivers from websites other than the hardware manufacturer?
_________________
~Maurice Naggar
MS-MVP
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Mon May 26, 2008 5:23 pm Post subject: |
|
|
hiyas Maurice!...missed ya!...and it is okay you had to be away for a spell, you are in no way obligated to me....you are just so awsome to be helping me out!
here is the RVAXO results log....
---RVAXO.exe Updated: 2008-05-26---first run---
Uninstallers:
Files found:
C:\WINDOWS\wininit.ini
C:\WINDOWS\ua2.dll
C:\WINDOWS\system32\netlogun.exe
Folders Found:
Hosts-file was reset, If you use a custom hosts file please replace it...
--------------RVAXO.exe last run---------------
Not deleted items:
--------------RVAXO.exe finished----------------
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Mon May 26, 2008 5:25 pm Post subject: |
|
|
and here is the RVAXO Vfind log......
======C:\WINDOWS====
----a-w 0 2008-05-26 17:18:51 C:\WINDOWS\0.log
--s-a-w 2,048 2008-05-26 17:18:31 C:\WINDOWS\bootstat.dat
----a-w 173 2008-05-09 00:39:25 C:\WINDOWS\cmsetacl.log
----a-w 3,560 2008-05-09 00:43:38 C:\WINDOWS\comsetup.log
----a-w 11,098 2008-05-09 06:21:12 C:\WINDOWS\DPINST.LOG
----a-w 226 2008-05-09 00:51:53 C:\WINDOWS\DtcInstall.log
----a-w 0 2008-05-26 16:51:15 C:\WINDOWS\DVEdit.INI
----a-w 623 2008-05-09 00:43:38 C:\WINDOWS\ehOCGen.log
----a-w 12,319 2008-05-09 00:43:27 C:\WINDOWS\FaxSetup.log
----a-w 6,172 2008-05-09 00:43:38 C:\WINDOWS\iis6.log
----a-w 2,639 2008-05-09 00:43:38 C:\WINDOWS\imsins.log
----a-w 10,114 2008-05-09 00:09:00 C:\WINDOWS\KB892130.log
----a-w 16,338 2008-05-09 00:51:32 C:\WINDOWS\MedCtrOC.log
----a-w 462 2008-05-09 00:43:28 C:\WINDOWS\msgsocm.log
----a-w 3,602 2008-05-09 00:43:25 C:\WINDOWS\msmqinst.log
----a-w 1,840 2008-05-09 00:43:28 C:\WINDOWS\netfxocm.log
----a-w 207,334 2008-05-22 17:09:10 C:\WINDOWS\ntbtlog.txt
----a-w 1,897 2008-05-09 00:43:38 C:\WINDOWS\ntdtcsetup.log
----a-w 5,821 2008-05-09 00:43:28 C:\WINDOWS\ocgen.log
----a-w 503 2008-05-09 00:43:38 C:\WINDOWS\ocmsn.log
----a-w 345 2008-05-09 00:49:08 C:\WINDOWS\OEWABLog.txt
----a-w 1,326 2008-05-09 00:43:28 C:\WINDOWS\plusoc.log
---ha-w 54,156 2008-05-18 20:20:16 C:\WINDOWS\QTFont.qfn
----a-w 32,634 2008-05-26 17:04:46 C:\WINDOWS\SchedLgU.Txt
----a-w 259 2008-05-09 00:39:15 C:\WINDOWS\sessmgr.setup.log
----a-w 360 2008-05-22 17:05:57 C:\WINDOWS\setupact.log
----a-w 113,175 2008-05-26 16:35:35 C:\WINDOWS\setupapi.log
----a-w 0 2008-05-09 00:08:33 C:\WINDOWS\setuperr.log
----a-w 9,785 2008-05-09 00:47:29 C:\WINDOWS\setuplog.txt
----a-w 31,920 2008-05-09 00:51:59 C:\WINDOWS\spupdsvc.log
----a-w 187 2008-05-09 00:51:33 C:\WINDOWS\spupdsvc.log.1.log
----a-w 554,234 2008-05-09 00:43:38 C:\WINDOWS\svcpack.log
----a-w 260 2008-05-22 16:40:08 C:\WINDOWS\system.ini
----a-w 778 2008-05-09 00:51:59 C:\WINDOWS\tabletoc.log
----a-w 4,700 2008-05-09 00:43:38 C:\WINDOWS\tsoc.log
----a-w 111,721 2008-05-09 00:38:35 C:\WINDOWS\updspapi.log
----a-w 159 2008-05-26 17:18:49 C:\WINDOWS\wiadebug.log
----a-w 312 2008-05-26 17:18:48 C:\WINDOWS\wiaservc.log
----a-w 1,223,458 2008-05-26 17:19:34 C:\WINDOWS\WindowsUpdate.log
----a-w 814 2008-05-09 00:51:53 C:\WINDOWS\wmsetup.log
Entries: 40 (3
Directories: 0 Files: 40
Bytes: 2,427,352 Blocks: 4,759
======C:\WINDOWS\system32=====
----a-w 2,577 2008-05-20 18:56:48 C:\WINDOWS\System32\CONFIG.NT
---ha-w 56 2008-05-05 21:30:03 C:\WINDOWS\System32\ezsidmv.dat
----a-w 337,848 2008-05-09 17:57:43 C:\WINDOWS\System32\FNTCACHE.DAT
----a-w 16,863,864 2008-05-09 21:35:04 C:\WINDOWS\System32\MRT.exe
----a-w 73,028 2008-05-09 00:52:38 C:\WINDOWS\System32\perfc009.dat
----a-w 446,200 2008-05-09 00:52:38 C:\WINDOWS\System32\perfh009.dat
----a-w 528,784 2008-05-09 00:52:37 C:\WINDOWS\System32\PerfStringBackup.INI
