Somthing on her laptop is causing it to trip out and kick her off the game every so often and tells her its detected a hacking threat, weve tried disabling the antivirus by ending the process and it still happens, she has a very small proccess list (which i also have an shot of if you would like to see) and nothing jumps out and screams "hey im screwing with you."
Sorry if these are in the wrong place, wasnt sure where to post.
heres the DDS log as requested, and the other 2 are attatched.
DDS (Ver_09-07-30.01) - NTFSx86
Run by Lenovo at 15:44:20.88 on Tue 09/08/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2038.1006 [GMT 3:00]
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:Windowssystem32wininit.exe
C:Windowssystem32lsm.exe
C:Windowssystem32svchost.exe -k DcomLaunch
C:Windowssystem32svchost.exe -k rpcss
C:WindowsSystem32svchost.exe -k secsvcs
C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted
C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted
C:Windowssystem32svchost.exe -k netsvcs
C:Windowssystem32SLsvc.exe
C:Windowssystem32svchost.exe -k LocalService
C:Windowssystem32svchost.exe -k NetworkService
C:WindowsSystem32spoolsv.exe
C:Windowssystem32svchost.exe -k LocalServiceNoNetwork
C:PROGRA~1AVGAVG8avgwdsvc.exe
C:Program FilesBonjourmDNSResponder.exe
C:Windowssystem32svchost.exe -k bthsvcs
C:Program FilesLENOVOHOTKEYFNF5SVC.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:PROGRA~1AVGAVG8avgrsx.exe
C:Windowssystem32svchost.exe -k NetworkServiceNetworkRestricted
C:PROGRA~1AVGAVG8avgnsx.exe
C:Windowssystem32svchost.exe -k imgsvc
C:Program FilesViewpointCommonViewpointService.exe
C:WindowsSystem32svchost.exe -k WerSvcGroup
C:Windowssystem32SearchIndexer.exe
C:Windowssystem32taskeng.exe
C:Windowssystem32taskeng.exe
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesLenovoHOTKEYTpWAudAp.exe
C:Program FilesAVGAVG8avgtray.exe
C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:WindowsSystem32igfxtray.exe
C:WindowsSystem32igfxpers.exe
C:Windowsvsnp2std.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesWindows Sidebarsidebar.exe
C:Program FilesCommon FilesAheadLibNMBgMonitor.exe
C:Windowssystem32igfxsrvc.exe
C:Program FilesCommon FilesAheadLibNMIndexStoreSvr.exe
C:Program FilesWindows Media Playerwmpnscfg.exe
C:Program FilesWindows Media Playerwmpnetwk.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesCommon FilesAheadLibNMIndexingService.exe
C:Windowssystem32wuauclt.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Windowssystem32SearchProtocolHost.exe
C:Windowssystem32SearchFilterHost.exe
C:UsersLenovoDesktopdds.scr
C:Windowssystem32wbemwmiprvse.exe
============== Pseudo HJT Report ===============
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uStart Page = hxxp://www.yahoo.com
uDefault_Page_URL = hxxp://www.lenovo.com
uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
uURLSearchHooks: H - No File
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:program filesavgavg8avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:progra~1micros~2office12GRA8E1~1.DLL
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:program filesavgavg8toolbarIEToolbar.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:program filesjavajre6binjp2ssv.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:program filesavgavg8toolbarIEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [Sidebar] c:program fileswindows sidebarsidebar.exe /autoRun
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:program filescommon filesaheadlibNMBgMonitor.exe"
uRun: [Aim6]
uRun: [ares] "c:program filesaresAres.exe" -h
uRun: [Search Protection] c:program filesyahoo!search protectionSearchProtection.exe
mRun: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
mRun: [TPWAUDAP] c:program fileslenovohotkeyTpWAudAp.exe
mRun: [NeroFilterCheck] c:program filescommon filesaheadlibNeroCheck.exe
mRun: [AVG8_TRAY] c:progra~1avgavg8avgtray.exe
mRun: [GrooveMonitor] "c:program filesmicrosoft officeoffice12GrooveMonitor.exe"
mRun: [SynTPEnh] c:program filessynapticssyntpSynTPEnh.exe
mRun: [IgfxTray] c:windowssystem32igfxtray.exe
mRun: [HotKeysCmds] c:windowssystem32hkcmd.exe
mRun: [Persistence] c:windowssystem32igfxpers.exe
mRun: [tsnp2std] c:windowstsnp2std.exe
mRun: [snp2std] c:windowsvsnp2std.exe
mRun: [SunJavaUpdateSched] "c:program filesjavajre6binjusched.exe"
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:progra~1micros~2office12EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:progra~1micros~2office12ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:progra~1micros~2office12REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:progra~1micros~2office12GR99D3~1.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:program filesavgavg8avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:progra~1common~1skypeSKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: avgrsstx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:progra~1micros~2office12GRA8E1~1.DLL
================= FIREFOX ===================
FF - ProfilePath - c:userslenovoappdataroamingmozillafirefoxprofileshwqvux1q.default
FF - prefs.js: browser.startup.homepage - www.google.com
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsIGeared_tavgp_xputils2.dll
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsIGeared_tavgp_xputils3.dll
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsIGeared_tavgp_xputils35.dll
FF - component: c:program filesavgavg8toolbarfirefoxavg@igearedcomponentsxpavgtbapi.dll
FF - plugin: c:program filesahnlabaspmykeydefense 2.5npmkd25aos.dll
FF - plugin: c:program filesfinal codecsmozillapluginsnppl3260.dll
FF - plugin: c:program filesfinal codecsmozillapluginsnprjplug.dll
FF - plugin: c:program filesfinal codecsmozillapluginsnprpjplug.dll
FF - plugin: c:program filesmozilla firefoxpluginsnpPandoWebInst.dll
FF - plugin: c:program filesmozilla firefoxpluginsnpViewpoint.dll
FF - plugin: c:program filesoperaprogrampluginsnp_gp.dll
FF - plugin: c:program filesviewpointviewpoint media playernpViewpoint.dll
FF - plugin: c:program filesvirtools3d life playernpvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:program filesmozilla firefoxextensions{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:windowssystem32driversavgldx86.sys [2009-6-22 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:windowssystem32driversavgtdix.sys [2009-6-22 108552]
R2 avg8wd;AVG Free8 WatchDog;c:progra~1avgavg8avgwdsvc.exe [2009-6-22 297752]
R2 FNF5SVC;Fn+F5 Service;c:program fileslenovohotkeyFnF5svc.exe [2009-6-22 54832]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:program filesviewpointcommonViewpointService.exe [2009-6-22 24652]
S2 TPHKSVC;On Screen Display;c:program fileslenovohotkeyTPHKSVC.exe [2009-6-22 55928]
S3 Mkd2kfNt;Mkd2kfNt;c:windowssystem32driversMkd2kfNT.sys [2009-8-19 131072]
S3 Mkd2Nadr;Mkd2Nadr;c:windowssystem32driversMkd2Nadr.sys [2009-8-19 79104]
=============== Created Last 30 ================
2009-09-06 22:09 0 a------- c:windowssystem32msexcr.ini
2009-08-30 17:53 <DIR> --d----- c:programdataAirportMania
2009-08-30 17:53 <DIR> --d----- c:progra~2AirportMania
2009-08-30 17:20 <DIR> --d----- c:program filesReflexiveArcade
2009-08-29 19:08 <DIR> --d----- c:programdataYahoo!
2009-08-29 19:08 <DIR> --d----- c:program filesYahoo!
2009-08-29 08:47 411,368 a------- c:windowssystem32deploytk.dll
2009-08-19 19:03 <DIR> --d----- c:programdata3DVIA
2009-08-19 19:03 <DIR> --d----- c:progra~23DVIA
2009-08-19 19:03 3,727,720 a------- c:windowssystem32d3dx9_35.dll
2009-08-19 19:03 2,414,360 a------- c:windowssystem32d3dx9_31.dll
2009-08-19 19:03 <DIR> --d----- c:program filesVirtools
2009-08-19 10:32 131,072 a------- c:windowssystem32driversMkd2kfNT.sys
2009-08-19 10:32 79,104 a------- c:windowssystem32driversMkd2Nadr.sys
2009-08-19 10:31 <DIR> --d----- c:program filesAhnLab
2009-08-18 15:12 <DIR> --d----- c:program filesNEXON
2009-08-18 11:11 <DIR> --d----- c:userslenovoappdataroamingImprudence
==================== Find3M ====================
2009-09-08 12:17 44,544 a------- c:windowssystem32agremove.exe
2009-08-21 08:37 335,240 a------- c:windowssystem32driversavgldx86.sys
2009-08-21 08:37 11,952 a------- c:windowssystem32avgrsstx.dll
2009-07-04 11:00 51,200 a------- c:windowsinfinfpub.dat
2009-07-04 11:00 86,016 a------- c:windowsinfinfstrng.dat
2009-07-04 10:59 86,016 a------- c:windowsinfinfstor.dat
2008-01-21 05:43 174 a--sh--- c:program filesdesktop.ini
2008-01-21 05:32 665,600 a------- c:windowsinfdrvindex.dat
2006-11-02 15:42 287,440 a------- c:windowsinfperflib0409perfi.dat
2006-11-02 15:42 287,440 a------- c:windowsinfperflib0409perfh.dat
2006-11-02 15:42 30,674 a------- c:windowsinfperflib0409perfd.dat
2006-11-02 15:42 30,674 a------- c:windowsinfperflib0409perfc.dat
2006-11-02 12:20 287,440 a------- c:windowsinfperflib0000perfi.dat
2006-11-02 12:20 287,440 a------- c:windowsinfperflib0000perfh.dat
2006-11-02 12:20 30,674 a------- c:windowsinfperflib0000perfd.dat
2006-11-02 12:20 30,674 a------- c:windowsinfperflib0000perfc.dat
============= FINISH: 15:45:11.89 ===============
i didnt wanna bump this but the forum moves so fast it was already at page 3 within an hour, overnight i didnt want to look for it..
sorry if im not supposed to :/
Hello amoeball,
We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the HJT Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.
That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.
Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible.
Thank you for understanding.
Regards,
The weatherman
(Moderator)
Attached Files
Edited by The weatherman, 09 September 2009 - 05:24 PM.