[RESOLVED] Google redirect
Page 1 of 4 123 ... LastLast
Results 1 to 15 of 60

Thread: [RESOLVED] Google redirect

  1. August 12th, 2010, 08:33 AM #1
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322

    Resolved [RESOLVED] Google redirect

    Fiends computer has the Google redirect virus .
    Malwarebytes and SAS is not picking it up . Can you please take a look at the HJT log and see if there is anything in there ?
    Thanks.
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:47:51 AM, on 8/12/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\AVG\AVG9\avgam.exe
    C:\Program Files\AVG\AVG9\avgemc.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG9\avgtray.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\Program Files\Garmin\MyGarminAgent\MyGarminAgent.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Documents and Settings\Paul\Desktop\tmail.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link.../?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKLM\..\Run: [MyGarminAgent] C:\Program Files\Garmin\MyGarminAgent\MyGarminAgent.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase6087.cab
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/soft...5111/CTPID.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O20 - Winlogon Notify: TPSvc - TPSvc.dll (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
    O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
    O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe

    --
    End of file - 6780 bytes
    Reply With Quote Reply With Quote
  2. August 12th, 2010, 10:39 AM #2
    Train
    Train is offline Friend of Site Staff
    Join Date
    Apr 2000
    Location
    Sheboygan, WI
    Posts
    53,391
    HJT is not what it once was ..... so please....
    http://discussions.virtualdr.com/sho...d.php?t=167915
    Reply With Quote Reply With Quote
  3. August 12th, 2010, 11:33 AM #3
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322
    Thanks Train , will pass it on and post back.
    Reply With Quote Reply With Quote
  4. August 12th, 2010, 08:09 PM #4
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322
    Waiting on DDS logs

    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit quick scan 2010-08-12 19:39:34
    Windows 5.1.2600 Service Pack 3
    Running: nikh1zch.exe; Driver: C:\DOCUME~1\Paul\LOCALS~1\Temp\pxtdypow.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs InCDrec.SYS (InCD File System Recognizer/Nero AG)
    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\Fastfat \Fat InCDrec.SYS (InCD File System Recognizer/Nero AG)
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    ---- EOF - GMER 1.0.15 ----
    Reply With Quote Reply With Quote
  6. August 13th, 2010, 12:27 PM #5
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322

    GMER LOG

    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-08-13 10:52:03
    Windows 5.1.2600 Service Pack 3
    Running: gmer.exe; Driver: C:\DOCUME~1\Paul\LOCALS~1\Temp\pxtdypow.sys


    ---- System - GMER 1.0.15 ----

    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF7435112]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF74142D6]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF74144C8]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF7435900]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF7435BB4]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF7433E12]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF7436020]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF74353D2]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xF7413F44]

    ---- Kernel code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB976D360, 0x37388D, 0xE8000020]

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs InCDrec.SYS (InCD File System Recognizer/Nero AG)
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

    AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    Device InCDFs.sys (InCD File System Driver/Nero AG)

    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\NdisWanIp@LLInterface WANARP
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\NdisWanIp@IpConfig Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}?Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\NdisWanIp@NumInterfaces 2
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{A122DA11-F4F8-4774-8922-32B095AE62DE}@LLInterface
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{A122DA11-F4F8-4774-8922-32B095AE62DE}@IpConfig Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{E03C9759-E2E0-441E-8BAD-DA6263030D9E}@LLInterface
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{E03C9759-E2E0-441E-8BAD-DA6263030D9E}@IpConfig Tcpip\Parameters\Interfaces\{E03C9759-E2E0-441E-8BAD-DA6263030D9E}?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\NdisWanIp@MTU 1500
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@UseZeroBroadcast 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@EnableDHCP 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@IPAddress 0.0.0.0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@SubnetMask 0.0.0.0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@DefaultGateway
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@EnableDeadGWDetect 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@DontAddDefaultGateway 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@UseZeroBroadcast 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@EnableDHCP 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@IPAddress 0.0.0.0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@SubnetMask 0.0.0.0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@DefaultGateway
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@EnableDeadGWDetect 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@DontAddDefaultGateway 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@UseZeroBroadcast 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@EnableDeadGWDetect 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@EnableDHCP 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@IPAddress 0.0.0.0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@SubnetMask 0.0.0.0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@DefaultGateway
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@DefaultGatewayMetric
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@NameServer
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@Domain
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@RegistrationEnabled 1
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@RegisterAdapterName 0
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@TCPAllowedPorts 0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@UDPAllowedPorts 0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@RawIPAllowedProtocols 0?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@NTEContextList 0x00000003?
    Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@MTU 1500
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\NdisWanIp@LLInterface WANARP
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\NdisWanIp@IpConfig Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}?Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\NdisWanIp@NumInterfaces 2
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\{A122DA11-F4F8-4774-8922-32B095AE62DE}@LLInterface
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\{A122DA11-F4F8-4774-8922-32B095AE62DE}@IpConfig Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\{E03C9759-E2E0-441E-8BAD-DA6263030D9E}@LLInterface
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\{E03C9759-E2E0-441E-8BAD-DA6263030D9E}@IpConfig Tcpip\Parameters\Interfaces\{E03C9759-E2E0-441E-8BAD-DA6263030D9E}?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\NdisWanIp@MTU 1500
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@UseZeroBroadcast 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@EnableDHCP 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@IPAddress 0.0.0.0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@SubnetMask 0.0.0.0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@DefaultGateway
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@EnableDeadGWDetect 1
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{17DD5775-0517-43D8-8E25-FF3C933273B1}@DontAddDefaultGateway 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@UseZeroBroadcast 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@EnableDHCP 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@IPAddress 0.0.0.0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@SubnetMask 0.0.0.0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@DefaultGateway
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@EnableDeadGWDetect 1
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{772FD57A-29FF-4648-ACF3-4950BCDC555D}@DontAddDefaultGateway 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@UseZeroBroadcast 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@EnableDeadGWDetect 1
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@EnableDHCP 1
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@IPAddress 0.0.0.0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@SubnetMask 0.0.0.0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@DefaultGateway
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@DefaultGatewayMetric
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@NameServer
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@Domain
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@RegistrationEnabled 1
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@RegisterAdapterName 0
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@TCPAllowedPorts 0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@UDPAllowedPorts 0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@RawIPAllowedProtocols 0?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@NTEContextList 0x00000003?
    Reg HKLM\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{A122DA11-F4F8-4774-8922-32B095AE62DE}@MTU 1500

