1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active Low virtual memory warning popping up

Discussion in 'Malware and Virus Removal Archive' started by missa85, 2010/01/03.

  1. 2010/01/03
    missa85

    missa85 Inactive Thread Starter

    Joined:
    2008/05/07
    Messages:
    117
    Likes Received:
    1
    [Active] Low virtual memory warning popping up

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-12-01.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 31/07/2006 4:54:09 PM
    System Uptime: 1/04/2010 7:02:44 AM (-2087 hours ago)

    Motherboard: Gigabyte Technology Co., Ltd. | | GA-8S661FXMP-RZ
    Processor: Intel(R) Celeron(R) CPU 2.80GHz | Socket 478 | 2800/133mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 75 GiB total, 46.749 GiB free.
    D: is CDROM ()
    E: is Removable
    F: is Removable
    G: is Removable
    H: is Removable
    I: is FIXED (NTFS) - 932 GiB total, 888.902 GiB free.

    ==== Disabled Device Manager Items =============

    Class GUID:
    Description:
    Device ID: ROOT\LEGACY_MSISERVER\0000
    Manufacturer:
    Name:
    PNP Device ID: ROOT\LEGACY_MSISERVER\0000
    Service:

    ==== System Restore Points ===================

    RP754: 6/11/2009 11:20:51 AM - Installed Uniblue DriverScanner v1.0
    RP755: 6/11/2009 1:59:16 PM - Software Distribution Service 3.0
    RP756: 7/11/2009 4:30:43 PM - System Checkpoint
    RP757: 8/11/2009 6:14:00 AM - Installed Java(TM) 6 Update 17
    RP758: 9/11/2009 11:50:59 AM - System Checkpoint
    RP759: 11/11/2009 1:06:55 PM - System Checkpoint
    RP760: 12/11/2009 3:00:31 AM - Software Distribution Service 3.0
    RP761: 13/11/2009 6:40:34 AM - System Checkpoint
    RP762: 14/11/2009 3:00:31 AM - Software Distribution Service 3.0
    RP763: 15/11/2009 7:19:17 AM - System Checkpoint
    RP764: 15/11/2009 6:12:15 AM - System Checkpoint
    RP765: 16/11/2009 6:37:29 AM - System Checkpoint
    RP766: 1/01/2005 12:59:23 AM - System Checkpoint
    RP767: 2/01/2005 4:22:10 AM - System Checkpoint
    RP768: 19/11/2005 9:58:08 PM - Installed Windows Internet Explorer 8.
    RP769: 19/11/2009 12:25:49 PM - System Checkpoint
    RP770: 20/11/2009 1:22:48 PM - System Checkpoint
    RP771: 21/11/2009 5:47:38 PM - System Checkpoint
    RP772: 22/11/2009 7:05:35 PM - System Checkpoint
    RP773: 23/11/2009 7:59:10 PM - System Checkpoint
    RP774: 25/11/2009 6:42:54 AM - System Checkpoint
    RP775: 25/11/2009 8:18:02 PM - Software Distribution Service 3.0
    RP776: 27/11/2009 6:47:12 AM - System Checkpoint
    RP777: 28/11/2009 8:23:07 AM - System Checkpoint
    RP778: 29/11/2009 10:08:58 AM - System Checkpoint
    RP779: 30/11/2009 10:47:02 PM - System Checkpoint
    RP780: 2/12/2009 6:30:18 AM - System Checkpoint
    RP781: 3/12/2009 1:57:48 PM - System Checkpoint
    RP782: 4/12/2009 2:26:05 PM - System Checkpoint
    RP783: 5/12/2009 2:44:55 PM - System Checkpoint
    RP784: 6/12/2009 4:47:35 PM - System Checkpoint
    RP785: 7/12/2009 4:50:59 PM - System Checkpoint
    RP786: 8/12/2009 4:56:01 PM - System Checkpoint
    RP787: 9/12/2009 5:23:17 PM - System Checkpoint
    RP788: 10/12/2009 3:00:49 AM - Software Distribution Service 3.0
    RP789: 11/12/2009 5:37:04 AM - System Checkpoint
    RP790: 12/12/2009 8:13:47 AM - System Checkpoint
    RP791: 13/12/2009 9:23:39 AM - System Checkpoint
    RP792: 14/12/2009 10:07:45 AM - System Checkpoint
    RP793: 15/12/2009 3:00:42 AM - Software Distribution Service 3.0
    RP794: 16/12/2009 6:33:08 AM - System Checkpoint
    RP795: 17/12/2009 7:17:10 AM - System Checkpoint
    RP796: 18/12/2009 2:42:40 PM - System Checkpoint
    RP797: 19/12/2009 3:25:31 PM - System Checkpoint
    RP798: 20/12/2009 4:25:11 PM - System Checkpoint
    RP799: 21/12/2009 5:10:56 PM - System Checkpoint
    RP800: 22/12/2009 5:29:50 PM - System Checkpoint
    RP801: 23/12/2009 8:32:44 PM - System Checkpoint
    RP802: 25/12/2009 9:25:58 AM - System Checkpoint
    RP803: 26/12/2009 9:49:28 AM - System Checkpoint
    RP804: 27/12/2009 10:58:18 AM - System Checkpoint
    RP805: 28/12/2009 1:07:48 PM - System Checkpoint
    RP806: 29/12/2009 1:59:45 PM - System Checkpoint
    RP807: 30/12/2009 2:07:12 PM - System Checkpoint
    RP808: 31/12/2009 2:07:39 PM - System Checkpoint
    RP809: 1/01/2010 2:38:48 PM - System Checkpoint
    RP810: 2/01/2010 4:00:13 PM - System Checkpoint
    RP811: 4/01/2010 6:57:12 AM - Software Distribution Service 3.0

