Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

not sure what infected with,desktop keeps freezing up


  • This topic is locked This topic is locked
5 replies to this topic

#1 enigmasean

enigmasean

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tucson,Arizona
  • Local time:01:47 PM

Posted 04 May 2009 - 08:28 AM

I log onto my desktop,takes forever to finish loading.Then I'll open a window,it freezes 1 min or so goes by,then works.same thing with web browser.hard drive light goin a mile a min,but cant seem to locate what exactly is running my pc so much.I've ran AV,rootkit eliminaters,malware apps,spybot will not load,but is present in lwr right of task bar.At a miss here.


DDS (Ver_09-03-16.01) - NTFSx86
Run by slowery at 5:54:01.67 on Mon 05/04/2009
Internet Explorer: 8.0.6001.18702
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2939.1310 [GMT -7:00]

AV: Norton 360 *On-access scanning enabled* (Outdated)
AV: AVG 7.5.557 *On-access scanning enabled* (Updated)
FW: Norton 360 *enabled*

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Windows\system32\taskeng.exe
c:\program files\windows defender\MpCmdRun.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgrssvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\spoolsv.exe
C:\UTILCD\PrivacyProtector.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\UTILCD\VistaManager.exe
D:\ZIPS\HIJACK.EXE
C:\Users\slowery\AppData\Local\Temp\RarSFX0\HJACK.exe
C:\Program Files\Cricket\QuickLink Mobile\QuickLink Mobile.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\RacAgent.exe
C:\Windows\system32\sfc.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Users\slowery\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uURLSearchHooks: P2P Torrent Toolbar: {bc4be15d-6a34-4356-9e97-79e43da32b1d} - c:\program files\p2p_torrent\tbP2P_.dll
mURLSearchHooks: P2P Torrent Toolbar: {bc4be15d-6a34-4356-9e97-79e43da32b1d} - c:\program files\p2p_torrent\tbP2P_.dll
BHO: IE7Pro BHO: {00011268-e188-40df-a514-835fcd78b1bf} - c:\program files\iepro\iepro.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: P2P Torrent Toolbar: {bc4be15d-6a34-4356-9e97-79e43da32b1d} - c:\program files\p2p_torrent\tbP2P_.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: P2P Torrent Toolbar: {bc4be15d-6a34-4356-9e97-79e43da32b1d} - c:\program files\p2p_torrent\tbP2P_.dll
TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [DownloadAccelerator] "c:\program files\dap\DAP.EXE" /STARTUP
uRun: [SmartRAM] "c:\program files\iobit\advanced systemcare 3\Sup_SmartRAM.exe" /m
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [Hide IP Platinum] c:\program files\hide ip platinum\hideippla.exe
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
StartupFolder: c:\users\slowery\appdata\roaming\micros~1\windows\startm~1\programs\startup\bittor~1.lnk - c:\program files\bittorrent acceleration patch\BitTorrent Acceleration Patch.exe
uPolicies-explorer: NoControlPanel = 1 (0x1)
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-explorer: NoSecurityTab = 1 (0x1)
uPolicies-explorer: NoFileAssociate = 1 (0x1)
uPolicies-explorer: NoInstrumentation = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-explorer: NoWelcomeScreen = 1 (0x1)
mPolicies-explorer: RestrictWelcomeCenter = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: DisplayLastLogonInfo = 1 (0x1)
mPolicies-system: EnableLUA = 2 (0x2)
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: {000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files\iepro\iepro.dll
IE: {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - {B119EB0C-C021-46CF-85B0-34A760E0D5FE} - c:\program files\iepro\iepro.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
TCP: {7BA02856-F2B3-4A0D-89EE-BAB18E37A5F4} = 172.28.221.53 172.28.221.54
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\dap\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\dap\dapie.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgwlntf - avgwlntf.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\slowery\appdata\roaming\mozilla\firefox\profiles\b5lgawnu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT1210541&SearchSource=13
FF - component: c:\program files\dap\dapfirefox\components\DAPFireFox.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - component: c:\users\slowery\appdata\roaming\mozilla\firefox\profiles\b5lgawnu.default\extensions\{bc4be15d-6a34-4356-9e97-79e43da32b1d}\components\FFAlert.dll