    ---- EOF - GMER 1.0.15 ----
    Reply With Quote Reply With Quote
  7. August 13th, 2010, 12:29 PM #6
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322

    DDS

    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Paul at 9:11:55.32 on Fri 08/13/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3710.2973 [GMT -4:00]

    AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\AVG\AVG9\avgam.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\AVG\AVG9\avgemc.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\PROGRA~1\AVG\AVG9\avgtray.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\Program Files\Garmin\MyGarminAgent\MyGarminAgent.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\Documents and Settings\Paul\Desktop\tmail.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Paul\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.ca/
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [UpdReg] c:\windows\UpdReg.EXE
    mRun: [nmapp] "c:\program files\pure networks\network magic\nmapp.exe" -autorun -nosplash
    mRun: [MyGarminAgent] c:\program files\garmin\mygarminagent\MyGarminAgent.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
    mPolicies-system: EnableLUA = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    Trusted Zone: phonedetective.com\www
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
    Notify: avgrsstarter - avgrsstx.dll
    Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    Notify: TPSvc - TPSvc.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\paul\applic~1\mozilla\firefox\profiles\rxmnocmt.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: browser.cache.memory.capacity - 65536
    FF - user.js: browser.chrome.favicons - false
    FF - user.js: browser.display.show_image_placeholders - true
    FF - user.js: browser.turbo.enabled - true
    FF - user.js: browser.urlbar.autocomplete.enabled - true
    FF - user.js: browser.urlbar.autofill - true
    FF - user.js: content.interrupt.parsing - true
    FF - user.js: content.max.tokenizing.time - 2250000
    FF - user.js: content.notify.backoffcount - 5
    FF - user.js: content.notify.interval - 750000
    FF - user.js: content.notify.ontimer - true
    FF - user.js: content.switch.threshold - 750000
    FF - user.js: network.http.max-connections - 48
    FF - user.js: network.http.max-connections-per-server - 16
    FF - user.js: network.http.max-persistent-connections-per-proxy - 16
    FF - user.js: network.http.max-persistent-connections-per-server - 8
    FF - user.js: network.http.pipelining - true
    FF - user.js: network.http.pipelining.firstrequest - true
    FF - user.js: network.http.pipelining.maxrequests - 8
    FF - user.js: network.http.proxy.pipelining - true
    FF - user.js: network.http.request.max-start-delay - 0
    FF - user.js: nglayout.initialpaint.delay - 0
    FF - user.js: plugin.expose_full_path - true
    FF - user.js: ui.submenuDelay - 0
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
    c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-2-8 52872]
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-6-20 218592]
    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-8 216400]
    R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-8 29584]
    R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-8 243024]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632]
    R2 avg9emc;AVG E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-6-22 921952]
    R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-6-22 308136]
    R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2010-2-8 10384]
    R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [2009-6-17 40720]
    R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [2009-6-17 10384]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-16 135664]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-2-8 20952]
    S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]
    S3 SDAntiRtKt;SDAntiRtKt;\??\c:\program files\max spyware detector\sdantirtkt.sys --> c:\program files\max spyware detector\SDAntiRtKt.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-2-8 304464]
    S4 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-6-20 366840]
    S4 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-6-20 1142224]