----a-w 827,419 2008-05-26 19:14:42 C:\WINDOWS\System32\RVAXO.bat
----a-w 90 2008-05-09 00:51:32 C:\WINDOWS\System32\spupdwxp.log
----a-w 4,664 2008-05-22 17:03:42 C:\WINDOWS\System32\tmp.reg
----a-w 0 2008-05-22 17:03:42 C:\WINDOWS\System32\tmp.txt
----a-w 352,918 2008-05-26 17:18:53 C:\WINDOWS\System32\vsconfig.xml
----a-w 1,158 2008-05-26 17:19:06 C:\WINDOWS\System32\wpa.dbl
Entries: 13 (12)
Directories: 0 Files: 13
Bytes: 19,438,606 Blocks: 37,974
======C:\WINDOWS\system32\drivers=====
--sha-w 29,210,656 2008-05-26 17:19:35 C:\WINDOWS\System32\drivers\fidbox.dat
--sha-w 343,340 2008-05-26 17:17:45 C:\WINDOWS\System32\drivers\fidbox.idx
----a-w 15,864 2008-05-06 01:46:32 C:\WINDOWS\System32\drivers\mbam.sys
----a-w 27,048 2008-05-06 01:46:36 C:\WINDOWS\System32\drivers\mbamcatchme.sys
Entries: 4 (2)
Directories: 0 Files: 4
Bytes: 29,596,908 Blocks: 57,808
=======C:\Program Files=====
Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0
=======C:=====
--sha-r 280 2008-05-19 17:27:34 C:\boot.ini
----a-w 21,390 2008-05-22 16:41:16 C:\ComboFix.txt
----a-w 292 2008-05-26 17:17:39 C:\firstrun6.log
--sha-w 3,748,093,952 2008-05-26 17:18:30 C:\hiberfil.sys
--sha-r 250,048 2008-05-09 00:33:45 C:\ntldr
--sha-w 2,145,386,496 2008-05-26 17:18:29 C:\pagefile.sys
----a-w 2,635 2008-05-22 17:06:03 C:\rapport.txt
----a-w 427 2008-05-26 17:19:35 C:\RVAXO-results.log
----a-w 4,932 2008-05-26 17:19:35 C:\RVAXO-Vfind.log
----a-w 24 2008-05-06 20:13:32 C:\url_history.xml
----a-w 137 2008-05-22 17:18:54 C:\VundoFix.txt
Entries: 11 (7)
Directories: 0 Files: 11
Bytes: 5,893,760,613 Blocks: 11,511,256
======C:\Documents and Settings\HP_Administrator\Application Data======
----a-w 19,786 2008-04-27 04:50:40 C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 19,786 Blocks: 39
======C:\Documents and Settings\HP_Administrator======
---ha-w 7,602,176 2008-05-26 17:17:45 C:\Documents and Settings\HP_Administrator\NTUSER.DAT
---ha-w 32,768 2008-05-26 17:19:21 C:\Documents and Settings\HP_Administrator\ntuser.dat.LOG
--sh--w 178 2008-05-26 17:04:43 C:\Documents and Settings\HP_Administrator\ntuser.ini
Entries: 3 (0)
Directories: 0 Files: 3
Bytes: 7,635,122 Blocks: 14,913
======C:\WINDOWS\Downloaded Program Files====
----a-w 320 2008-04-29 13:52:20 C:\WINDOWS\Downloaded Program Files\wlscBase.inf
Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 320 Blocks: 1
=============
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Mon May 26, 2008 5:27 pm Post subject: |
|
|
running Eset now and will have that log and a fresh HJT log as well....so far no random restarts at all though sometimes I get errors from IE7 saying it cannot open something but then does either on it's own or after a refresh of the browser......
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Mon May 26, 2008 8:21 pm Post subject: |
|
|
here is the Eset log!
# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3132 (20080526)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=91373dd810048f41a4839ff52134c928
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2008-05-26 08:16:39
# local_time=2008-05-26 03:16:39 (-0600, Central Daylight Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=647511
# found=0
# scan_time=9678
|
|
| Back to top |
|
|
Wyntarra
Private
Joined: May 08, 2008
Posts: 42
Location: USA
|
| Posted: Mon May 26, 2008 8:24 pm Post subject: |
|
|
and last, my new HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:22:37 PM, on 5/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxcicoms.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Lexmark 7300 Series\ezprint.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O | | |
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