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-8-14 7168]
R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2008-4-28 3658752]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S3 ATMFBUS;A600 USB Composite Device Driver;c:\windows\system32\drivers\ATMFBUS.sys [2009-3-24 38528]
S3 ATMFCVsp;A600 Cricket CM Port;c:\windows\system32\drivers\ATMFCVsp.sys [2009-3-24 54656]
S3 ATMFFLT;A600 USB Modem Installation CD;c:\windows\system32\drivers\ATMFFLT.sys [2009-3-24 11520]
S3 ATMFMdm;A600 Cricket EVDO Modem;c:\windows\system32\drivers\ATMFMdm.sys [2009-3-24 54528]
S3 ATMFNET;A600 Cricket EVDO Network Adapter;c:\windows\system32\drivers\ATMFNET.sys [2009-3-24 103424]
S3 ATMFNVsp;A600 Cricket NMEA Port Serial Port;c:\windows\system32\drivers\ATMFNVsp.sys [2009-3-24 54656]
S3 ATMFVsp;A600 Cricket Diagnostics Port;c:\windows\system32\drivers\ATMFVsp.sys [2009-3-24 54656]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
S3 SVRPEDRV;SVRPEDRV;c:\windows\system32\sysprep\PEDRV.SYS [2008-8-20 9216]