    =============== Created Last 30 ================

    2010-08-13 00:00:35 0 d-----w- C:\6a90c1337582c2e567f20e
    2010-08-12 10:45:12 0 d-----w- c:\program files\Trend Micro
    2010-08-11 18:25:30 0 d-----w- c:\docume~1\paul\applic~1\GARMIN
    2010-08-11 18:25:16 0 d-----w- c:\program files\Garmin GPS Plugin
    2010-08-10 04:17:21 0 d-----w- c:\program files\Pure Networks
    2010-08-10 02:03:14 16384 ---ha-w- C:\SZKGFS.dat
    2010-08-10 02:01:32 0 d-----w- c:\docume~1\alluse~1\applic~1\SITEguard
    2010-08-10 01:59:30 0 d-----w- c:\program files\common files\iS3
    2010-08-10 01:59:29 0 d-----w- c:\docume~1\alluse~1\applic~1\STOPzilla!
    2010-08-03 13:47:26 0 d-----w- c:\docume~1\paul\applic~1\SafeReturner
    2010-08-03 13:47:17 0 d-----w- c:\program files\Safe Returner
    2010-07-18 16:27:11 0 d-----w- c:\program files\ACD Systems
    2010-07-18 02:52:51 0 d-----w- c:\program files\OSS
    2010-07-14 13:41:31 0 d-----w- C:\00c5da6a8598ca1b77
    2010-07-14 13:38:10 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

    ==================== Find3M ====================

    2010-08-11 00:21:41 201649 ----a-w- c:\windows\Photo Pos Pro Uninstaller.exe
    2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
    2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
    2010-06-22 19:23:27 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-06-22 19:23:25 12536 ------w- c:\windows\system32\avgrsstx.dll
    2010-06-22 19:23:16 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-06-21 15:27:11 354304 ----a-w- c:\windows\system32\drivers\srv.sys
    2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll
    2010-06-14 09:57:49 528384 ----a-w- c:\windows\system32\PosGRP.dll
    2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll
    2010-06-01 15:58:20 53248 ----a-w- c:\windows\system32\PosTBsknLib.dll
    2010-05-27 15:44:20 237320 ----a-w- c:\windows\system32\PDBoot.exe
    2002-07-31 23:55:12 98 --sh--w- c:\windows\WSYS049.SYS

    ============= FINISH: 9:12:47.63 ===============

    Thanks
    Last edited by Drs Orders; August 13th, 2010 at 12:32 PM.
    Reply With Quote Reply With Quote
  8. August 14th, 2010, 12:30 PM #7
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Attach.txt part of DDS is missing and we still need Malwarebytes log.
    My Home Page
    Reply With Quote Reply With Quote
  9. August 14th, 2010, 01:38 PM #8
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322
    Sorry . Here is last part of DDS log . Will post MAlwarebytes .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 2/8/2010 3:47:07 PM
    System Uptime: 8/13/2010 9:02:37 AM (0 hours ago)

    Motherboard: ASUSTeK Computer Inc. | | P4P800SE
    Processor: Intel(R) Pentium(R) 4 CPU 2.66GHz | CPU 1 | 2672/133mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 233 GiB total, 212.476 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    F: is CDROM ()
    G: is CDROM ()
    H: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Ethernet Controller
    Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\4&2E98101C&0&28F0
    Manufacturer:
    Name: Ethernet Controller
    PNP Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\4&2E98101C&0&28F0
    Service:

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: Multimedia Audio Controller
    Device ID: PCI\VEN_8086&DEV_24D5&SUBSYS_80F31043&REV_02\3&267A616A&0&FD
    Manufacturer:
    Name: Multimedia Audio Controller
    PNP Device ID: PCI\VEN_8086&DEV_24D5&SUBSYS_80F31043&REV_02\3&267A616A&0&FD
    Service:

    ==== System Restore Points ===================

    No restore point in system.

