1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Checkup please for a friend

Discussion in 'Malware and Virus Removal Archive' started by wildfire, 2009/09/03.

Thread Status:
Not open for further replies.
  1. 2009/09/03
    wildfire

    wildfire Getting Old Thread Starter

    Joined:
    2008/04/21
    Messages:
    4,649
    Likes Received:
    124
    [Inactive] Checkup please for a friend

    Logs attached,

    Some weird things happening and your input much appreciated.

    Tkx, Paddy

    DDS.TXT---------------


    DDS (Ver_09-07-30.01) - NTFSx86
    Run by Tom at 16:50:09.28 on 03/09/2009
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_11
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.495.84 [GMT 1:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Kontiki\KService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\Postoffice\bin\sprtsvc.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Supportsoft\bin\tgsrvc.exe
    C:\Program Files\RealVNC\VNC4\winvnc4.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\WINDOWS\FixCamera.exe
    C:\WINDOWS\tsnp2std.exe
    C:\WINDOWS\vsnp2std.exe
    C:\Program Files\Kontiki\KHost.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Live\Toolbar\wltuser.exe
    C:\Documents and Settings\Tom\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uSearch Page = hxxp://www.google.com
    uDefault_Search_URL = hxxp://www.google.com/ie
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearch Bar = hxxp://www.google.com/ie
    uInternet Settings,ProxyServer = http=localhost:1030
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: H - No File
    uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: ShoppingReport: {100eb1fd-d03e-47fd-81f3-ee91287f9465} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows live\family safety\fssbho.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
    BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: Freeserve: {8b68564d-53fd-4293-b80c-993a9f3988ee} - c:\progra~1\freese~1\fsbar\FSBar.dll
    TB: ONSPEED: {8b79ee88-e62d-4aa8-b530-cc357ba112b7} - c:\program files\onspeed\TOOLBAND.DLL
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
    TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
    TB: {4E7BD74F-2B8D-469E-84BA-B830E8D4E122} - No File
    TB: {4E7BD74F-2B8D-469E-A1FB-F862B587B57D} - No File
    TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
    TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    EB: ShopperReports: {a7cddcdc-beeb-4685-a062-978f5e07ceee} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
    uRun: [EPSON Stylus C62 Series] c:\windows\system32\spool\drivers\w32x86\3\e_s10ic2.exe /a "c:\windows\system32\E_S13.tmp "
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [kdx] c:\program files\kontiki\KHost.exe -all
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.0\apps\apdproxy.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [fssui] "c:\program files\windows live\family safety\fsui.exe" -autorun
    mRun: [UKPostoffice] "c:\program files\postoffice\\bin\sprtcmd.exe" /P UKPostoffice
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [FixCamera] c:\windows\FixCamera.exe
    mRun: [tsnp2std] c:\windows\tsnp2std.exe
    mRun: [snp2std] c:\windows\vsnp2std.exe
    mRunServices: [RegisterDropHandler] c:\progra~1\textbr~2.0\bin\REGIST~1.EXE
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: Search with Freeserve - c:\progra~1\freese~1\fsbar\FSBar.dll/VSearch.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
    IE: {C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
    DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130678954156
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37971.5133912037
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
    DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath -
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

