BleepingComputer.com: Spyware protect2009 and maybe something else.

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

Spyware protect2009 and maybe something else. Already deleted, but computer is still acting funny.

#1 User is offline   Vergules 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 1
  • Joined: 07-June 09

Posted 07 June 2009 - 07:33 PM

I used Malwarebytes' Anti-Malware to remove Spyware Protect2009. however, after it was deleted my computer was still acting funny. i cannot enable my anti virus. I tried reinstalling the anti virus but the same thing keeps happening. i'm guessing that something wasn't deleted. Any help will be greatly appreciated.


DDS (Ver_09-05-14.01) - NTFSx86
Run by Compaq_Administrator at 18:55:03.17 on Sun 06/07/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2494.1792 [GMT -5:00]

AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\arservice.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\DISC\DiscUpdMgr.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\SinEspias\No-Spy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\PC-Doctor 5 for Windows\pcdsmartmonitor.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Compaq_Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
mDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
mSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;<local>
mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PRESARIO&pf=desktop
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\ievkbd.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [A00F22BDFE2E.exe] c:\docume~1\compaq~1\locals~1\temp\_A00F22BDFE2E.exe
uRun: [system tool] c:\windows\sysguard.exe
uRun: [nzdflkioezncfiunfindiuchiuenfcdc] c:\docume~1\compaq~1\locals~1\temp\lzkwdt.exe
uRun: [SYSDLL] SYSDLL
uRun: [Diagnostic Manager] c:\docume~1\compaq~1\locals~1\temp\352932472.exe
uRun: [AWMON] "c:\program files\lavasoft\ad-aware se professional\Ad-Watch.exe"
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [DISCover] c:\program files\disc\DISCover.exe
mRun: [DiscUpdateManager] c:\program files\disc\DiscUpdMgr.exe
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [<NO NAME>]
mRun: [PCDrProfiler] "c:\program files\pc-doctor 5 for windows\RunProfiler.exe" -r
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [Reminder] "c:\windows\creator\Remind_XP.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPwuSchd2.exe
mRun: [No Spy] "c:\program files\sinespias\No-Spy.exe" /autorun
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe"
mRun: [sysldtray] c:\windows\ld08.exe
dRun: [Diagnostic Manager] c:\windows\temp\4238019690.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
uPolicies-system: EnableProfileQuota = 1 (0x1)
dPolicies-explorer: NoFolderOptions = 1 (0x1)
dPolicies-system: DisableRegistryTools = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_05\bin\npjpi150_05.dll
IE: {1f460357-8a94-4d71-9ca3-aa4acf32ed8e} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky anti-virus 2009\SCIEPlgn.dll
Trusted Zone: trymedia.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\thunmail\testabd.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R1 klif;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-5-28 213520]
R2 avp;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2009\avp.exe [2008-7-29 206088]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
R3 PCD5SRVC{8A863ACB-F5F6CC6A-05010003};PCD5SRVC{8A863ACB-F5F6CC6A-05010003} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\pc-doc~1\PCD5SRVC.pkms [2006-2-8 21120]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2009-5-20 23856]
S3 ntalme;ntalme;c:\windows\system32\ntalme.sys [2009-5-19 2304]

