BleepingComputer.com: No idea of what the infection is, sorry :(

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

No idea of what the infection is, sorry :( Everything slowed down suddenly

#1 User is offline   fordownloads 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 1
  • Joined: 16-July 09

Posted 16 July 2009 - 04:17 AM

-Everything was fine until suddenly the boot up started taking extra minutes, the applications and games run slowly.
-The boot time scan of avast dint go past 1% after 25 min.
-disk fragment too is taking a long long time and doesnt exceed 1%.
-system restore to a nearby day not working.
-It may be due to bad sectors but i'm sure i didnt have any before this happened.
Hope to get this sorted soon.. Thanks a lot in advance.. :thumbup2:


DDS (Ver_09-06-26.01) - NTFSx86
Run by Shyam & Sandeep at 14:37:28.53 on Thu 07/16/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.375.66 [GMT 5.5:30]

AV: avast! antivirus 4.8.1335 [VPS 090716-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Cisco Systems\CiscoTrustAgent\ctalogd.exe
C:\Program Files\Cisco Systems\CiscoTrustAgent\ctad.exe
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAMSUNG\Samsung Internet Keyboard\MMKbd.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Downloads\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uWindow Title =
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.hrvg.tk
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn0\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {A057A204-BACC-4D26-9A9E-3AF287E2699B} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [<NO NAME>]
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\intern~1.lnk - c:\program files\samsung\samsung internet keyboard\MMKbd.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\orbit.lnk - c:\program files\orbitdownloader\orbitdm.exe
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: &Search - http://edits.mywebsearch.com/toolbaredits/...html?p=ZJfox000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {36ECAF82-3300-8F84-092E-AFF36D6C7040} - {86529161-034E-4F8A-88D2-3C625E612E04} - c:\program files\winhttrack\WinHTTrackIEBar.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mic273~1\office12\REFIEBAR.DLL
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {32564D57-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv8ax.cab
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: ,
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\shyam&~1\applic~1\mozilla\firefox\profiles\6tkih6h6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1867226&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxp://www.gmail.com
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - component: c:\documents and settings\shyam & sandeep\application data\mozilla\firefox\profiles\6tkih6h6.default\extensions\{463f6ca5-ee3c-4be1-b7e6-7fee11953374}\platform\winnt\components\FoxyTunes.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\shyam & sandeep\local settings\application data\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV80Win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPLV82Win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nplv85win32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\system32\drivers\nipbcfk.sys [2007-7-10 15448]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-5-18 130424]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-5-3 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-5-3 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-3-25 138680]
R2 ctad;Cisco Trust Agent;c:\program files\cisco systems\ciscotrustagent\ctad.exe [2004-10-22 553035]
R2 ctalogd;Cisco Trust Agent Event Logging Service;c:\program files\cisco systems\ciscotrustagent\ctalogd.exe [2004-10-22 90112]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmkl.sys [2007-2-22 11552]