=============== Created Last 30 ================

2009-05-04 04:08 <DIR> --d----- c:\users\slowery\appdata\roaming\X-Setup Pro
2009-05-04 04:08 <DIR> --d----- c:\programdata\X-Setup Pro
2009-05-04 04:08 <DIR> --d----- c:\progra~2\X-Setup Pro
2009-05-04 04:08 <DIR> --d----- C:\UTILCD
2009-05-02 21:18 <DIR> --d----- c:\program files\GSC 2.00
2009-05-02 21:13 <DIR> --d----- c:\program files\Conduit
2009-05-02 21:13 <DIR> --d----- c:\program files\P2P_Torrent
2009-05-02 21:12 <DIR> --d----- c:\program files\BitTorrent Acceleration Patch
2009-05-02 20:51 <DIR> --d----- c:\users\slowery\appdata\roaming\GSC 2.00
2009-05-01 21:17 <DIR> --d----- c:\program files\IEPro
2009-04-30 02:11 <DIR> --dsh--- c:\windows\system32\%APPDATA%
2009-04-29 01:29 <DIR> --d----- c:\programdata\SUPERAntiSpyware.com
2009-04-29 01:29 <DIR> --d----- c:\progra~2\SUPERAntiSpyware.com
2009-04-29 01:28 <DIR> --d----- c:\users\slowery\appdata\roaming\SUPERAntiSpyware.com
2009-04-29 01:28 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-04-29 01:25 <DIR> --d----- c:\programdata\Spybot - Search & Destroy
2009-04-29 01:25 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-04-29 01:25 <DIR> --d----- c:\progra~2\Spybot - Search & Destroy
2009-04-27 22:27 161,792 a------- c:\windows\SWREG.exe
2009-04-27 22:27 98,816 a------- c:\windows\sed.exe
2009-04-26 00:47 <DIR> --d----- c:\windows\pss
2009-04-24 10:18 <DIR> --d----- c:\programdata\PC Drivers HeadQuarters
2009-04-24 10:18 <DIR> --d----- c:\progra~2\PC Drivers HeadQuarters
2009-04-24 10:03 <DIR> --d----- c:\users\slowery\appdata\roaming\IObit
2009-04-24 10:03 <DIR> --d----- c:\program files\IObit
2009-04-24 09:59 <DIR> --d----- c:\programdata\Yahoo! Companion
2009-04-24 09:59 <DIR> --d----- c:\program files\Yahoo!
2009-04-24 01:36 <DIR> --d----- c:\users\slowery\appdata\roaming\360desktop
2009-04-24 01:36 <DIR> --d----- c:\program files\360desktop
2009-04-24 01:36 426 a------- c:\windows\{21D15DED-F125-46C8-8017-CB9F1CEB5B4D}_WiseFW.ini
2009-04-24 01:34 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-04-24 00:51 <DIR> --d----- c:\users\slowery\appdata\roaming\Malwarebytes
2009-04-24 00:51 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-24 00:51 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-24 00:51 <DIR> --d----- c:\programdata\Malwarebytes
2009-04-24 00:51 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-24 00:51 <DIR> --d----- c:\progra~2\Malwarebytes
2009-04-23 20:35 <DIR> --d----- c:\windows\system32\tempdir
2009-04-23 20:35 <DIR> --d----- c:\program files\Free Easy Word to Pdf Converter
2009-04-22 00:24 <DIR> --d--r-- c:\program files\Skype
2009-04-19 17:29 <DIR> --d----- c:\programdata\SpeedBit
2009-04-19 17:29 <DIR> --d----- c:\progra~2\SpeedBit
2009-04-19 17:28 479,298 a------- c:\windows\system32\wbocx.ocx
2009-04-19 17:28 172,032 a------- c:\windows\system32\AniGIF.ocx
2009-04-19 17:28 50,688 a------- c:\windows\system32\wbhelp2.dll
2009-04-19 17:28 <DIR> --d----- c:\program files\DAP
2009-04-19 17:08 <DIR> --d----- c:\users\slowery\appdata\roaming\DMCache
2009-04-19 01:16 <DIR> --d----- c:\program files\MediaMonkey
2009-04-18 23:51 551,424 a------- c:\windows\system32\rpcss.dll
2009-04-18 23:51 3,599,328 a------- c:\windows\system32\ntkrnlpa.exe
2009-04-18 23:51 3,547,632 a------- c:\windows\system32\ntoskrnl.exe
2009-04-18 23:51 666,624 a------- c:\windows\system32\printfilterpipelinesvc.exe
