Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


pa crashes during virus scan

  • This topic is locked This topic is locked
2 replies to this topic

#1 purific


  • Members
  • 7 posts
  • Local time:08:25 PM

Posted 14 January 2009 - 07:40 PM

yahoo "anti-virus" (toolbar add-on) scan flagged up these:TRYMEDIA ; NETFIX;and KOOLY NOODY but said "unable to quarentine-administrative rights needed"...i then ran numerous scans including f-secure and Kaspersky and pc crashed on all "complete scan" attempts .a typical windows blu screen pops up very briefly with a "BAD POOL" message then shuts down completely.
i downloaded and ran CAs securty suite as they provide the anti spy toolbar scanner which found the bugs in the first place this ran successfully and flagged up the same bugs but wouldnt remove untill i subscribed which i didnt (false positive ??? ) pc is actually working ok and none of the usual signs of malware as yet i have the file paths for the above (if you want them i can post )
hereis the DDS notepad log :

DDS (Ver_09-01-07.01) - NTFSx86
Run by john at 23:31:07.10 on 2009-01-14
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2038.886 [GMT 0:00]

AV: Doctor Web Anti-Virus *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe
C:\Program Files\Creative\Creative Centrale\CTUPnPFn.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe
C:\Program Files\Creative\Software Update 3\SoftAuto.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\ORSP Client\fsorsp.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\Creative\Shared Files\AVCMANU.EXE
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Creative\Shared Files\AVCMANU.EXE
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\F-Secure Internet Security\FSGUI\scanwizard.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

============== Pseudo HJT Report ===============

uStart Page =
mStart Page = hxxp://uk.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
BHO: SuperAdBlockerBHO Class: {00000000-6c30-11d8-9363-000ae6309654} - c:\program files\superadblocker.com\super ad blocker\SABBHO.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: NoExplorer - No File
BHO: {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live OneCare Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows live\family safety\fssbho.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: NoExplorer - No File
BHO: {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: Super Ad Blocker Toolbar: {b4b3001e-0f56-4e51-8250-bde11547ec55} - c:\program files\superadblocker.com\super ad blocker\sabtb.dll
TB: {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
uRun: [SuperAdBlocker] c:\program files\superadblocker.com\super ad blocker\SAdBlock.exe
uRun: [SoftAuto.exe] "c:\program files\creative\software update 3\SoftAuto.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Desktop SMS] c:\program files\idm\desktop sms\DesktopSMS.exe /auto
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Skytel] Skytel.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [F-Secure Manager] "c:\program files\f-secure internet security\common\FSM32.EXE" /splash
mRun: [F-Secure TNB] "c:\program files\f-secure internet security\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW
dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
StartupFolder: c:\users\john\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\users\john\appdata\roaming\micros~1\windows\startm~1\programs\startup\wordweb.lnk - c:\program files\wordweb\wweb32.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4
IE: {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redire...1&site=home
IE: {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\programs\partygaming\partycasino\RunApp.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\programs\partygaming\partypoker\RunApp.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\npjpi160.dll
IE: {200DB664-75B5-47c0-8B45-A44ACCF73C00} - {D68926FD-18FD-4B0E-A1C7-917D13FAB760} - c:\program files\f-secure internet security\fspc\fspcmsie.dll
IE: {200DB664-75B5-47c0-8B45-A44ACCF73F01} - {D68926FD-18FD-4B0E-A1C7-917D13FAB760} - c:\program files\f-secure internet security\fspc\fspcmsie.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\f-secure internet security\fsps\program\FSLSP.DLL
Notify: !SABWinLogon - c:\program files\superadblocker.com\super ad blocker\SABWINLO.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000d7} - c:\program files\superadblocker.com\super ad blocker\SABSEHB.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\john\appdata\roaming\mozilla\firefox\profiles\k5tc7x1y.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.speedbit.com/
FF - prefs.js: keyword.URL - hxxp://search.speedbit.com/searchresults.asp?src=default&q=
FF - plugin: c:\program files\google\google updater\2.4.1368.5602\npCIDetect13.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll

============= SERVICES / DRIVERS ===============

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-1-13 30856]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\f-secure internet security\hips\drivers\fshs.sys [2009-1-13 66720]
R1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [2009-1-13 35552]
R1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-1-13 70944]
R1 fsvista;F-Secure Vista Support Driver;c:\program files\f-secure internet security\anti-virus\minifilter\fsvista.sys [2009-1-13 12384]
R1 SABKUTIL;SABKUTIL;c:\program files\superadblocker.com\super ad blocker\SABKUTIL.SYS [2007-2-20 32256]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\f-secure internet security\anti-virus\minifilter\fsgk.sys [2009-1-13 83080]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\f-secure internet security\orsp client\fsorsp.exe [2009-1-13 55904]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2008-2-18 252416]
R4 CTUPnPSv;Creative Centrale Media Server;c:\program files\creative\creative centrale\CTUPnPSv.exe [2008-5-21 64000]
R4 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2008-2-18 43816]
R4 fsssvc;Windows Live OneCare Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2007-12-17 523816]
S1 SABDIFSV;SABDIFSV;c:\program files\superadblocker.com\super ad blocker\sabdifsv.sys [2005-9-21 5632]
S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\PFC027.SYS [2006-12-5 507136]
S3 RkHit;RkHit;c:\windows\system32\drivers\RKHit.sys [2008-10-6 30080]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\f-secure internet security\anti-virus\win2k\fsfilter.sys [2009-1-13 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\f-secure internet security\anti-virus\win2k\fsrec.sys [2009-1-13 25184]

=============== Created Last 30 ================

2009-01-14 01:38 434,176 a------- c:\windows\system32\Mpeg2DecFilter.ax
2009-01-14 01:38 135,168 a------- c:\windows\system32\DVDIFOFilter.dll
2009-01-14 01:38 831,488 a------- c:\windows\system32\MpaDecFilter.ax
2009-01-14 01:38 376,832 a------- c:\windows\system32\AVAide_MpegSplitter.ax
2009-01-14 01:38 <DIR> --d----- c:\windows\system32\filters
2009-01-14 01:38 <DIR> --d----- c:\program files\Tipard Studio
2009-01-14 00:05 <DIR> --d----- c:\programdata\Creative
2009-01-14 00:05 <DIR> --d-h--- c:\programdata\{F80BA25A-BEA5-42AE-89A4-E9FC6C7E53FB}
2009-01-14 00:05 <DIR> --d-h--- c:\progra~2\{F80BA25A-BEA5-42AE-89A4-E9FC6C7E53FB}
2009-01-14 00:03 <DIR> --d-h--- c:\programdata\{6F4129E6-CEE8-4F75-B38C-A5F568103EE1}
2009-01-14 00:03 <DIR> --d-h--- c:\progra~2\{6F4129E6-CEE8-4F75-B38C-A5F568103EE1}
2009-01-14 00:01 38,422 a------- c:\windows\system32\drivers\StMp3Rec.sys
2009-01-14 00:01 <DIR> --d----- c:\program files\Creative
2009-01-13 21:52 288,768 a------- c:\windows\system32\drivers\srv.sys
2009-01-13 19:27 30,856 a------- c:\windows\system32\drivers\fsbts.sys
2009-01-13 19:17 <DIR> --d----- c:\users\john\appdata\roaming\F-Secure
2009-01-13 19:12 35,552 a------- c:\windows\system32\drivers\fses.sys
2009-01-13 19:12 572,512 a------- c:\windows\system32\msvcp50.dll
2009-01-13 19:12 70,944 a------- c:\windows\system32\drivers\fsdfw.sys
2009-01-13 19:10 <DIR> --d----- c:\program files\F-Secure Internet Security
2009-01-13 19:04 <DIR> --d----- c:\programdata\fssg
2009-01-13 19:04 <DIR> --d----- c:\progra~2\fssg
2009-01-13 19:02 <DIR> --d----- c:\programdata\f-secure
2009-01-13 19:02 <DIR> --d----- c:\progra~2\f-secure
2009-01-13 16:03 7 a------- c:\windows\system32\mkghj.dll
2009-01-13 16:01 128 a------- c:\windows\system32\drivers\kmxzone.u2k1
2009-01-13 16:01 28 a------- c:\windows\system32\drivers\kmxzone.u2k7
2009-01-13 16:01 28 a------- c:\windows\system32\drivers\kmxzone.u2k6
2009-01-13 16:01 28 a------- c:\windows\system32\drivers\kmxzone.u2k5
2009-01-13 16:01 28 a------- c:\windows\system32\drivers\kmxzone.u2k4
2009-01-13 16:01 28 a------- c:\windows\system32\drivers\kmxzone.u2k3
2009-01-13 16:01 28 a------- c:\windows\system32\drivers\kmxzone.u2k2
2009-01-13 16:01 28 a------- c:\windows\system32\drivers\kmxzone.u2k0
2009-01-13 16:00 <DIR> --d----- c:\users\john\appdata\roaming\CallingID
2009-01-13 15:51 <DIR> --d----- c:\programdata\Logs
2009-01-13 15:51 <DIR> --d----- c:\progra~2\Logs
2009-01-13 15:49 <DIR> --d----- c:\windows\Downloaded Installations
2009-01-13 15:47 <DIR> --d----- c:\windows\rnapxs
2009-01-13 11:24 <DIR> --d----- c:\users\john\appdata\roaming\SuperAdBlocker.com
2009-01-13 11:24 <DIR> --d----- c:\windows\system32\URTTemp
2009-01-13 11:24 <DIR> --d----- c:\program files\SuperAdBlocker.com
2009-01-12 23:55 <DIR> --d----- c:\users\john\appdata\roaming\Malwarebytes
2009-01-12 23:55 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-12 23:55 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-12 23:55 <DIR> --d----- c:\programdata\Malwarebytes
2009-01-12 23:55 <DIR> --d----- c:\progra~2\Malwarebytes
2009-01-12 23:55 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-12 13:18 <DIR> --d----- c:\programdata\WindowsSearch
2009-01-12 12:41 <DIR> --d----- c:\programdata\Doctor Web
2009-01-12 12:41 <DIR> --d----- c:\progra~2\Doctor Web
2009-01-12 12:41 <DIR> --d----- c:\program files\DrWeb
2009-01-12 11:52 <DIR> --d----- c:\users\john\DoctorWeb
2009-01-12 07:23 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-01-12 01:38 <DIR> --d----- C:\ComboFix
2009-01-12 01:38 318,976 a------- c:\windows\system32\CF21344.exe
2009-01-12 01:20 161,792 a------- c:\windows\SWREG.exe
2009-01-12 01:20 98,816 a------- c:\windows\sed.exe
2009-01-11 22:23 <DIR> --d----- c:\programdata\SUPERAntiSpyware.com
2009-01-11 22:23 <DIR> --d----- c:\progra~2\SUPERAntiSpyware.com
2009-01-11 22:22 <DIR> --d----- c:\users\john\appdata\roaming\SUPERAntiSpyware.com
2009-01-11 22:22 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-01-11 11:51 598 a------- c:\windows\wininit.ini
2009-01-11 00:26 <DIR> --d----- c:\program files\SpeedBit Video Accelerator
2009-01-11 00:23 <DIR> --d----- c:\programdata\SpeedBit
2009-01-11 00:23 <DIR> --d----- c:\progra~2\SpeedBit
2009-01-11 00:23 479,298 a------- c:\windows\system32\wbocx.ocx
2009-01-11 00:23 172,032 a------- c:\windows\system32\AniGIF.ocx
2009-01-11 00:23 50,688 a------- c:\windows\system32\wbhelp2.dll
2009-01-10 12:16 <DIR> --d----- c:\users\john\{23e799f3-d667-4856-81dd-513e250b8c4e}
2009-01-10 12:15 <DIR> --d----- c:\program files\common files\PCSuite
2009-01-10 12:14 18,816 a------- c:\windows\system32\drivers\pccsmcfd.sys
2009-01-10 12:14 <DIR> --d----- c:\program files\PC Connectivity Solution
2009-01-10 02:27 675,840 a------- c:\windows\system32\AudioGenie24.ocx
2009-01-10 02:27 <DIR> --d----- c:\program files\Duplicate Cleaner
2009-01-10 00:50 737,280 a------- c:\windows\iun6002.exe
2009-01-10 00:50 <DIR> --d----- c:\program files\Codec Pack - All In 1
2009-01-10 00:27 <DIR> --d----- C:\audiograbber
2009-01-10 00:04 <DIR> --d----- c:\programdata\NOS
2009-01-09 23:19 561,152 a------- c:\windows\system32\xvidcore.dll
2009-01-09 23:19 159,744 a------- c:\windows\system32\xvidvfw.dll
2009-01-09 23:19 <DIR> --d----- c:\program files\Xvid
2009-01-09 21:37 620 a------- c:\windows\RegGenie.ini
2009-01-09 12:33 158,720 a------- c:\windows\RegGenieOnUninstall.exe
2009-01-09 12:14 <DIR> --d----- c:\program files\VideoLAN
2009-01-07 19:30 2,048 a------- c:\windows\system32\tzres.dll
2009-01-07 14:26 296,960 a------- c:\windows\system32\gdi32.dll
2009-01-07 14:25 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-01-07 14:25 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-01-07 14:24 2,927,104 a------- c:\windows\explorer.exe
2009-01-07 14:23 827,392 a------- c:\windows\system32\wininet.dll
2009-01-07 14:23 2,868,736 a------- c:\windows\system32\mf.dll
2009-01-07 14:23 996,352 a------- c:\windows\system32\WMNetMgr.dll
2009-01-07 14:23 94,720 a------- c:\windows\system32\logagent.exe

==================== Find3M ====================

2009-01-13 15:50 143,360 a------- c:\windows\inf\infstrng.dat
2009-01-13 15:50 51,200 a------- c:\windows\inf\infpub.dat
2009-01-13 15:50 86,016 a------- c:\windows\inf\infstor.dat
2008-12-11 00:33 200,704 a------- c:\windows\system32\dtu100.dll
2008-12-11 00:33 86,016 a------- c:\windows\system32\dpl100.dll
2008-12-09 02:28 593,920 a------- c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 344,064 a------- c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 a------- c:\windows\system32\dpu11.dll
2008-12-09 02:28 57,344 a------- c:\windows\system32\dpv11.dll
2008-11-29 16:59 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-11-29 15:14 0 a---h--- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2008-11-29 15:13 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-11-06 16:37 3,596,288 a------- c:\windows\system32\qt-dx331.dll
2008-11-06 16:35 1,044,480 a------- c:\windows\system32\libdivx.dll
2008-11-06 16:35 200,704 a------- c:\windows\system32\ssldivx.dll
2008-11-06 16:33 823,296 a------- c:\windows\system32\divx_xx0c.dll
2008-11-06 16:33 823,296 a------- c:\windows\system32\divx_xx07.dll
2008-11-06 16:33 815,104 a------- c:\windows\system32\divx_xx0a.dll
2008-11-06 16:33 802,816 a------- c:\windows\system32\divx_xx11.dll
2008-11-06 16:33 684,032 a------- c:\windows\system32\DivX.dll
2008-11-06 16:33 12,288 a------- c:\windows\system32\DivXWMPExtType.dll
2008-11-01 03:44 52,736 a------- c:\windows\apppatch\iebrshim.dll
2008-11-01 03:44 2,154,496 a------- c:\windows\apppatch\AcGenral.dll
2008-11-01 03:44 541,696 a------- c:\windows\apppatch\AcLayers.dll
2008-11-01 03:44 460,288 a------- c:\windows\apppatch\AcSpecfc.dll
2008-11-01 03:44 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2008-10-22 03:57 241,152 a------- c:\windows\system32\PortableDeviceApi.dll
2008-10-21 05:25 1,645,568 a------- c:\windows\system32\connect.dll
2008-09-22 10:25 174 a--sh--- c:\program files\desktop.ini
2008-09-22 10:16 665,600 a------- c:\windows\inf\drvindex.dat
2008-02-24 11:11 32 a------- c:\programdata\ezsid.dat
2008-02-24 11:11 32 a------- c:\progra~2\ezsid.dat
2006-11-02 12:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 12:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 09:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 23:34:06.29 ===============

Attached Files

BC AdBot (Login to Remove)


#2 Hoov


  • Malware Response Team
  • 3,519 posts
  • Location:Mikado Michigan
  • Local time:04:25 PM

Posted 29 January 2009 - 11:24 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.
Also please explain your problem as fully as possible. Each little detail will help in getting your system cleaned up and functional again.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scans:

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.

* Download DDS by sUBs from one of the following links. Save it to your desktop.

* Double click on the DDS icon, allow it to run.
* A small box will open, with an explaination about the tool. No input is needed, the scan is running.
* Notepad will open with the results, click no to the Optional_Scan
* Follow the instructions that pop up for posting the results.
* Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE
Visiting From SpywareHammer.com and DonHoover.net

Tilting at windmills hurts you more than the windmills.
-From the Notebooks of Lazarus Long
Senior of the Howard Families

Posted Image

#3 Hoov


  • Malware Response Team
  • 3,519 posts
  • Location:Mikado Michigan
  • Local time:04:25 PM

Posted 07 February 2009 - 09:17 PM

This thread is closed due to inactivity.
If you need this topic reopened, please send me or another moderator a PM. This applies to the thread originator only, all others start a new thread.
Visiting From SpywareHammer.com and DonHoover.net

Tilting at windmills hurts you more than the windmills.
-From the Notebooks of Lazarus Long
Senior of the Howard Families

Posted Image

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users