    ==== Installed Programs ======================

    ABCSpell for Outlook Express
    ACDSee 5.0 Standard Trial
    Adobe AIR
    Adobe Anchor Service CS4
    Adobe Bridge CS4
    Adobe CMaps CS4
    Adobe Color - Photoshop Specific CS4
    Adobe Color EU Extra Settings CS4
    Adobe Color JA Extra Settings CS4
    Adobe Color NA Recommended Settings CS4
    Adobe Color Video Profiles CS CS4
    Adobe Common File Installer
    Adobe CSI CS4
    Adobe Default Language CS4
    Adobe Device Central CS4
    Adobe Drive CS4
    Adobe ExtendScript Toolkit CS4
    Adobe Extension Manager CS4
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Help Center 1.0
    Adobe Linguistics CS4
    Adobe Media Player
    Adobe Output Module
    Adobe PDF Library Files CS4
    Adobe Photoshop CS2
    Adobe Photoshop CS4
    Adobe Photoshop CS4 Support
    Adobe Photoshop Lightroom 3
    Adobe Search for Help
    Adobe Service Manager Extension
    Adobe Setup
    Adobe Stock Photos 1.0
    Adobe Type Support CS4
    Adobe Update Manager CS4
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS4
    AdobeColorCommonSetCMYK
    AdobeColorCommonSetRGB
    AFPL Ghostscript 7.33
    AFPL Ghostscript Fonts
    Apple Application Support
    Apple Software Update
    AVG 9.0
    BufferChm
    Canon Utilities Digital Photo Professional 3.7
    CCleaner
    CDDRV_Installer
    Cisco Network Magic
    ClocX (1.5b2)
    Connect
    Corel Applications
    Creative MediaSource 5
    Creative Software AutoUpdate
    Creative System Information
    Creative WaveStudio 7
    Desktop iCalendar Lite 1.1.0
    Destinations
    DeviceManagementQFolder
    DocProc
    DocProcQFolder
    DSSD
    erLT
    Firefox Preloader
    G-Zapper v2.5
    Garmin Communicator Plugin with myGarmin Agent
    Garmin USB Drivers
    Garmin WebUpdater
    Google Earth
    Google Update Helper
    GPBaseService2
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    hp deskjet 960c series (Remove only)
    HP Imaging Device Functions 13.0
    HP Photosmart Essential 3.5
    HP Scanjet G4000 Series
    HP Scanjet G4000 series 8.0
    HP Solution Center 13.0
    HP Update
    hpg4000
    hpg4000QFolder
    HPPhotosmartEssential
    HPProductAssistant
    Icon Restore 1.0
    Jasc Paint Shop Pro 8
    Java Auto Updater
    Java(TM) 6 Update 18
    KhalInstallWrapper
    kuler
    Logitech ImageStudio
    Logitech SetPoint
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 12
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Works 4.5
    Mozilla Firefox (3.6.8)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MWSnap 3
    Nero 7 Ultra Edition
    Network Magic
    NTI CD & DVD-Maker
    NTI CD & DVD-Maker Platinum Trial
    NVIDIA Drivers
    OCR Software by I.R.I.S. 13.0
    OSS Internet Speed Booster 3.0.0.0
    Panerai 1.0
    PanoStandAlone
    PDF Settings CS4
    PerfectDisk 11 Home Premium
    Photo Pos Pro
    Photoshop Camera Raw
    Pure Networks Platform
    QuickTime
    RegCure
    Scan
    ScannerCopy
    Security Update for 2007 Microsoft Office System (KB2277947)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for 2007 Microsoft Office System (KB982312)
    Security Update for 2007 Microsoft Office System (KB982331)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB982308)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office Outlook 2007 (KB980376)
    Security Update for Microsoft Office PowerPoint 2007 (KB982158)
    Security Update for Microsoft Office Publisher 2007 (KB982124)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2251419)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB978207)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Skype™ 4.2
    SolutionCenter
    Sound Blaster Audigy
    Spybot - Search & Destroy
    Spyware Doctor 7.0
    Suite Shared Configuration CS4
    SUPERAntiSpyware Professional
    Uniblue DriverScanner 2010
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Outlook 2007 Junk Email Filter (kb2279264)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB978506)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB978207)
    Visual Business Cards 4
    WebEx Support Manager for Internet Explorer
    WebFldrs XP
    WebReg
    Window Washer 5
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
    Windows Driver Package - Hewlett-Packard Image (03/27/2007 8.3.0.0)
    Windows Genuine Advantage Notifications (KB905474)
    Windows Internet Explorer 8
    Windows Live OneCare safety scanner
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    WinRAR archiver

    ==== Event Viewer Messages From Past Week ========

    8/9/2010 11:56:16 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the szserver service.
    8/9/2010 10:06:25 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
    8/8/2010 9:28:06 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service upnphost with arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
    8/10/2010 8:08:53 PM, error: Print [19] - Sharing printer failed + 1722, Printer hp deskjet 960c series share name hpdeskjet9~2.

    ==== End Of File ===========================
    Reply With Quote Reply With Quote
  11. August 14th, 2010, 06:27 PM #9
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322
    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4429

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    8/14/2010 4:31:35 PM
    mbam-log-2010-08-14 (16-31-35).txt

    Scan type: Full scan (C:\|)
    Objects scanned: 207184
    Time elapsed: 46 minute(s), 30 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
    Reply With Quote Reply With Quote
  12. August 14th, 2010, 06:30 PM #10
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"

    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
    My Home Page
    Reply With Quote Reply With Quote
  13. August 14th, 2010, 06:32 PM #11
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322
    Thanks Broni , will pass it on and post back.
    Reply With Quote Reply With Quote
  14. August 14th, 2010, 06:34 PM #12
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    OK
    My Home Page
    Reply With Quote Reply With Quote
  15. August 14th, 2010, 07:39 PM #13
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322
    ComboFix 10-08-14.02 - Paul 08/14/2010 19:17:37.1.1 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3710.3155 [GMT -4:00]
    Running from: c:\documents and settings\Paul\Desktop\ComboFix.exe
    AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\settings.reg
    c:\windows\system32\Data
    c:\windows\system32\syoepk_lib0.dll

    .
    ((((((((((((((((((((((((( Files Created from 2010-07-14 to 2010-08-14 )))))))))))))))))))))))))))))))
    .