    ==== Installed Programs ======================


    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 8.1.2
    Adobe Shockwave Player 11
    Adobe® Photoshop® Album Starter Edition 3.0
    Agere Systems PCI Soft Modem
    µTorrent
    Auslogics Disk Defrag
    Brother MFL-Pro Suite
    ccCommon
    Crawler Toolbar
    DVD Shrink 3.2
    Fast Browser Search (My Web Tattoo)
    FUJIFILM FinePixViewer S Ver.2.1
    Home Media Server 4.0.0.0072
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB954708)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Imikimi Plugin
    Inca Ball
    J2SE Runtime Environment 5.0 Update 6
    Java(TM) 6 Update 17
    Java(TM) 6 Update 5
    Junk Mail filter update
    LimeWire 5.4.6
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB953297)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Search Enhancement Pack
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    MSVCRT
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6.0 Parser (KB933579)
    Multimedia Samples
    Nero BurnRights
    Nero Suite
    Network Play System (Patching)
    Norton AntiVirus 2006 (Symantec Corporation)
    Norton Protection Center
    OLYMPUS CAMEDIA Master 4.2
    Optus Internet Security Suite 2009
    Pando Media Booster
    PaperPort
    PowerDVD
    QuickTime
    Realtek AC'97 Audio
    RegCure
    SAGEM F@st 1201
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371-v2)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Segoe UI
    Shockwave
    SiS VGA Utilities
    SIW version 2009.10.22
    The Game Of Life
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB975364)
    Update for Windows Internet Explorer 8 (KB976749)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    USB PC Camera Plus
    USB Remote NDIS Network Device
    WebFldrs XP
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3

    ==== Event Viewer Messages From Past Week ========

    31/12/2009 5:02:36 AM, error: Dhcp [1002] - The IP address lease 10.1.1.2 for the Network Card with network address 002569E32948 has been denied by the DHCP server 10.1.1.1 (The DHCP Server sent a DHCPNACK message).
    30/12/2009 8:42:35 AM, error: F-Secure Gatekeeper [1] -
    28/12/2009 6:56:08 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.
    1/01/2010 12:30:31 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the wscsvc service.

    ==== End Of File ===========================
     
  2. 2010/01/03
    missa85

    missa85 Inactive Thread Starter

    Joined:
    2008/05/07
    Messages:
    117
    Likes Received:
    1
    DDS (Ver_09-12-01.01) - NTFSx86
    Run by adam_missa_mia at 7:59:38.12 on Mon 04/01/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.61.1033.18.479.91 [GMT 10:00]

    AV: Optus Internet Security Suite 2009 8.00 *On-access scanning enabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
    FW: Optus Internet Security Suite 2009 8.00 *enabled* {D4747503-0346-49EB-9262-997542F79BF4}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsgk32st.exe
    C:\Program Files\Optus Internet Security Suite\Common\FSMA32.EXE
    C:\Program Files\Optus Internet Security Suite\Anti-Virus\FSGK32.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Optus Internet Security Suite\Common\FSMB32.EXE
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Optus Internet Security Suite\Common\FCH32.EXE
    C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsqh.exe
    C:\Program Files\Optus Internet Security Suite\Common\FAMEH32.EXE
    C:\Program Files\Optus Internet Security Suite\FSPC\fspc.exe
    C:\Program Files\Optus Internet Security Suite\FWES\Program\fsdfwd.exe
    C:\Program Files\Optus Internet Security Suite\Anti-Virus\fssm32.exe
    C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsaua.exe
    C:\Program Files\Optus Internet Security Suite\FSAUA\program\fsus.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\RegCure\RegCure.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\vsnpstd3.exe
    C:\Program Files\Optus Internet Security Suite\Common\FSM32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Pando Networks\Media Booster\PMB.exe
    C:\Program Files\FinePixViewerS\QuickDCF2.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Optus Internet Security Suite\FSGUI\fsguidll.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Optus Internet Security Suite\Anti-Virus\fsav32.exe
    C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCSRVCE.EXE
    C:\Program Files\Windows Live\Toolbar\wltuser.exe
    C:\PROGRA~1\Crawler\CToolbar.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\Optus Internet Security Suite\FSGUI\scanwizard.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Documents and Settings\adam_missa_mia\Local Settings\Temporary Internet Files\Content.IE5\RBHN0EMG\dds[1].scr

    ============== Pseudo HJT Report ===============

    uSearch Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=66028
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uStart Page = hxxp://www.optuszoo.com.au/
    uURLSearchHooks: N/A: {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\crawler\ctbr.dll
    BHO: {00000250-0320-4dd4-be4f-7566d2314352} - No File
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: {13197ace-6851-45c3-a7ff-c281324d5489} - No File
    BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - c:\progra~1\crawler\ctbr.dll
    BHO: {4e1075f4-eec4-4a86-add7-cd5f52858c31} - No File
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: {5dafd089-24b1-4c5e-bd42-8ca72550717b} - No File
    BHO: {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - No File
    BHO: BrowserHelper Class: {8a9d74f9-560b-4fe7-abeb-3b2e638e5cd6} - c:\program files\sgpsa\SearchAssistant.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: {cf021f40-3e14-23a5-cba2-717765728274} - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: {F0626A63-410B-45E2-99A1-3F2475B2D695} - No File
    BHO: {ffff0001-0002-101a-a3c9-08002b2f49fb} - No File
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: &Crawler Toolbar: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - c:\progra~1\crawler\ctbr.dll
    TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
    TB: {855F3B16-6D32-4FE6-8A56-BBB695989046} - No File
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [PcSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog
    uRun: [NBJ] "c:\program files\ahead\nero backitup\NBJ.exe "
    uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe "
    mRun: [snpstd3] c:\windows\vsnpstd3.exe
    mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.0\apps\apdproxy.exe "
    mRun: [F-Secure Manager] "c:\program files\optus internet security suite\common\FSM32.EXE" /splash
    mRun: [F-Secure TNB] "c:\program files\optus internet security suite\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW
    mRun: [SGPUpdater] c:\program files\search guard plusu\sgpUpdaters.exe
    mRun: [FBSearch] c:\program files\search guard plus\SearchGuardPlus.exe
    dRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
    dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
    StartupFolder: c:\documents and settings\adam_missa_mia\start menu\programs\startup\PowerReg Scheduler.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\exifla~1.lnk - c:\program files\finepixviewers\QuickDCF2.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\utilit~1.lnk - c:\windows\system32\sistray.exe
    IE: Crawler Search - tbr:iemenu
    IE: eBay Search - c:\program files\ebay\ebay toolbar2\eBayTb.dll/RCSearch.html
    IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\adam_missa_mia\start menu\programs\imvu\Run IMVU.lnk
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {200DB664-75B5-47c0-8B45-A44ACCF73C00} - {D68926FD-18FD-4B0E-A1C7-917D13FAB760} - c:\program files\optus internet security suite\fspc\fspcmsie.dll
    IE: {200DB664-75B5-47c0-8B45-A44ACCF73F01} - {D68926FD-18FD-4B0E-A1C7-917D13FAB760} - c:\program files\optus internet security suite\fspc\fspcmsie.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    LSP: c:\program files\optus internet security suite\fsps\program\fslsp.dll
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Bejeweled%202/Images/stg_drm.ocx
    DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab
    DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
    Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\crawler\ctbr.dll
    Notify: urqnoOEW - urqnoOEW.dll
    Notify: __c00146D8 - __c00146D8.dat
    Notify: __c0020400 - __c0020400.dat
    Notify: __c005E353 - __c005E353.dat
    Notify: __c00B6CD6 - __c00B6CD6.dat
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ============= SERVICES / DRIVERS ===============

    R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-10-30 33920]
    R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-10-30 79904]
    R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\optus internet security suite\hips\drivers\fshs.sys [2009-10-30 66720]
    R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-6-5 109160]
    R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2007-6-5 109160]
    R2 F-Secure Gatekeeper Handler Starter;FSGKHS;c:\program files\optus internet security suite\anti-virus\fsgk32st.exe [2009-10-30 215648]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\optus internet security suite\anti-virus\minifilter\fsgk.sys [2009-10-30 107104]
    R3 FSORSPClient;F-Secure ORSP Client;c:\program files\optus internet security suite\orsp client\fsorsp.exe [2009-10-30 55904]
    S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [2006-8-5 49399]
    S3 qcusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\drivers\zteusbser.sys --> c:\windows\system32\drivers\ZTEusbser.sys [?]
    S4 F-Secure Filter;F-Secure File System Filter;c:\program files\optus internet security suite\anti-virus\win2k\fsfilter.sys [2009-10-30 39776]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\optus internet security suite\anti-virus\win2k\fsrec.sys [2009-10-30 25184]

    =============== Created Last 30 ================

    2010-01-03 20:56:04 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
    2010-01-03 20:28:08 0 d-----w- c:\docume~1\alluse~1\applic~1\RegCure
    2010-01-01 03:59:35 54156 ---ha-w- c:\windows\QTFont.qfn
    2010-01-01 03:59:35 1409 ----a-w- c:\windows\QTFont.for
    2009-12-26 23:41:49 0 d-----w- c:\docume~1\adam_m~1\applic~1\Sahmon Games
    2009-12-26 23:36:07 0 d-----w- c:\program files\MyPlayCity.com

    ==================== Find3M ====================

    2009-11-07 20:14:27 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-10-29 07:45:38 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-18 07:55:27 3482 -c--a-w- c:\docume~1\adam_m~1\applic~1\wklnhst.dat
    2009-10-13 10:30:16 270336 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:38:19 149504 ----a-w- c:\windows\system32\rastls.dll
    2009-10-12 13:38:18 79872 ----a-w- c:\windows\system32\raschap.dll
    2008-05-05 01:23:22 7476 -csha-w- c:\windows\system32\NnUtAcdd.ini2

    ============= FINISH: 8:01:54.81 ===============
     

  3. to hide this advert.

  4. 2010/01/03
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    There is absolutely no point in posting DDS logs without also describing the problem you have.
     
  5. 2010/01/03
    missa85

    missa85 Inactive Thread Starter

    Joined:
    2008/05/07
    Messages:
    117
    Likes Received:
    1
    Low virtual memory...sorry
     
  6. 2010/01/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
  7. 2010/01/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    RESTART COMPUTER

    STEP 4. Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Installer under Version 2.0.2
    [DO NOT download version 2.0.3 (beta)]
    Install, and run it.
    Post HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  8. 2010/01/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I adjusted topic title...
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.