2009-04-18 23:51 183,296 a------- c:\windows\system32\sdohlp.dll
2009-04-18 23:51 98,304 a------- c:\windows\system32\iasrecst.dll
2009-04-18 23:51 54,784 a------- c:\windows\system32\iasads.dll
2009-04-18 23:51 44,032 a------- c:\windows\system32\iasdatastore.dll
2009-04-18 23:51 26,112 a------- c:\windows\system32\printfilterpipelineprxy.dll
2009-04-18 23:51 17,408 a------- c:\windows\system32\iashost.exe
2009-04-18 23:49 1,255,936 a------- c:\windows\system32\lsasrv.dll
2009-04-18 23:49 72,704 a------- c:\windows\system32\secur32.dll
2009-04-18 23:49 24,064 a------- c:\windows\system32\amxread.dll
2009-04-18 23:49 13,824 a------- c:\windows\system32\apilogen.dll
2009-04-18 21:46 562,176 a------- c:\windows\system32\msdtcprx.dll
2009-04-18 21:46 38,912 a------- c:\windows\system32\xolehlp.dll
2009-04-18 21:42 376,832 a------- c:\windows\system32\winhttp.dll
2009-04-17 19:08 <DIR> -cd-hr-- C:\$VAULT$.AVG
2009-04-17 11:59 <DIR> --d----- c:\windows\SSMaui Wowee
2009-04-17 11:59 49,664 a------- c:\windows\SSMaui Wowee.scr
2009-04-17 11:57 802,816 a------- c:\windows\FeedingFrenzy.scr
2009-04-17 11:55 57,344 a------- c:\windows\system32\Big Kahuna Reef.scr
2009-04-17 11:54 389,120 a------- c:\windows\Adventure Inlay.scr
2009-04-17 11:54 <DIR> --d----- c:\program files\GameHouse Games Collection
2009-04-17 07:38 0 a---h--- c:\windows\system32\drivers\Msft_User_ZuneDriver_01_07_00.Wdf
2009-04-17 07:38 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf
2009-04-16 20:51 <DIR> --d----- c:\users\slowery\appdata\roaming\Lexmark Productivity Studio
2009-04-16 20:51 <DIR> --d----- c:\programdata\lx_cats
2009-04-16 20:51 <DIR> --d----- c:\progra~2\lx_cats
2009-04-16 20:44 <DIR> --d----- c:\program files\Abbyy FineReader 6.0 Sprint
2009-04-16 20:31 <DIR> --d----- c:\program files\Microsoft Visual Studio 8
2009-04-16 19:47 603,904 a------- c:\windows\system32\TUProgSt.exe
2009-04-16 19:47 27,904 a------- c:\windows\system32\uxtuneup.dll
2009-04-16 19:47 17,152 a------- c:\windows\system32\authuitu.dll
2009-04-16 19:47 362,240 a------- c:\windows\system32\TuneUpDefragService.exe
2009-04-16 19:47 <DIR> --d----- c:\users\slowery\appdata\roaming\TuneUp Software
2009-04-16 19:46 <DIR> --d----- c:\programdata\TuneUp Software
2009-04-16 19:46 <DIR> --d----- c:\program files\TuneUp Utilities 2009
2009-04-16 19:46 <DIR> --d----- c:\progra~2\TuneUp Software
2009-04-16 19:44 32 a------- c:\windows\go
2009-04-16 19:43 <DIR> --d----- c:\windows\vf_hip
2009-04-16 19:43 <DIR> --d----- c:\program files\Hide IP Platinum
2009-04-16 19:25 <DIR> --d----- c:\programdata\WindowsSearch
2009-04-16 18:34 <DIR> --d----- c:\program files\common files\xing shared
2009-04-14 00:29 <DIR> --d----- c:\users\slowery\appdata\roaming\Smith Micro
2009-04-14 00:24 110,848 a------- c:\windows\system32\drivers\uts_mdm.sys
2009-04-14 00:24 90,880 a------- c:\windows\system32\drivers\uts_serd.sys
2009-04-14 00:24 84,352 a------- c:\windows\system32\drivers\uts_bus.sys
2009-04-14 00:24 14,976 a------- c:\windows\system32\drivers\uts_mdfl.sys
2009-04-14 00:24 12,160 a------- c:\windows\system32\drivers\uts_whnt.sys
2009-04-14 00:24 12,160 a------- c:\windows\system32\drivers\uts_wh.sys
2009-04-14 00:24 12,160 a------- c:\windows\system32\drivers\uts_cmnt.sys
2009-04-14 00:24 12,160 a------- c:\windows\system32\drivers\uts_cm.sys
2009-04-14 00:24 <DIR> --d----- c:\program files\UTStarcom
2009-04-12 15:20 131,072 a------- c:\windows\system32\Ikeext.etl