    2010-08-14 12:13 . 2010-08-14 23:12 8136704 ---ha-w- c:\windows\system32\SecSigDB.BIN
    2010-08-14 12:13 . 2010-08-14 23:12 450000 ---ha-w- c:\windows\system32\NameDB.BIN
    2010-08-14 12:13 . 2010-08-14 12:13 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Mozilla
    2010-08-14 12:09 . 2010-08-14 13:13 -------- d-----w- c:\program files\Max Spyware Detector
    2010-08-13 00:00 . 2010-08-13 00:02 -------- d-----w- C:\6a90c1337582c2e567f20e
    2010-08-12 10:45 . 2010-08-12 10:45 -------- d-----w- c:\program files\Trend Micro
    2010-08-12 03:10 . 2010-08-12 03:10 433384 ------w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
    2010-08-11 18:25 . 2010-08-11 18:40 -------- d-----w- c:\documents and settings\Paul\Application Data\GARMIN
    2010-08-11 18:25 . 2010-08-11 18:25 -------- d-----w- c:\program files\Garmin GPS Plugin
    2010-08-11 13:04 . 2010-08-11 13:04 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-08-10 04:17 . 2010-08-10 04:17 -------- d-----w- c:\program files\Pure Networks
    2010-08-10 04:16 . 2010-08-10 03:52 34226736 ------w- c:\documents and settings\All Users\Application Data\Pure Networks\Setup\nmsetup.exe
    2010-08-10 02:03 . 2010-08-10 02:03 16384 ------w- C:\SZKGFS.dat
    2010-08-10 02:01 . 2010-08-10 02:01 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
    2010-08-10 01:59 . 2010-08-10 01:59 -------- d-----w- c:\program files\Common Files\iS3
    2010-08-10 01:59 . 2010-08-10 03:56 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
    2010-08-04 03:01 . 2010-08-04 03:04 -------- d-----w- c:\program files\Windows Live Safety Center
    2010-08-03 13:47 . 2010-08-03 13:54 -------- d-----w- c:\documents and settings\Paul\Application Data\SafeReturner
    2010-08-03 13:47 . 2010-08-05 04:31 -------- d-----w- c:\program files\Safe Returner
    2010-07-18 16:27 . 2010-07-18 16:27 65536 ------w- c:\documents and settings\Paul\Application Data\Microsoft\Installer\{A4C7096C-DB17-4B31-BBDB-E805513AA637}\FotoCanvasLitePMFolderShortcut.exe
    2010-07-18 16:27 . 2010-07-18 16:27 65536 ------w- c:\documents and settings\Paul\Application Data\Microsoft\Installer\{A4C7096C-DB17-4B31-BBDB-E805513AA637}\FotoCanvasLiteDesktopShortcut.exe
    2010-07-18 16:27 . 2010-07-18 16:27 61440 ------w- c:\documents and settings\Paul\Application Data\Microsoft\Installer\{A4C7096C-DB17-4B31-BBDB-E805513AA637}\ACDSeePMFolderShortcut.exe
    2010-07-18 16:27 . 2010-07-18 16:27 61440 ------w- c:\documents and settings\Paul\Application Data\Microsoft\Installer\{A4C7096C-DB17-4B31-BBDB-E805513AA637}\ACDSeeDesktopShortcut.exe
    2010-07-18 16:27 . 2010-07-18 16:27 15150 ------w- c:\documents and settings\Paul\Application Data\Microsoft\Installer\{A4C7096C-DB17-4B31-BBDB-E805513AA637}\PowerPackNow.exe
    2010-07-18 16:27 . 2010-07-18 16:27 15150 ------w- c:\documents and settings\Paul\Application Data\Microsoft\Installer\{A4C7096C-DB17-4B31-BBDB-E805513AA637}\ACDSeeNowShortcut.exe
    2010-07-18 16:27 . 2010-07-18 16:27 12062 ------w- c:\documents and settings\Paul\Application Data\Microsoft\Installer\{A4C7096C-DB17-4B31-BBDB-E805513AA637}\ARPPRODUCTICON.exe
    2010-07-18 16:27 . 2010-07-18 16:27 -------- d-----w- c:\program files\ACD Systems
    2010-07-18 02:52 . 2010-07-18 02:52 -------- d-----w- c:\program files\OSS

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-08-14 23:12 . 2010-02-09 13:30 123 ----a-w- c:\documents and settings\All Users\Application Data\Max Secure\Max Spyware Detector\SysSD.dll
    2010-08-13 17:13 . 2010-02-19 23:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-08-13 17:13 . 2010-06-20 23:38 -------- d-----w- c:\program files\Spyware Doctor
    2010-08-11 18:25 . 2010-02-21 16:54 -------- d-----w- c:\program files\Garmin
    2010-08-11 00:21 . 2010-06-27 16:25 201649 ------w- c:\windows\Photo Pos Pro Uninstaller.exe
    2010-08-11 00:21 . 2010-06-27 16:25 -------- d-----w- c:\program files\Photo Pos Pro
    2010-08-11 00:05 . 2010-02-09 02:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2010-08-10 23:58 . 2010-02-08 21:04 75872 ------w- c:\documents and settings\Paul\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-08-10 23:36 . 2010-02-09 04:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-08-10 23:36 . 2010-02-09 04:33 -------- d-----w- c:\program files\CCleaner
    2010-08-10 04:17 . 2010-02-09 13:17 8892928 ------w- c:\documents and settings\All Users\Application Data\atscie.msi
    2010-08-10 03:53 . 2010-02-28 20:56 -------- d-----w- c:\program files\ClocX
    2010-08-07 13:43 . 2010-02-08 19:44 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
    2010-08-05 04:31 . 2010-06-13 23:08 -------- d-----r- c:\program files\Skype
    2010-08-04 05:05 . 2010-02-08 18:46 -------- d-----w- c:\program files\Common Files\Webroot Shared
    2010-07-23 21:38 . 2010-06-13 23:09 -------- d-----w- c:\documents and settings\Paul\Application Data\Skype
    2010-07-23 21:37 . 2010-06-13 23:11 -------- d-----w- c:\documents and settings\Paul\Application Data\skypePM
    2010-07-18 16:27 . 2010-02-09 12:12 -------- d-----w- c:\program files\Common Files\ACD Systems
    2010-07-18 03:26 . 2010-02-19 20:37 -------- d-----w- c:\program files\Uniblue
    2010-07-18 03:12 . 2010-02-19 20:37 -------- d-----w- c:\documents and settings\Paul\Application Data\Uniblue
    2010-07-17 17:48 . 2010-04-11 17:33 -------- d-----w- c:\program files\RegCure
    2010-07-05 13:47 . 2010-02-09 01:33 -------- d-----w- c:\program files\Common Files\Adobe
    2010-06-30 12:31 . 2006-02-28 12:00 149504 ------w- c:\windows\system32\schannel.dll
    2010-06-27 16:25 . 2010-06-27 16:25 -------- d-----w- c:\program files\Common Files\Thraex Software
    2010-06-24 12:22 . 2006-02-28 12:00 916480 ------w- c:\windows\system32\wininet.dll
    2010-06-23 13:44 . 2006-02-28 12:00 1851904 ------w- c:\windows\system32\win32k.sys
    2010-06-22 19:23 . 2010-02-08 19:45 243024 ------w- c:\windows\system32\drivers\avgtdix.sys
    2010-06-22 19:23 . 2010-06-22 19:23 12536 ------w- c:\windows\system32\avgrsstx.dll
    2010-06-22 19:23 . 2010-02-08 19:45 216400 ------w- c:\windows\system32\drivers\avgldx86.sys
    2010-06-21 15:27 . 2006-02-28 12:00 354304 ------w- c:\windows\system32\drivers\srv.sys
    2010-06-20 23:39 . 2010-06-20 23:38 -------- d-----w- c:\program files\Common Files\PC Tools
    2010-06-20 23:38 . 2010-06-20 23:38 -------- d-----w- c:\documents and settings\Paul\Application Data\PC Tools
    2010-06-20 23:38 . 2010-06-20 23:38 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
    2010-06-20 03:08 . 2010-06-20 03:05 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
    2010-06-20 02:57 . 2010-06-20 02:57 -------- d-----w- c:\program files\Adobe Media Player
    2010-06-20 02:55 . 2010-06-20 02:55 -------- d-----w- c:\program files\Common Files\Adobe AIR
    2010-06-20 02:52 . 2010-06-20 02:52 -------- d-----w- c:\program files\Common Files\Macrovision Shared
    2010-06-19 10:38 . 2010-06-19 10:38 -------- d-----w- c:\program files\Canon
    2010-06-17 14:03 . 2006-02-28 12:00 80384 ------w- c:\windows\system32\iccvid.dll
    2010-06-17 13:51 . 2010-02-20 04:10 117760 ------w- c:\documents and settings\Paul\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-06-16 13:23 . 2010-06-16 13:23 -------- d-----w- c:\program files\Reference Assemblies
    2010-06-14 14:31 . 2010-02-08 20:39 744448 ------w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
    2010-06-14 09:57 . 2010-04-06 10:10 528384 ------w- c:\windows\system32\PosGRP.dll
    2010-06-14 07:41 . 2006-02-28 12:00 1172480 ------w- c:\windows\system32\msxml3.dll
    2010-06-13 23:11 . 2010-06-13 23:11 56 ------w- c:\windows\system32\ezsidmv.dat
    2010-06-01 19:58 . 2010-02-08 19:45 29584 ------w- c:\windows\system32\drivers\avgmfx86.sys