R2 NiViPxiK;NI-VISA PXI Driver;c:\windows\system32\drivers\NiViPxiKl.sys [2007-7-19 11360]
R2 RTWTKRNL;Real-Time Windows Target;c:\windows\system32\drivers\RTWTKRNL.sys [2008-8-21 28672]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-3-25 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-3-25 352920]
S3 Aickaud;Aickaud; [x]
S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2008-7-5 42376]
S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2008-7-5 66952]
S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2008-7-5 81288]
S3 lvalarmk;lvalarmk;c:\windows\system32\drivers\lvalarmk.sys [2007-1-11 20256]
S3 ni1006k;NI PXI-1006 Chassis Pilot;c:\windows\system32\drivers\ni1006k.sys [2007-2-22 25888]
S3 ni1045k;NI PXI-1045 Chassis Pilot;c:\windows\system32\drivers\ni1045kl.sys [2007-2-22 11552]
S3 ni1065k;NI PXIe-1065 Chassis Pilot;c:\windows\system32\drivers\ni1065k.sys [2007-5-25 22360]
S3 ni488lock;NI-488.2 Locking Service;c:\windows\system32\drivers\ni488lock.sys [2007-2-26 16672]
S3 nicdrk;nicdrk;c:\windows\system32\drivers\nicdrkl.sys [2007-7-15 11352]
S3 nidimk;nidimk;c:\windows\system32\drivers\nidimkl.sys [2007-7-12 11360]
S3 nidmxfk;nidmxfk;c:\windows\system32\drivers\nidmxfkl.sys [2007-7-13 11336]
S3 nidsark;nidsark;c:\windows\system32\drivers\nidsarkl.sys [2007-7-19 11344]
S3 niemrk;niemrk;c:\windows\system32\drivers\niemrkl.sys [2007-7-24 11336]
S3 niesrk;niesrk;c:\windows\system32\drivers\niesrkl.sys [2007-7-24 11336]
S3 nifslk;nifslk;c:\windows\system32\drivers\nifslkl.sys [2007-7-15 11352]
S3 nimru2k;nimru2k;c:\windows\system32\drivers\nimru2kl.sys [2007-7-24 11360]
S3 nimsdrk;nimsdrk;c:\windows\system32\drivers\nimsdrkl.sys [2007-7-18 11392]
S3 nimslk;nimslk;c:\windows\system32\drivers\nimslk.dll [2007-6-21 14464]
S3 nimsrlk;nimsrlk;c:\windows\system32\drivers\nimsrlk.dll [2007-6-21 151683]
S3 nimstsk;nimstsk;c:\windows\system32\drivers\nimstskl.sys [2007-7-13 11360]
S3 nimxpk;nimxpk;c:\windows\system32\drivers\nimxpkl.sys [2007-7-13 11368]
S3 ninshsdk;ninshsdk;c:\windows\system32\drivers\ninshsdkl.sys [2007-7-19 11360]
S3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [2007-7-18 11904]
S3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [2007-7-18 11896]
S3 nipxigpk;NI PXI Generic Chassis Pilot;c:\windows\system32\drivers\nipxigpk.sys [2007-2-22 20768]
S3 niscdk;niscdk;c:\windows\system32\drivers\niscdkl.sys [2007-7-19 11376]
S3 nisdigk;nisdigk;c:\windows\system32\drivers\nisdigkl.sys [2007-7-17 11352]
S3 nisftk;nisftk;c:\windows\system32\drivers\nisftkl.sys [2007-7-16 11344]
S3 nispdk;nispdk;c:\windows\system32\drivers\nispdkl.sys [2007-7-19 11376]
S3 nissrk;nissrk;c:\windows\system32\drivers\nissrkl.sys [2007-7-24 11336]
S3 nistc2k;nistc2k;c:\windows\system32\drivers\nistc2kl.sys [2007-7-15 11312]
S3 nistcrk;nistcrk;c:\windows\system32\drivers\nistcrkl.sys [2007-7-15 11360]
S3 niswdk;niswdk;c:\windows\system32\drivers\niswdkl.sys [2007-7-17 11336]
S3 nitiork;nitiork;c:\windows\system32\drivers\nitiorkl.sys [2007-7-18 11360]
S3 NiViFWK;NI-VISA FireWire Driver;c:\windows\system32\drivers\NiViFWKl.sys [2007-7-19 11384]
S3 NiViPciK;NI-VISA PCI Driver;c:\windows\system32\drivers\NiViPciKl.sys [2007-7-19 11360]
S3 niwfrk;niwfrk;c:\windows\system32\drivers\niwfrkl.sys [2007-7-24 11336]
S3 nixsrk;nixsrk;c:\windows\system32\drivers\nixsrkl.sys [2007-7-24 11336]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-7-5 348752]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-7-5 1095560]
S3 usb6xxxk;usb6xxxk; [x]
S3 XDS560;Texas Instruments XDS560 Device Driver;c:\windows\system32\drivers\xds560.sys --> c:\windows\system32\drivers\xds560.sys [?]
S4 DUMeterSvc;DU Meter Service; [x]
S4 ni488enumsvc;NI-488.2 Enumeration Service;c:\windows\system32\nipalsm.exe [2007-2-16 12696]
S4 nidevldu;NI Device Loader;c:\windows\system32\nipalsm.exe [2007-2-16 12696]