=============== Created Last 30 ================

2009-06-07 18:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters
2009-06-07 18:48 <DIR> --d----- c:\program files\PC Drivers HeadQuarters
2009-06-07 18:45 38,400 a------- c:\windows\system32\pcdhdm.cpl
2009-06-07 18:12 <DIR> --d----- c:\program files\Windows Media Connect 2
2009-06-07 18:11 <DIR> --d----- c:\windows\system32\LogFiles
2009-06-07 18:04 <DIR> --d----- c:\program files\common files\xing shared
2009-06-05 10:18 <DIR> --d----- c:\docume~1\compaq~1\applic~1\MSNInstaller
2009-05-29 22:38 <DIR> --d----- c:\docume~1\compaq~1\applic~1\HPQ
2009-05-28 14:37 105,395 a------- c:\windows\system32\drivers\klin.dat
2009-05-28 14:37 94,643 a------- c:\windows\system32\drivers\klick.dat
2009-05-28 14:36 32 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-05-28 14:36 32 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-05-28 14:36 32 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-05-28 14:36 32 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-05-28 13:53 <DIR> --d----- c:\docume~1\compaq~1\applic~1\Malwarebytes
2009-05-28 13:53 40,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-28 13:53 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-05-28 13:53 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-05-28 13:53 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-28 12:58 <DIR> --d----- c:\program files\Lavasoft
2009-05-28 12:51 <DIR> --d----- c:\program files\SinEspias
2009-05-28 11:25 <DIR> --d----- c:\windows\dhcp
2009-05-28 11:25 <DIR> --d----- c:\windows\system32\sysloc
2009-05-28 11:25 97,996 a------- c:\windows\system32\drivers\6894799d.sys
2009-05-27 22:50 <DIR> --d----- c:\documents and settings\compaq_administrator\Tracing
2009-05-27 22:49 <DIR> --d----- c:\program files\Microsoft
2009-05-27 22:49 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-05-27 22:47 <DIR> --d----- c:\program files\common files\Windows Live
2009-05-26 17:18 90,112 a------- c:\windows\system32\QuickTimeVR.qtx
2009-05-26 17:18 57,344 a------- c:\windows\system32\QuickTime.qts
2009-05-21 19:42 <DIR> --d----- c:\windows\system32\appmgmt
2009-05-21 19:33 <DIR> --dshr-- C:\cmdcons
2009-05-21 19:33 <DIR> --d----- c:\windows\setupupd
2009-05-21 19:32 1,907 a--shr-- c:\windows\system32\drivers\103C_HP_CPC_EX316AA-ABA SR1917CL NA670_YC_0Pres_QCNH617_E63NAemREA1_48_INAGAMI2_SASUSTek Computer INC._V2.00_B3.11_T060919_WXP2_L409_M2495_J200_7AMD_8Athlon 64_92.2_#090520_N_Z14F12F20_G10DE0241_OPHILIPS DVD8851.MRK
2009-05-21 19:30 <DIR> --d----- c:\docume~1\compaq~1\applic~1\Intuit
2009-05-21 19:30 <DIR> --d----- c:\documents and settings\compaq_administrator\WINDOWS
2009-05-21 19:30 <DIR> --d----- c:\documents and settings\Compaq_Administrator
2009-05-21 17:45 <DIR> --dshr-- c:\windows\system32\dllcache
2009-05-20 23:09 <DIR> --d----- c:\documents and settings\compaq_administrator\dwhelper
2009-05-20 22:54 737,280 a------- c:\windows\iun6002.exe
2009-05-20 22:53 <DIR> --d----- c:\program files\Replay Converter
2009-05-20 17:52 <DIR> --d----- c:\program files\Kaspersky Lab
2009-05-20 17:52 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2009-05-20 17:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2009-05-20 17:38 <DIR> --ds---- c:\documents and settings\compaq_administrator\UserData
2009-05-20 17:21 <DIR> --d----- c:\windows\setup.pss
2009-05-20 17:10 243 a------- c:\windows\system\hpsysdrv.dat
2009-05-20 15:41 <DIR> --d----- c:\program files\CONEXANT
2009-05-20 15:40 43,531 a------- c:\windows\system32\nvapps.xml
2009-05-20 15:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SBSI
2009-05-20 15:39 218,245 a------- c:\windows\orun32.isu
2009-05-20 15:39 791 a------- c:\windows\orun32.ini
2009-05-20 15:39 306,688 a------- c:\windows\IsUninst.exe
2009-05-20 15:31 61 a------- c:\windows\smscfg.ini
2009-05-20 15:31 <DIR> --dsh--- c:\documents and settings\all users\DRM
2009-05-20 15:31 333 a------- c:\windows\system32\$ncsp$.inf
2009-05-20 15:29 <DIR> --d-h--- c:\windows\$hf_mig$
2009-05-20 15:28 52,736 a------- c:\windows\system\hpsysdrv.exe
2009-05-20 15:27 786,944 a------- c:\windows\system32\RDBios32.dll
2009-05-20 15:27 532,480 a------- c:\windows\system32\cPC_DMIRD.dll
2009-05-20 15:26 49,265 a------- c:\windows\system32\jpicpl32.cpl
2009-05-20 15:23 <DIR> --d----- c:\windows\RegisteredPackages
2009-05-20 15:21 <DIR> --d----- c:\program files\GemMaster
2009-05-20 15:21 <DIR> --d----- c:\program files\EnglishOtto
2009-05-20 15:19 <DIR> --d----- c:\windows\system32\URTTemp
2009-05-20 15:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Symantec
2009-05-20 15:19 <DIR> --d----- c:\program files\common files\Symantec Shared
2009-05-20 15:18 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-05-20 15:18 25,856 a------- c:\windows\system32\dllcache\usbprint.sys
2009-05-20 15:11 2,238 a------- c:\windows\system32\doc.ico
2009-05-20 15:11 <DIR> --d----- c:\program files\PC-Doctor for DOS
2009-05-20 15:11 28,848 a------- c:\windows\system32\drivers\USBkey.sys
2009-05-20 15:11 13,440 a------- c:\windows\system32\drivers\pcdrndisuio.sys
2009-05-20 15:11 11,351 a------- c:\windows\system32\drivers\diag69xp.sys
2009-05-20 15:10 <DIR> --d----- c:\program files\PC-Doctor 5 for Windows
2009-05-20 15:08 29,926 a------- c:\windows\hsc.ico
2009-05-20 15:07 <DIR> --d----- c:\windows\HPCPCUninstall-5577497
2009-05-20 15:07 118,842 a----r-- c:\windows\HPCPCUninstaller-6.3.2.116-5577497.exe
2009-05-20 15:07 <DIR> --d----- c:\program files\Compaq Connections
2009-05-20 15:07 <DIR> a-d----- c:\windows\system32\pcintro
2009-05-20 15:06 667,896 a------- c:\windows\unins000.exe
2009-05-20 15:06 1,235 a------- c:\windows\unins000.dat
2009-05-20 15:06 12,987 a------- c:\windows\system32\CHODDI.SYS
2009-05-20 15:06 19,736 a------- c:\windows\system32\oemlogo.bmp
2009-05-20 15:06 45,056 a------- c:\windows\system32\runclose.ocx
2009-05-20 15:06 40,960 a------- c:\windows\system32\omano.dll
2009-05-20 15:06 45,056 a------- c:\windows\system32\hpreg.dll
2009-05-20 15:04 1,667,072 a------- c:\windows\system32\cdintf250.dll
2009-05-20 15:04 <DIR> --d----- c:\program files\common files\Palo Alto Software
2009-05-20 15:04 <DIR> --d----- c:\program files\common files\Intuit
2009-05-20 15:03 <DIR> --d----- c:\program files\Quicken
2009-05-20 15:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intuit
2009-05-20 15:03 174 a------- c:\windows\QUICKEN.INI
2009-05-20 15:03 <DIR> a-d----- c:\windows\CREATOR
2009-05-20 15:03 266,240 a------- c:\windows\system32\ShellvRTF64.dll
2009-05-20 15:03 237,568 a------- c:\windows\system32\ShellvRTF.dll
2009-05-20 15:02 376 a------- c:\windows\ODBC.INI
2009-05-20 15:02 17,920 a------- c:\windows\system32\mdimon.dll
2009-05-20 15:02 <DIR> --d----- c:\program files\Microsoft ActiveSync
2009-05-20 15:01 <DIR> --d----- c:\windows\ShellNew
2009-05-20 14:59 <DIR> --d----- c:\program files\Microsoft Money 2006
2009-05-20 14:57 44,544 a------- c:\windows\system32\msxml4a.dll
2009-05-20 14:56 <DIR> --d----- c:\program files\common files\TiVo Shared
2009-05-20 14:52 <DIR> --d----- c:\program files\HP Games
2009-05-20 14:51 108 a------- c:\windows\WININIT.INI
2009-05-20 14:51 <DIR> --d----- c:\program files\common files\SureThing Shared
2009-05-20 14:51 <DIR> --d----- c:\program files\Sonic
2009-05-20 14:50 <DIR> --d----- c:\program files\HP Rhapsody
2009-05-20 14:50 45,929 a------- c:\windows\NSSetDefaultBrowser.EXE
2009-05-20 14:50 698 a------- c:\windows\NSSetDefaultBrowser.ini
2009-05-20 14:50 <DIR> --d----- c:\program files\Netscape
2009-05-20 14:50 8,192 a------- c:\windows\REGLOCS.OLD
2009-05-20 14:50 <DIR> --d----- c:\program files\music_now
2009-05-20 14:49 <DIR> --d----- c:\program files\common files\Real
2009-05-20 14:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Digital Interactive Systems Corporation
2009-05-20 14:49 <DIR> --d----- c:\program files\DISC
2009-05-20 14:48 <DIR> --d----- c:\program files\MSN Encarta Standard
2009-05-20 14:46 <DIR> --d----- c:\program files\common files\Sonic Shared
2009-05-20 14:45 <DIR> --d----- c:\program files\common files\HP
2009-05-20 14:45 <DIR> --d----- c:\program files\HP
2009-05-20 14:45 95,822 a------- c:\windows\hpqins69.dat
2009-05-20 14:44 57 a------- c:\windows\system32\mapisvc.inf
2009-05-20 14:44 <DIR> --d----- c:\windows\system32\Lang
2009-05-20 14:42 36,352 a------- c:\windows\system32\drivers\AmdK8.sys
2009-05-20 06:56 <DIR> --d----- C:\Program Files
2009-05-20 05:04 332,544 a------- c:\windows\system32\drivers\srv.sys
2009-05-20 05:04 332,544 a------- c:\windows\system32\dllcache\srv.sys
2009-05-20 05:04 474,112 a------- c:\windows\system32\dllcache\shlwapi.dll
2009-05-20 05:02 721,920 a------- c:\windows\system32\lsasrv.dll
2009-05-20 05:01 128,512 a------- c:\windows\system32\dllcache\dhtmled.ocx
2009-05-19 23:58 <DIR> --d----- c:\windows\I386
2009-05-19 23:56 <DIR> --d--r-- c:\documents and settings\all users\Documents
2009-05-19 23:36 <DIR> --d--r-- c:\windows\Offline Web Pages
2009-05-19 23:14 53,248 a------- c:\windows\system32\drivers\1394bus.sys
2009-05-19 23:14 2,233 a------- c:\windows\system32\dllcache\12520850.cpx
2009-05-19 23:14 2,233 a------- c:\windows\system32\12520850.cpx
2009-05-19 23:14 2,151 a------- c:\windows\system32\dllcache\12520437.cpx
2009-05-19 23:14 2,151 a------- c:\windows\system32\12520437.cpx
2009-05-19 22:04 984,576 a------- c:\windows\system32\syssetup.dll
2009-05-19 22:03 1,669,120 a------- c:\windows\system32\dllcache\setup_wm.exe
2009-05-19 22:02 1,028,096 a------- c:\windows\system32\mfc42.dll
2009-05-19 22:01 375,296 a------- c:\windows\system32\dpnet.dll