==================== Find3M ====================

2009-04-23 20:24 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-21 22:23 143,360 a------- c:\windows\inf\infstrng.dat
2009-04-21 22:23 51,200 a------- c:\windows\inf\infpub.dat
2009-04-21 22:23 86,016 a------- c:\windows\inf\infstor.dat
2009-03-24 16:06 9,216 a------- c:\windows\system32\avgwlntf.dll
2009-03-24 04:03 7,808 a------- c:\windows\system32\drivers\psi_mf.sys
2009-03-16 20:38 40,960 a------- c:\windows\apppatch\apihex86.dll
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 109,056 a------- c:\windows\system32\iesysprep.dll
2009-03-08 04:33 109,568 a------- c:\windows\system32\PDMSetup.exe
2009-03-08 04:33 132,608 a------- c:\windows\system32\ieUnatt.exe
2009-03-08 04:33 107,520 a------- c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 04:33 107,008 a------- c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 04:33 103,936 a------- c:\windows\system32\SetDepNx.exe
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:32 66,560 a------- c:\windows\system32\wextract.exe
2009-03-08 04:32 169,472 a------- c:\windows\system32\iexpress.exe
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 08:06 140,800 a------- c:\windows\system32\drivers\Rtlh86.sys
2009-03-05 05:54 73,728 a------- c:\windows\system32\RtNicProp32.dll
2009-02-21 19:19 202,352 a------- c:\windows\system32\PnkBstrB.exe
2009-02-21 19:19 66,872 a------- c:\windows\system32\PnkBstrA.exe
2009-02-08 20:10 2,033,152 a------- c:\windows\system32\win32k.sys
2009-01-04 05:22 56 a---h--- c:\programdata\ezsidmv.dat
2009-01-04 05:22 56 a---h--- c:\progra~2\ezsidmv.dat
2008-10-27 08:38 95,056 a------- c:\users\slowery\DSETUP.dll
2008-10-27 08:37 1,692,496 a------- c:\users\slowery\dsetup32.dll
2008-08-14 12:49 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-20 19:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 5:57:34.87 ===============

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:25:14 AM, on 5/4/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Windows\system32\taskeng.exe
c:\program files\windows defender\MpCmdRun.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgrssvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\spoolsv.exe
C:\UTILCD\PrivacyProtector.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\UTILCD\VistaManager.exe
D:\ZIPS\HIJACK.EXE
C:\Users\slowery\AppData\Local\Temp\RarSFX0\HJACK.exe
C:\Program Files\Cricket\QuickLink Mobile\QuickLink Mobile.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: P2P Torrent Toolbar - {bc4be15d-6a34-4356-9e97-79e43da32b1d} - C:\Program Files\P2P_Torrent\tbP2P_.dll
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: BitTorrent Acceleration Patch.lnk = C:\Program Files\BitTorrent Acceleration Patch\BitTorrent Acceleration Patch.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{7BA02856-F2B3-4A0D-89EE-BAB18E37A5F4}: NameServer = 172.28.221.53 172.28.221.54
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: McAfee Application Installer Cleanup (0046281240228326) (0046281240228326mcinstcleanup) - Unknown owner - C:\Users\slowery\AppData\Local\Temp\004628~1.EXE (file missing)
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgrssvc.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MOOO - Unknown owner - C:\Users\slowery\AppData\Local\Temp\MOOO.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: RI - Unknown owner - C:\Users\slowery\AppData\Local\Temp\RI.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SmartFaceVWatchSrv - Unknown owner - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe (file missing)
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 10834 bytes

Attached Files



BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,801 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:47 PM

Posted 17 May 2009 - 04:37 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results, click no to the Optional_Scan
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. You can find information on A/V control HERE

Orange Blossom :thumbup2:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 enigmasean

enigmasean
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tucson,Arizona
  • Local time:01:47 PM

Posted 17 May 2009 - 08:10 PM

DDS (Ver_09-05-14.01) - NTFSx86
Run by slowery at 18:02:51.66 on Sun 05/17/2009
Internet Explorer: 8.0.6001.18702
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2939.1655 [GMT -7:00]

AV: Norton 360 *On-access scanning enabled* (Outdated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
AV: AVG 7.5.557 *On-access scanning enabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Norton 360 *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgrssvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Windows\System32\TUProgSt.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\taskeng.exe
C:\Windows\explorer.exe
C:\Program Files\MediaMonkey\MediaMonkey.exe
C:\Program Files\Cricket\QuickLink Mobile\QuickLink Mobile.exe
C:\Windows\system32\SndVol.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\slowery\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
mSearch Page = hxxp://www.google.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: IE7Pro: {00011268-e188-40df-a514-835fcd78b1bf} - IE7Pro BHO
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [DownloadAccelerator] "c:\program files\dap\DAP.EXE" /STARTUP
uRun: [SmartRAM] "c:\program files\iobit\advanced systemcare 3\Sup_SmartRAM.exe" /m
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
uRun: [Persistence] c:\windows\system32\igfxpers.exe
uRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
uRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
uRun: [DLD.EXE] c:\program files\download direct\DLD.exe
uRun: [BitTorrent] "c:\program files\bittorrent\bittorrent.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [AVG7_CC] c:\progra~1\grisoft\avgfre~1\avgcc.exe /STARTUP
mRun: [ToshibaServiceStation] "c:\program files\toshiba\toshiba service station\TSS.exe" /hide
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [AVG7_Run] c:\progra~1\grisoft\avgfre~1\avgw.exe /RUNONCE
StartupFolder: c:\users\slowery\appdata\roaming\micros~1\windows\startm~1\programs\startup\quickl~1.lnk - c:\program files\cricket\quicklink mobile\QuickLink Mobile.exe
uPolicies-explorer: NoInstrumentation = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: DisplayLastLogonInfo = 1 (0x1)
mPolicies-system: EnableLUA = 2 (0x2)
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49}
IE: {000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709}
IE: {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - {B119EB0C-C021-46CF-85B0-34A760E0D5FE}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
TCP: {8A0BD692-752E-4FA7-9012-930263E1EF5A} = 172.28.221.53 172.28.221.54
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} -
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} -
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgwlntf - avgwlntf.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\slowery\appdata\roaming\mozilla\firefox\profiles\b5lgawnu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1210541&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\users\slowery\appdata\roaming\mozilla\firefox\profiles\b5lgawnu.default\extensions\{bc4be15d-6a34-4356-9e97-79e43da32b1d}\components\FFAlert.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-7-10 40960]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-4-29 1153368]
R2 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2008-8-14 46392]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-4-16 603904]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-8-14 7168]
R3 NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit ;c:\windows\system32\drivers\NETw5v32.sys [2008-4-28 3658752]
R3 uts_bus;UTStarcom USB Composite Device driver (WDM);c:\windows\system32\drivers\uts_bus.sys [2009-4-14 84352]
R3 uts_mdfl;UTStarcom USB Modem Filter;c:\windows\system32\drivers\uts_mdfl.sys [2009-4-14 14976]
R3 uts_mdm;UTStarcom USB Modem Drivers;c:\windows\system32\drivers\uts_mdm.sys [2009-4-14 110848]
R3 uts_serd;UTStarcom USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\uts_serd.sys [2009-4-14 90880]
S2 0046281240228326mcinstcleanup;McAfee Application Installer Cleanup (0046281240228326);c:\users\slowery\appdata\local\temp\004628~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\users\slowery\appdata\local\temp\004628~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S3 ATMFBUS;A600 USB Composite Device Driver;c:\windows\system32\drivers\ATMFBUS.sys [2009-3-24 38528]
S3 ATMFCVsp;A600 Cricket CM Port;c:\windows\system32\drivers\ATMFCVsp.sys [2009-3-24 54656]
S3 ATMFFLT;A600 USB Modem Installation CD;c:\windows\system32\drivers\ATMFFLT.sys [2009-3-24 11520]
S3 ATMFMdm;A600 Cricket EVDO Modem;c:\windows\system32\drivers\ATMFMdm.sys [2009-3-24 54528]
S3 ATMFNET;A600 Cricket EVDO Network Adapter;c:\windows\system32\drivers\ATMFNET.sys [2009-3-24 103424]
S3 ATMFNVsp;A600 Cricket NMEA Port Serial Port;c:\windows\system32\drivers\ATMFNVsp.sys [2009-3-24 54656]
S3 ATMFVsp;A600 Cricket Diagnostics Port;c:\windows\system32\drivers\ATMFVsp.sys [2009-3-24 54656]
S3 MOOO;MOOO;c:\users\slowery\appdata\local\temp\mooo.exe --> c:\users\slowery\appdata\local\temp\MOOO.exe [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
S3 RI;RI;c:\users\slowery\appdata\local\temp\ri.exe --> c:\users\slowery\appdata\local\temp\RI.exe [?]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;"c:\program files\toshiba\smartfacev\smartfacevwatchsrv.exe" --> c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [?]
S3 SVRPEDRV;SVRPEDRV;c:\windows\system32\sysprep\PEDRV.SYS [2008-8-20 9216]

=============== Created Last 30 ================

2009-05-17 07:33 <DIR> --d----- c:\users\slowery\appdata\roaming\Splitscreen Studios
2009-05-16 05:18 <DIR> --d----- c:\users\slowery\Games
2009-05-16 05:13 <DIR> --d----- c:\programdata\PMB Files
2009-05-16 05:13 <DIR> --d----- c:\progra~2\PMB Files
2009-05-16 05:11 <DIR> --d----- c:\program files\Pando Networks
2009-05-16 01:58 0 a------- c:\windows\system32\NeroCopyGadgetData-9806.xml
2009-05-13 12:41 876 a------- c:\windows\$_hpcst$.hpc
2009-05-12 16:43 <DIR> --d----- c:\programdata\Apple Computer
2009-05-08 05:48 <DIR> --d----- c:\program files\hkSFV
2009-05-06 08:00 26 a------- c:\windows\popcinfo.dat
2009-05-06 07:40 <DIR> --d----- c:\users\slowery\appdata\roaming\EA
2009-05-06 07:39 <DIR> --d----- c:\programdata\EA
2009-05-06 07:39 <DIR> --d----- c:\progra~2\EA
2009-05-06 06:53 <DIR> --d----- c:\program files\Download Direct
2009-05-06 05:36 23,552 a------- c:\users\slowery\xobglu32.dll
2009-05-06 05:36 63,488 a------- c:\users\slowery\xobglu16.dll
2009-05-06 05:30 2,124,288 a------- c:\windows\system32\QuickTimeMusicalInstruments.qtx
2009-05-06 05:30 969,216 a------- c:\windows\system32\qd3d.dll
2009-05-06 05:30 747,008 a------- c:\windows\system32\Indeo4.qtx
2009-05-06 05:30 596,992 a------- c:\windows\system32\rave.dll
2009-05-06 05:30 253,952 a------- c:\windows\system32\QD3D_IR2.q3x
2009-05-06 05:30 202,240 a------- c:\windows\system32\QuickTime.cpl
2009-05-06 05:30 126,976 a------- c:\windows\system32\3DViewer.dll
2009-05-06 05:30 44,032 a------- c:\windows\system32\QD3DCustomElements.q3x
2009-05-06 05:30 27,136 a------- c:\windows\system32\QTUninst.dll
2009-05-06 05:27 299,008 a------- c:\windows\uninst.exe
2009-05-04 04:08 <DIR> --d----- c:\users\slowery\appdata\roaming\X-Setup Pro
2009-05-04 04:08 <DIR> --d----- c:\programdata\X-Setup Pro
2009-05-04 04:08 <DIR> --d----- c:\progra~2\X-Setup Pro
2009-05-04 04:08 <DIR> --d----- C:\UTILCD
2009-05-02 21:18 <DIR> --d----- c:\program files\GSC 2.00
2009-05-02 20:51 <DIR> --d----- c:\users\slowery\appdata\roaming\GSC 2.00
2009-04-30 02:11 <DIR> --dsh--- c:\windows\system32\%APPDATA%
2009-04-29 01:29 <DIR> --d----- c:\programdata\SUPERAntiSpyware.com
2009-04-29 01:29 <DIR> --d----- c:\progra~2\SUPERAntiSpyware.com
2009-04-29 01:28 <DIR> --d----- c:\users\slowery\appdata\roaming\SUPERAntiSpyware.com
2009-04-29 01:28 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-04-29 01:25 <DIR> --d----- c:\programdata\Spybot - Search & Destroy
2009-04-29 01:25 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-04-29 01:25 <DIR> --d----- c:\progra~2\Spybot - Search & Destroy
2009-04-27 22:27 161,792 a------- c:\windows\SWREG.exe
2009-04-27 22:27 98,816 a------- c:\windows\sed.exe
2009-04-26 00:47 <DIR> --d----- c:\windows\pss
2009-04-24 10:18 <DIR> --d----- c:\programdata\PC Drivers HeadQuarters
2009-04-24 10:18 <DIR> --d----- c:\progra~2\PC Drivers HeadQuarters
2009-04-24 10:03 <DIR> --d----- c:\users\slowery\appdata\roaming\IObit
2009-04-24 10:03 <DIR> --d----- c:\program files\IObit
2009-04-24 09:59 <DIR> --d----- c:\programdata\Yahoo! Companion
2009-04-24 09:59 <DIR> --d----- c:\program files\Yahoo!
2009-04-24 01:36 <DIR> --d----- c:\users\slowery\appdata\roaming\360desktop
2009-04-24 01:36 <DIR> --d----- c:\program files\360desktop
2009-04-24 01:36 426 a------- c:\windows\{21D15DED-F125-46C8-8017-CB9F1CEB5B4D}_WiseFW.ini
2009-04-24 01:34 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-04-24 00:51 <DIR> --d----- c:\users\slowery\appdata\roaming\Malwarebytes
2009-04-24 00:51 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-24 00:51 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-24 00:51 <DIR> --d----- c:\programdata\Malwarebytes
2009-04-24 00:51 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-24 00:51 <DIR> --d----- c:\progra~2\Malwarebytes
2009-04-22 00:24 <DIR> --d--r-- c:\program files\Skype
2009-04-19 17:29 <DIR> --d----- c:\programdata\SpeedBit
2009-04-19 17:29 <DIR> --d----- c:\progra~2\SpeedBit
2009-04-19 17:28 479,298 a------- c:\windows\system32\wbocx.ocx
2009-04-19 17:28 172,032 a------- c:\windows\system32\AniGIF.ocx
2009-04-19 17:28 50,688 a------- c:\windows\system32\wbhelp2.dll
2009-04-19 17:28 <DIR> --d----- c:\program files\DAP
2009-04-19 17:08 <DIR> --d----- c:\users\slowery\appdata\roaming\DMCache
2009-04-19 01:16 <DIR> --d----- c:\program files\MediaMonkey
2009-04-18 23:51 551,424 a------- c:\windows\system32\rpcss.dll
2009-04-18 23:51 3,599,328 a------- c:\windows\system32\ntkrnlpa.exe
2009-04-18 23:51 3,547,632 a------- c:\windows\system32\ntoskrnl.exe
2009-04-18 23:51 666,624 a------- c:\windows\system32\printfilterpipelinesvc.exe
2009-04-18 23:51 183,296 a------- c:\windows\system32\sdohlp.dll
2009-04-18 23:51 98,304 a------- c:\windows\system32\iasrecst.dll
2009-04-18 23:51 54,784 a------- c:\windows\system32\iasads.dll
2009-04-18 23:51 44,032 a------- c:\windows\system32\iasdatastore.dll
2009-04-18 23:51 26,112 a------- c:\windows\system32\printfilterpipelineprxy.dll
2009-04-18 23:51 17,408 a------- c:\windows\system32\iashost.exe
2009-04-18 23:49 1,255,936 a------- c:\windows\system32\lsasrv.dll
2009-04-18 23:49 72,704 a------- c:\windows\system32\secur32.dll
2009-04-18 23:49 24,064 a------- c:\windows\system32\amxread.dll
2009-04-18 23:49 13,824 a------- c:\windows\system32\apilogen.dll
2009-04-18 21:46 562,176 a------- c:\windows\system32\msdtcprx.dll
2009-04-18 21:46 38,912 a------- c:\windows\system32\xolehlp.dll
2009-04-18 21:42 376,832 a------- c:\windows\system32\winhttp.dll
2009-04-17 19:08 <DIR> -cd-hr-- C:\$VAULT$.AVG

==================== Find3M ====================

2009-04-23 20:24 410,984 a------- c:\windows\system32\deploytk.dll
2009-04-21 22:23 143,360 a------- c:\windows\inf\infstrng.dat
2009-04-21 22:23 51,200 a------- c:\windows\inf\infpub.dat
2009-04-21 22:23 86,016 a------- c:\windows\inf\infstor.dat
2009-04-17 07:38 0 a---h--- c:\windows\system32\drivers\Msft_User_ZuneDriver_01_07_00.Wdf
2009-04-17 07:38 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf
2009-04-16 19:47 603,904 a------- c:\windows\system32\TUProgSt.exe
2009-04-16 19:47 362,240 a------- c:\windows\system32\TuneUpDefragService.exe
2009-03-24 16:06 9,216 a------- c:\windows\system32\avgwlntf.dll
2009-03-24 04:03 7,808 a------- c:\windows\system32\drivers\psi_mf.sys
2009-03-16 20:38 40,960 a------- c:\windows\apppatch\apihex86.dll
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 109,056 a------- c:\windows\system32\iesysprep.dll
2009-03-08 04:33 109,568 a------- c:\windows\system32\PDMSetup.exe
2009-03-08 04:33 132,608 a------- c:\windows\system32\ieUnatt.exe
2009-03-08 04:33 107,520 a------- c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 04:33 107,008 a------- c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 04:33 103,936 a------- c:\windows\system32\SetDepNx.exe
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:32 66,560 a------- c:\windows\system32\wextract.exe
2009-03-08 04:32 169,472 a------- c:\windows\system32\iexpress.exe
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-05 05:54 73,728 a------- c:\windows\system32\RtNicProp32.dll
2009-02-21 19:19 202,352 a------- c:\windows\system32\PnkBstrB.exe
2009-02-21 19:19 66,872 a------- c:\windows\system32\PnkBstrA.exe
2009-01-04 05:22 56 a---h--- c:\programdata\ezsidmv.dat
2009-01-04 05:22 56 a---h--- c:\progra~2\ezsidmv.dat
2008-10-27 08:38 95,056 a------- c:\users\slowery\DSETUP.dll
2008-10-27 08:37 1,692,496 a------- c:\users\slowery\dsetup32.dll
2008-08-14 12:49 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-20 19:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 18:03:19.89 ===============

Attached Files



#4 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:10:47 PM

Posted 19 May 2009 - 05:16 PM

Hi enigmasean,

Welcome to BC HijackThis forum. I am farbar. I am going to assist you with your problem.

Please refrain from making any changes to your system (updating Windows, installing applications, removing files, etc.) from now on as it might prolong handling your log and make the job for both of us more difficult.

Your log(s) show that you are using so called peer-to-peer or file-sharing programs. These programs allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."


Removal Instructions

AVG 7 is outdated and no more supported. We are going to install AVG 8 as soon as the system is stable enough. Lets so some cleaning.
  • Empty all p2p download folders. They might contain infected files. Please avoid using these p2p applications until the system is clean. Using these applications at this stage might lead to reinfection or infecting other users.

  • You have the program Spybot S&D (Teatimer option) running on your machine. We need to disable TeaTimer so it does not interfere with the fixes we are about to do. This will only take a few seconds.
    • First disable TeaTimer:
      • Run Spybot-S&D
      • Go to the Mode menu, and make sure Advanced Mode is selected
      • On the left hand side, choose Tools -> Resident
      • Uncheck Resident TeaTimer and OK any prompts
      • Restart your computer.
      Instruction is also here: How to disable TeaTimer during HijackThis Cleanup

      Note:If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

    • Then download ResetTeaTimer.exe to your desktop. (In case you use Firefox, rightclick the link and choose "Save Link As").
      • Doubleclick ResetTeaTimer.exe and let it run.
    Note: The Teatimer should be kept disabled until I give you the clean sign.
    In case you you could not run Spybot Search & Destroy to disable teatimer please unistall it. You can install it again when we are done.


  • You have the latest version of Java (Java 6 Update 13) and it is good. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components:
    Click "start" and then "Control Panel" icon.
    Doubleclick the "Add or Remove Programs" icon
    A list of programs installed will be "populated" this may take a bit of time.
    Uninstall the following by clicking on the following entries and selecting "remove":

    Java™ 6 Update 6

  • Go to start > Run copy/paste the following line in the run box and click OK.

    sc delete 0046281240228326mcinstcleanup

    A window flashes it is normal.

  • You have still some leftovers from an incomplete uninstalled Norton Antivirus on your computer.

    To remove the leftovers please download and run the Norton Removal Tool.

    Note: Norton removal tool is one and the same for all versions named below. It doesn't matter which version you have.

    Warning: The Norton Removal Tool uninstalls all Norton 2008/2007/2006/2005/2004/2003 products and Norton 360 from your computer. If you use ACT! or WinFAX, back up those databases before you proceed.

  • Open your Malwarebytes' Anti-Malware, first update it, run a "quick scan", let reboot if needed and copy/paste the log to your reply.

    Note: The logs are saved by default under the Logs tab. If the log did not automatically open you can obtain the latest log from there.

  • Please copy and paste a fresh Hijackthis log to your reply.
Please include in your next reply:
  • The log of MBAM.
  • A fresh Hijackthis log.
  • Any comment or feedback about how it went.


#5 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:10:47 PM

Posted 23 May 2009 - 06:11 PM

Is anybody there? I'll wait one more day before closing the topic.

#6 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:10:47 PM

Posted 27 May 2009 - 04:09 PM

This thread will now be closed due to lack of activity.

If you should have the same or a new issue, please start a new topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users