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2009-07-16 14:37 <DIR> --d----- c:\temp\RarSFX0
2009-07-16 14:03 <DIR> --d----- c:\temp\WPDNSE
2009-07-16 07:13 <DIR> --d----- c:\temp\nseF1.tmp
2009-07-16 07:09 <DIR> --d----- c:\temp\nsgED.tmp
2009-07-16 05:24 <DIR> --d----- c:\temp\plugtmp-36
2009-07-14 21:20 <DIR> --d----- c:\temp\plugtmp-35
2009-07-13 17:02 <DIR> --d----- c:\temp\{f7963ba0-ee1c-11d4-9fa5-00a0c9e6a342}
2009-07-12 09:14 20,480 a------- c:\windows\system32\H@tKeysH@@k.DLL
2009-07-11 13:29 38,160 a------- c:\windows\system32\LMRTREND.dll
2009-07-11 13:29 140,800 a------- c:\windows\system32\tm20dec.ax
2009-07-11 13:29 182,032 a------- c:\windows\system32\dxtmsft3.dll
2009-07-11 13:28 63,488 a------- c:\windows\system32\unam4ie.exe
2009-07-11 13:28 11,776 a------- c:\windows\system32\mciqtz.drv
2009-07-11 13:28 10,240 a------- c:\windows\system32\vidx16.dll
2009-07-11 13:28 5,672 a------- c:\windows\system32\quartz.vxd
2009-07-11 13:28 194,320 a------- c:\windows\system32\qcut.dll
2009-07-11 13:28 4,608 a------- c:\windows\system32\w95inf32.dll
2009-07-11 13:28 2,272 a------- c:\windows\system32\w95inf16.dll
2009-07-09 22:09 16,384 a------t c:\temp\Perflib_Perfdata_550.dat
2009-07-09 17:43 <DIR> --d----- c:\docume~1\shyam&~1\applic~1\ErrorSweeper
2009-07-09 08:52 45 a------- c:\temp\utt18.tmp.bat
2009-07-08 18:52 <DIR> --d----- c:\temp\plugtmp-34
2009-07-07 09:33 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-07-05 14:37 <DIR> --d----- C:\vb
2009-07-05 06:27 45 a------- c:\temp\utt7.tmp.bat
2009-07-03 09:21 <DIR> --d----- C:\alone
2009-07-01 17:08 16,384 a------t c:\temp\Perflib_Perfdata_77c.dat
2009-06-30 18:54 <DIR> --d----- C:\AloneInTheDark
2009-06-30 18:52 <DIR> --d----- c:\program files\DOSBox-0.73
2009-06-30 09:53 <DIR> --d----- c:\temp\plugtmp-33
2009-06-29 23:22 45 a------- c:\temp\utt79.tmp.bat
2009-06-29 14:09 <DIR> --d----- c:\temp\plugtmp-32
2009-06-29 08:46 <DIR> --d----- c:\temp\plugtmp-31
2009-06-27 21:40 16,384 a------t c:\temp\Perflib_Perfdata_ef8.dat
2009-06-26 17:25 <DIR> --d----- c:\temp\plugtmp-30
2009-06-26 09:46 16,384 a------t c:\temp\Perflib_Perfdata_f38.dat
2009-06-26 09:46 16,384 a------t c:\temp\Perflib_Perfdata_da0.dat
2009-06-25 22:50 <DIR> --d----- c:\temp\plugtmp-29
2009-06-24 21:17 <DIR> --d----- c:\temp\plugtmp-28
2009-06-22 09:32 21,504 a------- c:\windows\system32\hidserv.dll
2009-06-22 09:32 14,848 a------- c:\windows\system32\drivers\kbdhid.sys
2009-06-22 09:32 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-06-22 09:32 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-06-22 09:30 31,616 ac------ c:\windows\system32\dllcache\usbccgp.sys
2009-06-22 09:30 31,616 a------- c:\windows\system32\drivers\usbccgp.sys
2009-06-21 09:52 552 a------- c:\windows\system32\d3d8caps.dat
2009-06-18 02:26 45 a------- c:\temp\utt2B.tmp.bat
2009-06-17 22:01 <DIR> --d----- c:\temp\Excel8.0

==================== Find3M ====================

2009-05-28 12:45 197,120 a------- c:\windows\system32\3-D Salt Water Fish Tank Demo 2.scr
2009-05-02 00:00 3,366,912 a------- c:\windows\system32\GPhotos.scr
2009-04-22 06:02 98,304 a------- c:\windows\system32\CmdLineExt.dll
2008-12-10 21:49 226 a------- c:\program files\aliases2.txt
2008-07-05 21:57 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat
2008-06-24 10:00 24,192 a------- c:\documents and settings\shyam & sandeep\usbsermptxp.sys
2008-06-24 10:00 22,768 a------- c:\documents and settings\shyam & sandeep\usbsermpt.sys
2008-06-07 22:37 92,064 a------- c:\documents and settings\shyam & sandeep\mqdmmdm.sys
2008-06-07 22:37 79,328 a------- c:\documents and settings\shyam & sandeep\mqdmserd.sys
2008-06-07 22:37 66,656 a------- c:\documents and settings\shyam & sandeep\mqdmbus.sys
2008-06-07 22:37 9,232 a------- c:\documents and settings\shyam & sandeep\mqdmmdfl.sys
2008-06-07 22:37 6,208 a------- c:\documents and settings\shyam & sandeep\mqdmcmnt.sys
2008-06-07 22:37 5,936 a------- c:\documents and settings\shyam & sandeep\mqdmwhnt.sys
2008-06-07 22:37 4,048 a------- c:\documents and settings\shyam & sandeep\mqdmcr.sys
2001-11-23 09:38 712,704 a------- c:\windows\inf\other\AUDIO3D.DLL
1998-06-09 00:00 137,216 a------- c:\program files\common files\Msderun.dll
2009-03-02 12:16 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009030220090303\index.dat

============= FINISH: 14:38:30.85 ===============

Attached File(s)


#2 User is offline   sempai 

  • noypi
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Team
  • Posts: 5,161
  • Joined: 30-June 06
  • Gender:Male
  • Location:3 stars and a sun

Posted 26 July 2009 - 09:48 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.  

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine.  Please perform the following scan:
  • Download DDS by sUBs from one of the following links.  Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool.  No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note:  You may have to disable any script protection running if the scan fails to run.  After downloading the tool, disconnect from the internet and disable all antivirus protection.  Run the scan, enable your A/V and reconnect to the internet.  

Information on A/V control HERE
~Semp

Posted Image
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.
Member of UNITE (Unified Network of Instructors and Trained Eliminators) and ASAP (Alliance of Security Analysis Professionals)

#3 User is offline   Orange Blossom 

  • OBleepin Investigator
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Moderator
  • Posts: 29,822
  • Joined: 14-July 06
  • Gender:Not Telling
  • Location:Bloomington, IN

Posted 31 July 2009 - 07:40 PM

Due to the lack of feedback, this Topic is now closed.

In case you still have problems, please send me a Private message to reopen this topic within the next 5 days. Beyond that point, please start a new topic.

Orange Blossom :thumbup2:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom
An ounce of prevention is worth a pound of cure
SuperAntiSpyware, SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users