    2010-06-01 15:58 . 2010-04-06 10:10 53248 ------w- c:\windows\system32\PosTBsknLib.dll
    2010-05-27 15:44 . 2010-05-27 15:44 237320 ------w- c:\windows\system32\PDBoot.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-07-08 472112]
    "MyGarminAgent"="c:\program files\Garmin\MyGarminAgent\MyGarminAgent.exe" [2010-03-16 337256]
    "SDActiveMonitor"="c:\program files\Max Spyware Detector\MaxSDTray.exe" [2010-08-05 718520]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-2-8 813584]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 19:21 548352 ------w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2010-06-22 19:23 12536 ------w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2009-07-20 17:28 72208 ------w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MaxDSrv]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Firefox Preloader.lnk]
    backup=c:\windows\pss\Firefox Preloader.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
    backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Paul^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    backup=c:\windows\pss\Adobe Gamma.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Paul^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
    backup=c:\windows\pss\Logitech . Product Registration.lnkStartup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
    2008-08-14 11:58 611712 ------w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
    2007-04-04 19:41 970752 ------w- c:\program files\Common Files\Adobe\Updater\AdobeUpdater.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG9_TRAY]
    2010-06-22 19:23 2065760 ------w- c:\progra~1\AVG\AVG9\avgtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    2006-10-09 16:28 139264 ------w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
    2005-10-31 18:51 57344 ------w- c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    2008-10-25 16:44 31072 ------w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2007-05-08 20:24 54840 ------w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
    2001-11-07 18:36 196608 ------w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]
    2008-08-20 14:54 150016 ------w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iCalendar]
    2008-03-16 00:23 2774528 ------w- c:\program files\Desksware\Desktop iCal\Calendar.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
    2006-07-25 20:55 1043968 ------w- c:\program files\Nero\Nero 7\InCD\InCD.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
    2010-06-20 23:57 1287120 ------w- c:\program files\Spyware Doctor\pctsTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechGalleryRepair]
    2002-12-10 23:32 155648 ------w- c:\program files\Logitech\ImageStudio\ISStart.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechImageStudioTray]
    2002-12-10 23:31 61440 ------w- c:\program files\Logitech\ImageStudio\LogiTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]
    2002-12-10 22:54 127022 ------w- c:\program files\Common Files\Logitech\QCDriver3\LVComS.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
    2010-04-29 19:39 437584 ------w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    2006-01-12 21:40 155648 ------w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nmctxth]
    2009-07-07 19:48 647216 ------w- c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    2008-05-16 22:01 86016 ------w- c:\windows\system32\nvmctray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2009-11-11 04:08 417792 ------w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDActiveMonitor]
    2010-08-05 03:00 718520 ------w- c:\program files\Max Spyware Detector\MaxSDTray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2010-01-11 20:21 246504 ------w- c:\program files\Common Files\Java\Java Update\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
    2010-03-29 12:29 2012912 ------w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer]
    2003-08-04 13:00 196096 ------w- c:\program files\Webroot\Washer\wwDisp.exe
    Reply With Quote Reply With Quote
  16. August 14th, 2010, 08:03 PM #14
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Combofix log is incomplete.
    Please, repost.
    My Home Page
    Reply With Quote Reply With Quote
  17. August 14th, 2010, 08:12 PM #15
    Drs Orders
    Drs Orders is offline Virtual PC Surgeon!
    Join Date
    Jan 2006
    Posts
    1,322
    Sorry Broni , had to break it into two parts . thought the last one took.

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "MaxWatchDogService"=2 (0x2)
    "Browser Defender Update Service"=2 (0x2)
    "sdCoreService"=3 (0x3)
    "sdAuxService"=3 (0x3)
    "WMPNetworkSvc"=3 (0x3)
    "ose"=3 (0x3)
    "odserv"=3 (0x3)
    "NBService"=3 (0x3)
    "Microsoft Office Groove Audit Service"=3 (0x3)
    "MBAMService"=2 (0x2)
    "LBTServ"=3 (0x3)
    "InCDsrv"=2 (0x2)
    "Adobe LM Service"=3 (0x3)
    "ABCSpell Helper Service"=2 (0x2)
    "WebClient"=3 (0x3)
    "VSS"=3 (0x3)
    "SCardSvr"=3 (0x3)
    "RDSessMgr"=3 (0x3)
    "Netlogon"=3 (0x3)
    "MaxDSrv"=3 (0x3)
    "avg9wd"=2 (0x2)
    "avg9emc"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
    "c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
    "c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
    "c:\\WINDOWS\\system32\\spoolsv.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe"= c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5353:TCP"= 5353:TCP:Adobe CSI CS4

    R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2/8/2010 3:45 PM 52872]
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/20/2010 7:38 PM 218592]
    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/8/2010 3:45 PM 216400]
    R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/8/2010 3:45 PM 243024]
    R1 MaxProc;MaxProc;c:\program files\Max Spyware Detector\MaxProc.sys [8/14/2010 8:13 AM 31416]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 11:15 AM 66632]
    R1 SDManager;SDManager;c:\program files\Max Spyware Detector\SDManager.sys [8/14/2010 8:09 AM 34488]
    R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2/8/2010 11:07 PM 10384]
    R2 MaxProtector;MaxProtector;c:\program files\Max Spyware Detector\MaxProtector.sys [8/14/2010 8:09 AM 30392]
    R2 MaxWatchDogService;MaxWatchDogService;c:\program files\Max Spyware Detector\MaxWatchDogService.exe [8/14/2010 8:09 AM 424632]
    R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 12:55 PM 40720]
    R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 12:55 PM 10384]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/16/2010 6:28 AM 135664]
    S2 MaxNPF;MaxNPF;c:\program files\Max Spyware Detector\MaxNpf.sys [8/14/2010 8:09 AM 37560]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2/8/2010 8:31 PM 20952]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 11:15 AM 12872]
    S3 SDActMon;SDActMon;c:\program files\Max Spyware Detector\SDActMon.sys [8/14/2010 8:09 AM 32952]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
    S4 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [6/22/2010 3:23 PM 921952]
    S4 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/22/2010 3:23 PM 308136]
    S4 MaxDSrv;MaxDSrv;c:\program files\Max Spyware Detector\MaxDSrv.exe [8/14/2010 8:12 AM 409784]
    S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2/8/2010 8:32 PM 304464]
    S4 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/20/2010 7:38 PM 366840]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    hpdevmgmt REG_MULTI_SZ hpqcxs08
    .
    Contents of the 'Scheduled Tasks' folder

    2010-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-16 10:28]

    2010-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-16 10:28]

    2010-08-14 c:\windows\Tasks\RegCure Program Check.job
    - c:\program files\RegCure\RegCure.exe [2010-05-19 23:20]

    2010-04-11 c:\windows\Tasks\RegCure.job
    - c:\program files\RegCure\RegCure.exe [2010-05-19 23:20]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    Trusted Zone: phonedetective.com\www
    FF - ProfilePath - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\rxmnocmt.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca
    FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: browser.cache.memory.capacity - 65536
    FF - user.js: browser.chrome.favicons - false
    FF - user.js: browser.display.show_image_placeholders - true
    FF - user.js: browser.turbo.enabled - true
    FF - user.js: browser.urlbar.autocomplete.enabled - true
    FF - user.js: browser.urlbar.autofill - true
    FF - user.js: content.interrupt.parsing - true
    FF - user.js: content.max.tokenizing.time - 2250000
    FF - user.js: content.notify.backoffcount - 5
    FF - user.js: content.notify.interval - 750000
    FF - user.js: content.notify.ontimer - true
    FF - user.js: content.switch.threshold - 750000
    FF - user.js: network.http.max-connections - 48
    FF - user.js: network.http.max-connections-per-server - 16
    FF - user.js: network.http.max-persistent-connections-per-proxy - 16
    FF - user.js: network.http.max-persistent-connections-per-server - 8
    FF - user.js: network.http.pipelining - true
    FF - user.js: network.http.pipelining.firstrequest - true
    FF - user.js: network.http.pipelining.maxrequests - 8
    FF - user.js: network.http.proxy.pipelining - true
    FF - user.js: network.http.request.max-start-delay - 0
    FF - user.js: nglayout.initialpaint.delay - 0
    FF - user.js: plugin.expose_full_path - true
    FF - user.js: ui.submenuDelay - 0
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-SDAutoScan - (no file)
    ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
    Notify-TPSvc - TPSvc.dll
    MSConfigStartUp-Performance Center - c:\program files\Ascentive\Performance Center\ApcMain.exe
    MSConfigStartUp-smp - c:\program files\Pure Networks\Speed Meter Pro\smp.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-08-14 19:23
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(744)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\WININET.dll
    c:\documents and settings\Paul\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    c:\documents and settings\Paul\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\common files\logishrd\bluetooth\LBTServ.dll
    c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
    .
    Completion time: 2010-08-14 19:26:28
    ComboFix-quarantined-files.txt 2010-08-14 23:26

    Pre-Run: 227,948,838,912 bytes free
    Post-Run: 227,923,349,504 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    - - End Of File - - 9C3BEB0199E0F4BAC90F35CA86994F33
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules