DDS/RootRepeal logs - Somthing is causing a hack scanner to trip out every 15-20 minutes

Im posting on behalf of my girlfriend, we play a game called MapleStory together, and it uses somthing called "Ahnlab Hackshield Pro" to stop people from, you guessed it, hacking.

Somthing on her laptop is causing it to trip out and kick her off the game every so often and tells her its detected a hacking threat, weve tried disabling the antivirus by ending the process and it still happens, she has a very small proccess list (which i also have an shot of if you would like to see) and nothing jumps out and screams "hey im screwing with you."

Sorry if these are in the wrong place, wasnt sure where to post.

heres the DDS log as requested, and the other 2 are attatched.




DDS (Ver_09-07-30.01) - NTFSx86
Run by Lenovo at 15:44:20.88 on Tue 09/08/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2038.1006 [GMT 3:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:Windowssystem32wininit.exe
C:Windowssystem32lsm.exe
C:Windowssystem32svchost.exe -k DcomLaunch
C:Windowssystem32svchost.exe -k rpcss
C:WindowsSystem32svchost.exe -k secsvcs
C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted
C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted
C:Windowssystem32svchost.exe -k netsvcs
C:Windowssystem32SLsvc.exe
C:Windowssystem32svchost.exe -k LocalService
C:Windowssystem32svchost.exe -k NetworkService
C:WindowsSystem32spoolsv.exe
C:Windowssystem32svchost.exe -k LocalServiceNoNetwork
C:PROGRA~1AVGAVG8avgwdsvc.exe
C:Program FilesBonjourmDNSResponder.exe
C:Windowssystem32svchost.exe -k bthsvcs
C:Program FilesLENOVOHOTKEYFNF5SVC.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:PROGRA~1AVGAVG8avgrsx.exe
C:Windowssystem32svchost.exe -k NetworkServiceNetworkRestricted
C:PROGRA~1AVGAVG8avgnsx.exe
C:Windowssystem32svchost.exe -k imgsvc
C:Program FilesViewpointCommonViewpointService.exe
C:WindowsSystem32svchost.exe -k WerSvcGroup
C:Windowssystem32SearchIndexer.exe
C:Windowssystem32taskeng.exe
C:Windowssystem32taskeng.exe
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesLenovoHOTKEYTpWAudAp.exe
C:Program FilesAVGAVG8avgtray.exe
C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:WindowsSystem32igfxtray.exe
C:WindowsSystem32igfxpers.exe
C:Windowsvsnp2std.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Windowssystem32igfxsrvc.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesWindows Media Playerwmpnetwk.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesCommon FilesAheadLibNMIndexingService.exe
C:Windowssystem32wuauclt.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Windowssystem32SearchProtocolHost.exe
C:Windowssystem32SearchFilterHost.exe
C:UsersLenovoDesktopdds.scr
C:Windowssystem32wbemwmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uStart Page = hxxp://www.yahoo.com
uDefault_Page_URL = hxxp://www.lenovo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
uURLSearchHooks: H - No File
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:program filesavgavg8avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:progra~1micros~2office12GRA8E1~1.DLL
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:program filesjavajre6binjp2ssv.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:program filesavgavg8toolbarIEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [Sidebar] c:program fileswindows sidebarsidebar.exe /autoRun
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:program filescommon filesaheadlibNMBgMonitor.exe"
uRun: [Aim6]
uRun: [ares] "c:program filesaresAres.exe" -h
uRun: [Search Protection] c:program filesyahoo!search protectionSearchProtection.exe
mRun: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
mRun: [TPWAUDAP] c:program fileslenovohotkeyTpWAudAp.exe
mRun: [NeroFilterCheck] c:program filescommon filesaheadlibNeroCheck.exe
mRun: [AVG8_TRAY] c:progra~1avgavg8avgtray.exe
mRun: [GrooveMonitor] "c:program filesmicrosoft officeoffice12GrooveMonitor.exe"
mRun: [SynTPEnh] c:program filessynapticssyntpSynTPEnh.exe
mRun: [IgfxTray] c:windowssystem32igfxtray.exe
mRun: [HotKeysCmds] c:windowssystem32hkcmd.exe
mRun: [Persistence] c:windowssystem32igfxpers.exe
mRun: [tsnp2std] c:windowstsnp2std.exe
mRun: [snp2std] c:windowsvsnp2std.exe
mRun: [SunJavaUpdateSched] "c:program filesjavajre6binjusched.exe"
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:progra~1micros~2office12EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:progra~1micros~2office12ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:progra~1micros~2office12REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:progra~1micros~2office12GR99D3~1.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:program filesavgavg8avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:progra~1common~1skypeSKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: avgrsstx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:progra~1micros~2office12GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:userslenovoappdataroamingmozillafirefoxprofileshwqvux1q.default
FF - prefs.js: browser.startup.homepage - www.google.com
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsIGeared_tavgp_xputils2.dll
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsIGeared_tavgp_xputils3.dll
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsIGeared_tavgp_xputils35.dll
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsxpavgtbapi.dll
FF - plugin: c:program filesahnlabaspmykeydefense 2.5npmkd25aos.dll
FF - plugin: c:program filesfinal codecsmozillapluginsnppl3260.dll
FF - plugin: c:program filesfinal codecsmozillapluginsnprjplug.dll
FF - plugin: c:program filesfinal codecsmozillapluginsnprpjplug.dll
FF - plugin: c:program filesmozilla firefoxpluginsnpPandoWebInst.dll
FF - plugin: c:program filesmozilla firefoxpluginsnpViewpoint.dll
FF - plugin: c:program filesoperaprogrampluginsnp_gp.dll
FF - plugin: c:program filesviewpointviewpoint media playernpViewpoint.dll
FF - plugin: c:program filesvirtools3d life playernpvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:program filesmozilla firefoxextensions{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:windowssystem32driversavgldx86.sys [2009-6-22 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:windowssystem32driversavgtdix.sys [2009-6-22 108552]
R2 avg8wd;AVG Free8 WatchDog;c:progra~1avgavg8avgwdsvc.exe [2009-6-22 297752]
R2 FNF5SVC;Fn+F5 Service;c:program fileslenovohotkeyFnF5svc.exe [2009-6-22 54832]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:program filesviewpointcommonViewpointService.exe [2009-6-22 24652]
S2 TPHKSVC;On Screen Display;c:program fileslenovohotkeyTPHKSVC.exe [2009-6-22 55928]
S3 Mkd2kfNt;Mkd2kfNt;c:windowssystem32driversMkd2kfNT.sys [2009-8-19 131072]
S3 Mkd2Nadr;Mkd2Nadr;c:windowssystem32driversMkd2Nadr.sys [2009-8-19 79104]

=============== Created Last 30 ================

2009-09-06 22:09 0 a------- c:windowssystem32msexcr.ini
2009-08-30 17:53 <DIR> --d----- c:programdataAirportMania
2009-08-30 17:53 <DIR> --d----- c:progra~2AirportMania
2009-08-30 17:20 <DIR> --d----- c:program filesReflexiveArcade
2009-08-29 19:08 <DIR> --d----- c:programdataYahoo!
2009-08-29 19:08 <DIR> --d----- c:program filesYahoo!
2009-08-29 08:47 411,368 a------- c:windowssystem32deploytk.dll
2009-08-19 19:03 <DIR> --d----- c:programdata3DVIA
2009-08-19 19:03 <DIR> --d----- c:progra~23DVIA
2009-08-19 19:03 3,727,720 a------- c:windowssystem32d3dx9_35.dll
2009-08-19 19:03 2,414,360 a------- c:windowssystem32d3dx9_31.dll
2009-08-19 19:03 <DIR> --d----- c:program filesVirtools
2009-08-19 10:32 131,072 a------- c:windowssystem32driversMkd2kfNT.sys
2009-08-19 10:32 79,104 a------- c:windowssystem32driversMkd2Nadr.sys
2009-08-19 10:31 <DIR> --d----- c:program filesAhnLab
2009-08-18 15:12 <DIR> --d----- c:program filesNEXON
2009-08-18 11:11 <DIR> --d----- c:userslenovoappdataroamingImprudence

==================== Find3M ====================

2009-09-08 12:17 44,544 a------- c:windowssystem32agremove.exe
2009-08-21 08:37 335,240 a------- c:windowssystem32driversavgldx86.sys
2009-08-21 08:37 11,952 a------- c:windowssystem32avgrsstx.dll
2009-07-04 11:00 51,200 a------- c:windowsinfinfpub.dat
2009-07-04 11:00 86,016 a------- c:windowsinfinfstrng.dat
2009-07-04 10:59 86,016 a------- c:windowsinfinfstor.dat
2008-01-21 05:43 174 a--sh--- c:program filesdesktop.ini
2008-01-21 05:32 665,600 a------- c:windowsinfdrvindex.dat
2006-11-02 15:42 287,440 a------- c:windowsinfperflib0409perfi.dat
2006-11-02 15:42 287,440 a------- c:windowsinfperflib0409perfh.dat
2006-11-02 15:42 30,674 a------- c:windowsinfperflib0409perfd.dat
2006-11-02 15:42 30,674 a------- c:windowsinfperflib0409perfc.dat
2006-11-02 12:20 287,440 a------- c:windowsinfperflib0000perfi.dat
2006-11-02 12:20 287,440 a------- c:windowsinfperflib0000perfh.dat
2006-11-02 12:20 30,674 a------- c:windowsinfperflib0000perfd.dat
2006-11-02 12:20 30,674 a------- c:windowsinfperflib0000perfc.dat

============= FINISH: 15:45:11.89 ===============

i didnt wanna bump this but the forum moves so fast it was already at page 3 within an hour, overnight i didnt want to look for it..
sorry if im not supposed to :/

Hello amoeball,

We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the HJT Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.

Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible.

Thank you for understanding.

Regards,

The weatherman
(Moderator)

Edited by The weatherman, 09 September 2009 - 05:24 PM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic