1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive ActiveX Not Working In IE or Firefox

Discussion in 'Malware and Virus Removal Archive' started by Angstromm, 2010/09/19.

  1. 2010/09/19
    Angstromm

    Angstromm Inactive Thread Starter

    Joined:
    2010/09/18
    Messages:
    10
    Likes Received:
    0
    [Inactive] ActiveX Not Working In IE or Firefox

    OK, found a solution (apparently this is a "known" issue w/ IE8). See my post in the Internet Explore forum (link below)...


    I have a post in the Internet Explorer forum and was told to post this here.

    I've run scans for malware w/ two separate programs (Malwarebytes' Anti-Malware and Ad-Aware) and I've done a full-system scan w/ AVG; the results were negative--no malware or viruses found. I'm a tad puzzled why I've been asked to post my DDS log files here, but I'm doing what I was told to do.

    Here's what I said in my other post, in case that's useful:

    ActiveX isn’t working on my system, period (see specs below)—I’ve gone to the PC Pitstop site and run their test and IE freezes—no, I can’t access the Info Bar and install control. I get an error message (see at bottom) and I have to kill IE via Win Task Manager. Even when I logon to Windows Update site and attempt to run the Upgrade to Microsoft Update (where all MS products, like Office, get updated at once), I get a "This tab has been recovered" message followed by "We were unable to return you to microsoft.com" error. No further info is provided.

    In Firefox, simply get "ActiveX is not supported" on the PC Pitstop test page.

    I’ve tried everything I can think of:
    • disabling firewall and antivirus software
    • going back as far as I can via Win. Restore
    • un-/re-installing IE & Firefox
    • reading a ton of stuff in forums, on MS Support, etc.
    • went to Microsoft Internet Explorer - windows IE activex and tried all that business
    • under C:\WINDOWS\Downloaded Program Files there aren’t any objects listed (empty)
    • checked my IE settings against this page: http://www.pcpitstop.com/faq/security.asp
    • and checked IE settings against those displayed in a post on this site
    • witt’s end!
    All ideas/notions/permutations welcome! I’m to the point where I’m considering a fresh install (I just finished, supposedly, doing that). Sheesh!!!

    IE Error Message:
    iexplore.exe "“ Application Error
    The instruction at "0x08470068" referenced memory at "0x08470068â€. The memory could not be "writtenâ€.

    Config:
    IE 8 (latest updates)
    Firefox 3.6.10 (latest updates)
    Windows XP Pro, SP 3 (everything up-to-date)
    Acer Ferrari 4005 (all the latest drives)


    Here are the contents of DDS.txt:
    Note: contents of Attach.txt in next post​

    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Jim at 8:08:26.20 on Sun 09/19/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.790 [GMT -7:00]

    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\Program Files\AppsAVG\avgchsvx.exe
    C:\Program Files\AppsAVG\avgrsx.exe
    svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\AppsAVG\avgcsrvx.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Apps\eManager\anbmServ.exe
    C:\Program Files\AppsAVG\avgwdsvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\System32\GEARSec.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Nero\Update\NASvc.exe
    C:\Program Files\Norton Ghost\Agent\VProSvc.exe
    C:\Program Files\AppsAVG\avgnsx.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\wltrysvc.exe
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Apps\LaunchMngr\QtZgAcer.EXE
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
    C:\PROGRA~1\AppsAVG\avgtray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Norton Ghost\Agent\GhostTray.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Xmarks\IE Extension\xmarkssync.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Apps\WordWeb\wweb32.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\AppsAVG\avgcsrvx.exe
    C:\Program Files\Microsoft Streets & Trips 2009\StreetsOlkShim.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Program Files\AppsAVG\avgui.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\Jim\Desktop\Dump\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    mSearchAssistant = hxxp://www.google.com/ie
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\appsavg\avgssie.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [Xmarks] c:\program files\xmarks\ie extension\xmarkssync.exe -q
    uRun: [AdobeBridge]
    mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [AGRSMMSG] AGRSMMSG.exe
    mRun: [LManager] c:\program files\apps\launchmngr\QtZgAcer.EXE
    mRun: [<NO NAME>]
    mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe "
    mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
    mRun: [AVG9_TRAY] c:\progra~1\appsavg\avgtray.exe
    mRun: [NBAgent] "c:\program files\apps\nero\nero backitup\NBAgent.exe" /WinStart
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
    mRun: [Norton Ghost 10.0] "c:\program files\norton ghost\agent\GhostTray.exe "
    mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wordwe~1.lnk - c:\program files\apps\wordweb\wweb32.exe
    mPolicies-system: EnableLinkedConnections = 1 (0x1)
    IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: Send To &Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\appsavg\avgpp.dll
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\jim\applic~1\mozilla\firefox\profiles\16e6dr54.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
    FF - prefs.js: network.proxy.type - 0
    FF - component: c:\documents and settings\jim\application data\mozilla\firefox\profiles\16e6dr54.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
    FF - component: c:\program files\appsavg\firefox\components\avgssff.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.buffer.cache.count ", 24);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.buffer.cache.size ", 4096);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 45);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-9-17 64288]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-9-15 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-9-15 29584]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-9-15 243024]
    R2 avg9wd;AVG Free WatchDog;c:\program files\appsavg\avgwdsvc.exe [2010-9-15 308136]
    R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\CCEVTMGR.EXE [2004-12-13 198248]
    R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\CCSETMGR.EXE [2004-12-13 181864]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 1355928]
    R2 NAUpdate;@c:\program files\nero\update\nasvc.exe,-200;c:\program files\nero\update\NASvc.exe [2010-5-4 503080]
    R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2010-9-17 822424]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\CCPWDSVC.EXE [2004-12-13 79464]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15008]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2001-8-23 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    =============== Created Last 30 ================

    2010-09-19 14:45:41 3275 ----a-w- c:\windows\system32\wbem\Outlook_01cb580954c6ff8e.mof
    2010-09-19 07:12:08 0 d--h--w- c:\windows\PIF
    2010-09-19 06:59:56 0 d-----w- c:\docume~1\jim\applic~1\wsInspector
    2010-09-19 05:13:38 0 d-----w- c:\program files\Synaptics
    2010-09-18 20:15:48 0 dc-h--w- c:\windows\ie8
    2010-09-18 04:37:16 15880 ----a-w- c:\windows\system32\lsdelete.exe
    2010-09-18 02:56:42 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-09-18 02:34:08 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-09-18 02:28:28 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{ECC164E0-3133-4C70-A831-F08DB2940F70}
    2010-09-18 02:28:04 0 d-----w- c:\program files\Lavasoft
    2010-09-18 02:01:31 0 d-----w- c:\docume~1\jim\applic~1\Malwarebytes
    2010-09-18 02:01:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-09-18 02:01:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-09-18 02:01:22 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-09-17 23:37:45 0 d-----w- c:\program files\MSXML 4.0
    2010-09-17 21:37:31 0 d-----w- c:\windows\system32\URTTEMP
    2010-09-17 21:15:58 4608 ----a-w- c:\windows\system32\drivers\symlcbrd.sys
    2010-09-17 21:13:09 0 d-----w- c:\program files\Norton Ghost
    2010-09-17 21:11:29 0 d-----w- c:\docume~1\jim\applic~1\Symantec
    2010-09-17 21:10:02 0 d-----w- c:\docume~1\alluse~1\applic~1\Symantec
    2010-09-17 21:09:57 0 d-----w- c:\program files\Symantec
    2010-09-17 01:23:47 0 d-----w- c:\program files\Nero
    2010-09-17 01:16:04 0 d-----w- c:\docume~1\alluse~1\applic~1\Nero
    2010-09-16 23:58:50 0 d-----w- c:\windows\system32\XPSViewer
    2010-09-16 05:48:25 12536 ----a-w- c:\windows\system32\avgrsstx.dll
    2010-09-16 05:48:22 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-09-16 05:48:16 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-09-16 05:48:10 0 d-----w- c:\windows\system32\drivers\Avg
    2010-09-16 05:45:31 0 d-----w- c:\program files\AVG
    2010-09-16 05:45:31 0 d-----w- c:\program files\AppsAVG
    2010-09-16 05:45:13 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
    2010-09-16 04:56:42 0 d-----w- c:\windows\system32\NtmsData
    2010-09-16 04:19:14 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
    2010-09-16 04:19:07 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
    2010-09-16 04:19:00 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
    2010-09-16 04:18:51 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
    2010-09-16 04:18:43 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll
    2010-09-16 04:18:32 0 d-----w- c:\windows\Logs
    2010-09-15 21:02:23 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
    2010-09-15 21:02:23 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
    2010-09-15 18:43:38 0 d-----w- c:\documents and settings\jim\Library
    2010-09-15 16:52:43 0 d-----w- c:\program files\common files\Macrovision Shared
    2010-09-15 16:52:21 45392 ----a-r- c:\windows\system32\AdobePDF.dll
    2010-09-15 16:52:21 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
    2010-09-15 16:29:35 0 d-----w- c:\program files\Microsoft Streets & Trips 2009
    2010-09-15 16:28:08 0 d-----w- c:\program files\MSECache
    2010-09-15 06:51:16 0 d-----w- c:\docume~1\jim\applic~1\WordWeb
    2010-09-15 06:50:19 1534200 ----a-w- c:\windows\system32\wweb32.dll
    2010-09-15 06:03:58 266360 ----a-w- c:\windows\system32\TweakUI.exe
    2010-09-15 06:03:58 160217 ----a-w- c:\windows\system32\PowerToysLicense.rtf
    2010-09-15 05:01:08 3275 ----a-w- c:\windows\system32\wbem\Outlook_01cb549302741ea2.mof
    2010-09-15 04:56:36 0 d-----w- c:\windows\pss
    2010-09-15 03:12:20 0 d-----w- c:\windows\system32\Backup
    2010-09-15 03:12:01 0 d-----w- c:\windows\SQLHotfix
    2010-09-15 03:10:52 466 ----a-w- c:\windows\system32\mapisvc.inf
    2010-09-15 03:10:45 33340 ------w- c:\windows\system32\dbmsqlgc.dll
    2010-09-15 03:10:45 24576 ------w- c:\windows\system32\dbmsgnet.dll
    2010-09-15 03:10:40 306688 ----a-w- c:\windows\IsUninst.exe
    2010-09-15 03:09:28 0 d-----w- c:\program files\common files\Crystal Decisions
    2010-09-15 03:08:02 0 d-----w- c:\program files\Microsoft SQL Server
    2010-09-15 03:07:02 0 d-----w- c:\windows\system32\appmgmt
    2010-09-15 02:11:16 0 d-----w- c:\docume~1\jim\applic~1\IESessionManager
    2010-09-15 00:37:16 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01009.Wdf
    2010-09-15 00:37:12 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
    2010-09-15 00:37:06 16928 ------w- c:\windows\system32\spmsgXP_2k3.dll
    2010-09-15 00:36:43 228784 ----a-w- c:\windows\system32\drivers\SynTP.sys
    2010-09-15 00:36:42 206120 ----a-w- c:\windows\system32\SynCtrl.dll
    2010-09-15 00:36:42 169256 ----a-w- c:\windows\system32\SynCOM.dll
    2010-09-15 00:36:42 161064 ----a-w- c:\windows\system32\SynTPAPI.dll
    2010-09-15 00:36:42 1461992 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
    2010-09-15 00:36:42 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
    2010-09-14 23:04:19 0 d-----w- c:\program files\Xmarks
    2010-09-14 21:42:31 0 d-----w- c:\docume~1\jim\applic~1\Windows Search
    2010-09-14 20:49:58 0 d-----w- c:\windows\system32\winrm
    2010-09-14 20:49:49 0 dc-h--w- c:\windows\$968930Uinstall_KB968930$
    2010-09-14 19:19:00 376 ----a-w- c:\windows\ODBC.INI
    2010-09-14 19:18:52 28040 ----a-w- c:\windows\system32\mdimon.dll
    2010-09-14 19:17:54 0 d-----w- c:\program files\Microsoft ActiveSync
    2010-09-14 19:17:01 0 d-----w- c:\windows\SHELLNEW
    2010-09-13 20:43:23 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
    2010-09-13 20:40:26 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

    ==================== Find3M ====================

    2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-07-22 15:49:15 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    2010-07-22 05:57:20 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
    2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys

    ============= FINISH: 8:08:55.29 ===============
     
    Last edited: 2010/09/19
  2. 2010/09/19
    Angstromm

    Angstromm Inactive Thread Starter

    Joined:
    2010/09/18
    Messages:
    10
    Likes Received:
    0
    Contents of Attach.txt:


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 11/7/2005 10:54:31 PM
    System Uptime: 9/19/2010 7:41:24 AM (1 hours ago)

    Motherboard: Acer, Inc. | | Ferrari IV
    Processor: AMD Turion(tm) 64 Mobile Technology ML-37 | Socket 754 | 1989/400mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 93 GiB total, 71.419 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP87: 9/17/2010 2:12:25 PM - Installed Norton Ghost 10.0
    RP88: 9/17/2010 2:37:18 PM - Installed Microsoft .NET Framework 1.1
    RP89: 9/17/2010 4:35:56 PM - Software Distribution Service 3.0
    RP90: 9/17/2010 4:50:28 PM - Software Distribution Service 3.0
    RP91: 9/18/2010 1:16:53 PM - Installed Windows Internet Explorer 8.
    RP92: 9/18/2010 1:17:44 PM - Software Distribution Service 3.0
    RP93: 9/18/2010 1:31:19 PM - Software Distribution Service 3.0
    RP94: 9/18/2010 7:17:32 PM - Restore Operation
    RP95: 9/18/2010 7:32:12 PM - Restore Operation
    RP96: 9/18/2010 10:51:21 PM - Printer Driver Microsoft Office Document Image Writer Installed

    ==== Installed Programs ======================

    7-Zip 4.65
    Acer eManager for Notebook
    Acer GridVista
    Ad-Aware
    Adobe Acrobat 9 Pro - English, Français, Deutsch
    Adobe AIR
    Adobe Anchor Service CS4
    Adobe Bridge CS4
    Adobe CMaps CS4
    Adobe Color - Photoshop Specific CS4
    Adobe Color EU Extra Settings CS4
    Adobe Color JA Extra Settings CS4
    Adobe Color NA Recommended Settings CS4
    Adobe Color Video Profiles CS CS4
    Adobe CSI CS4
    Adobe Default Language CS4
    Adobe Device Central CS4
    Adobe Drive CS4
    Adobe ExtendScript Toolkit CS4
    Adobe Extension Manager CS4
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Linguistics CS4
    Adobe Media Player
    Adobe Output Module
    Adobe PDF Library Files CS4
    Adobe Photoshop CS4
    Adobe Photoshop CS4 Support
    Adobe Reader 9.3.4
    Adobe Search for Help
    Adobe Service Manager Extension
    Adobe Setup
    Adobe Type Support CS4
    Adobe Update Manager CS4
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS4
    AdobeColorCommonSetCMYK
    AdobeColorCommonSetRGB
    Agere Systems AC'97 Modem
    Athlon 64 Processor Driver
    ATI - Software Uninstall Utility
    ATI Control Panel
    ATI Display Driver
    AVG Free 9.0
    Broadcom 802.11 Network Adapter
    Business Contact Manager for Outlook 2003
    CCleaner
    Connect
    High-Definition Video Playback 10
    HighMAT Extension to Microsoft Windows XP CD Writing Wizard
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB915800-v4)
    Hotfix for Windows XP (KB942288-v3)
    Hotfix for Windows XP (KB954550-v5)
    IrfanView (remove only)
    kuler
    Launch Manager
    LiveReg (Symantec Corporation)
    LiveUpdate 2.6 (Symantec Corporation)
    Malwarebytes' Anti-Malware
    Metric Converter
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft English TTS Engine
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
    Microsoft Office Access database engine 2007 (English)
    Microsoft Office Small Business Edition 2003
    Microsoft Streets & Trips 2009
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Mozilla Firefox (3.6.10)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Nero 10 ClipartPack
    Nero 10 Menu TemplatePack 1
    Nero 10 Menu TemplatePack 2
    Nero 10 Menu TemplatePack 3
    Nero 10 Menu TemplatePack Basic
    Nero 10 Movie ThemePack 1
    Nero 10 Movie ThemePack 2
    Nero 10 Movie ThemePack Basic
    Nero 10 Sample ImagePack
    Nero 10 Sample Videos
    Nero BackItUp 10
    Nero BackItUp 10 Help (CHM)
    Nero Burning ROM 10
    Nero BurningROM 10 Help (CHM)
    Nero BurnRights 10
    Nero BurnRights 10 Help (CHM)
    Nero Control Center 10
    Nero ControlCenter 10 Help (CHM)
    Nero Core Components 10
    Nero CoverDesigner 10
    Nero CoverDesigner 10 Help (CHM)
    Nero DiscSpeed 10
    Nero DiscSpeed 10 Help (CHM)
    Nero Dolby Files 10
    Nero Express 10
    Nero Express 10 Help (CHM)
    Nero InfoTool 10
    Nero InfoTool 10 Help (CHM)
    Nero MediaHub 10
    Nero MediaHub 10 Help (CHM)
    Nero Multimedia Suite 10
    Nero Recode 10
    Nero Recode 10 Help (CHM)
    Nero RescueAgent 10
    Nero RescueAgent 10 Help (CHM)
    Nero SoundTrax 10
    Nero SoundTrax 10 Help (CHM)
    Nero StartSmart 10
    Nero StartSmart 10 Help (CHM)
    Nero Update
    Nero Vision 10
    Nero Vision 10 Help (CHM)
    Nero WaveEditor 10
    Nero WaveEditor 10 Help (CHM)
    Norton Ghost 10.0
    PDF Settings CS4
    Photoshop Camera Raw
    Realtek AC'97 Audio
    SAPI Wrapper
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB951376-v2)
    Snapshot (remove only)
    Suite Shared Configuration CS4
    Synaptics Pointing Device Driver
    Texas Instruments PCIxx21/x515 drivers.
    TIxx21
    TTS Wrapper
    Tweak UI
    Uninstall Startup Inspector
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB982664)
    Update for Windows XP (KB2141007)
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VLC media player 1.1.2
    WebFldrs XP
    WIDCOMM Bluetooth Software
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage v1.3.0254.0
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 8
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    WordWeb Pro
    Xmarks for IE

    ==== Event Viewer Messages From Past Week ========

    9/16/2010 1:39:41 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework, Version 2.0 (KB928365).
    9/15/2010 9:44:50 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Search service to connect.
    9/15/2010 9:44:50 AM, error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    9/15/2010 9:44:50 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    9/15/2010 7:27:21 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
    9/15/2010 7:27:21 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\Jim\LOCALS~1\Temp\RarSFX0\redist.dll. Reference error message: The operation completed successfully. .
    9/15/2010 7:27:21 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
    9/15/2010 10:00:58 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 2.0 Service Pack 2 Update for Windows Server 2003 and Windows XP x86 (KB976569).
    9/14/2010 12:08:54 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 2 time(s).
    9/14/2010 12:08:21 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 1.1 SP1 Security Update for Windows 2000 and Windows XP (KB979906).
    9/14/2010 12:06:15 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0 SP2 Update for Windows Server 2003 and Windows XP x86 (KB982524).
    9/14/2010 12:06:04 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s).

    ==== End Of File ===========================
     

  3. to hide this advert.

  4. 2010/09/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Firefox doesn't use ActiveX.

    Have you/are you using anything else than Ghost from Symantec/Norton?
     
  5. 2010/09/19
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
  6. 2010/09/19
    Angstromm

    Angstromm Inactive Thread Starter

    Joined:
    2010/09/18
    Messages:
    10
    Likes Received:
    0
    OK, fixed the sucker! Found a fix on a DEP msdn forum. Here's the link.

    And here's the fix:

    The solution to the problem is to uncheck the security feature "Enable memory protection to help mitigate online attacks" and then no problems occur.

    Local Administrators can control DEP/NX by running Internet Explorer as an Administrator and unchecking the Tools > Internet Options > Advanced > Security (scroll toward the bottom) and uncheck “Enable memory protection to help mitigate online attacks” option. "
    For details see http://blogs.msdn.com/ie/archive/200...rotection.aspx

    So, there you have it! Again, thanks for such speedy responses!
     
    Last edited: 2010/09/19
  7. 2010/09/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Thanks for posting back :)
     
  8. 2010/09/19
    Angstromm

    Angstromm Inactive Thread Starter

    Joined:
    2010/09/18
    Messages:
    10
    Likes Received:
    0
    You betcha! Tried all kinds of ineffectual "fixes," full of labyrinthine directions, and from all the subsequent posts, looked like these well-intentioned suggestions weren't working for folks. So when I found this simple and, thank goodness, viable fix I absolutely had to post it here.

    And yeah, Firefox doesn't support ActiveX. Thanks for the tip!
     
  9. 2010/09/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Thankfully :)
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.