==================== Find3M ====================

2009-06-07 18:28 33,808 a------- c:\windows\system32\drivers\klbg.sys
2009-06-07 18:04 499,712 a------- c:\windows\system32\msvcp71.dll
2009-06-07 18:04 348,160 a------- c:\windows\system32\msvcr71.dll
2009-05-20 15:10 92,947 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-05-20 15:09 45,056 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\uninstallui\eHelpSetup.exe
2009-05-20 15:09 341,048 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\HPBasicDetection3.dll
2009-05-20 15:09 217,088 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll
2009-05-20 15:09 163,840 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\modemcheck.dll
2009-05-20 15:09 61,440 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\modemutil.dll
2009-05-20 15:09 44,032 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\scripts\devcon.exe
2009-05-20 15:09 40,960 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\ScDmi.dll
2009-05-20 15:09 32,768 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\uploadHSC.dll
2009-05-20 15:09 32,768 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\Scom.dll
2005-07-14 13:31 27,648 a--sh--- c:\windows\system32\AVSredirect.dll

============= FINISH: 18:55:19.76 ===============

Attached File(s)


#2 User is offline   Tokek 

  • Bleepin' Gecko
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Members
  • Posts: 1,213
  • Joined: 18-April 08
  • Gender:Male
  • Location:Jakarta, Indonesia

Posted 17 June 2009 - 11:48 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE
If I have not replied back to your post in 3 days, please send me a PM.

Posted Image

#3 User is offline   teacup61 

  • Bleepin' Texan in Ohio!
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Team
  • Posts: 17,058
  • Joined: 05-April 06
  • Gender:Female
  • Location:New Bremen, Ohio

Posted 22 June 2009 - 01:10 PM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!
Posted Image


Error reading poptart in Drive A: Delete kids y/n?

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users