    ============= SERVICES / DRIVERS ===============

    R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2003-12-17 4064]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-20 335240]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-20 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-20 108552]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-20 908056]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-20 297752]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2008-12-19 54752]
    R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
    R2 sprtsvc_UKPostoffice;SupportSoft Sprocket Service (UKPostoffice);c:\program files\postoffice\bin\sprtsvc.exe [2008-1-24 202280]
    R2 tgsrvc_ukpostoffice;SupportSoft Repair Service (UKPostoffice);c:\program files\common files\supportsoft\bin\tgsrvc.exe [2007-8-2 148768]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
    S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-9-19 33752]
    S3 HSFHWCD2;HSFHWCD2;c:\windows\system32\drivers\HSFHWCD2.sys [2005-12-4 201728]
    S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-1-13 40840]
    S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-1-13 66952]
    S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-1-13 81288]
    S3 MR97310_VGA_DUAL_CAMERA;Dual-Mode Digital Camera;c:\windows\system32\drivers\MR97310v.sys [2005-3-7 116126]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-1-13 356920]
    S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-1-13 1079176]
    S3 w200bus;Sony Ericsson W200 driver (WDM);c:\windows\system32\drivers\w200bus.sys [2008-8-10 61504]
    S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;c:\windows\system32\drivers\w200mdfl.sys [2008-8-10 9328]
    S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;c:\windows\system32\drivers\w200mdm.sys [2008-8-10 97056]
    S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w200mgmt.sys [2008-8-10 88560]
    S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;c:\windows\system32\drivers\w200obex.sys [2008-8-10 86368]

    =============== Created Last 30 ================

    2009-08-27 20:33 349,472 a------- c:\windows\WindowsXP-KB822603-x86.exe
    2009-08-27 20:33 344,064 a------- c:\windows\vsnp2std.exe
    2009-08-27 20:33 270,336 a------- c:\windows\tsnp2std.exe
    2009-08-27 20:33 15,497 a------- c:\windows\snp2std.ini
    2009-08-27 20:33 13,022 a------- c:\windows\snp2std.src
    2009-08-27 20:33 25,472 a------- c:\windows\system32\drivers\sncamd.sys
    2009-08-27 20:33 12,178,688 a------- c:\windows\system32\drivers\snp2sxp.sys
    2009-08-27 20:33 151,552 a------- c:\windows\system32\rsnp2std.dll
    2009-08-27 20:33 77,824 a------- c:\windows\system32\csnp2std.dll
    2009-08-27 20:33 73,728 a------- c:\windows\system32\vsnp2std.dll
    2009-08-27 20:33 <DIR> --d----- c:\program files\common files\snp2std
    2009-08-27 15:28 94,208 a------- c:\windows\amcap.exe
    2009-08-27 15:28 20,480 a------- c:\windows\FixCamera.exe
    2009-08-13 15:31 <DIR> --d----- c:\documents and settings\tom\report
    2009-08-13 14:06 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx
    2009-08-13 14:04 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll
    2009-08-12 15:55 <DIR> --d----- C:\spoolerlogs
    2009-08-06 14:46 <DIR> --d----- c:\documents and settings\tom\cs
    2009-08-05 10:01 204,800 -c------ c:\windows\system32\dllcache\mswebdvd.dll

    ==================== Find3M ====================

    2009-08-23 12:38 11,952 a------- c:\windows\system32\avgrsstx.dll
    2009-08-23 12:38 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
    2009-08-05 22:48 54,752 a------- c:\windows\system32\drivers\fssfltr_tdi.sys
    2009-08-05 10:01 204,800 a------- c:\windows\system32\mswebdvd.dll
    2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll
    2009-07-17 20:01 58,880 a------- c:\windows\system32\atl.dll
    2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
    2009-07-10 12:15 306,544 a------- c:\windows\WLXPGSS.SCR
    2009-07-03 18:09 915,456 a------- c:\windows\system32\wininet.dll
    2009-06-16 15:36 119,808 a------- c:\windows\system32\t2embed.dll
    2009-06-16 15:36 81,920 a------- c:\windows\system32\fontsub.dll
    2009-06-12 13:31 80,896 a------- c:\windows\system32\tlntsess.exe
    2009-06-12 13:31 76,288 a------- c:\windows\system32\telnet.exe
    2009-06-10 15:13 84,992 a------- c:\windows\system32\avifil32.dll
    2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
    2009-06-10 07:14 132,096 a------- c:\windows\system32\wkssvc.dll
    2004-11-15 15:29 52,800 a------- c:\docume~1\tom\applic~1\GDIPFONTCACHEV1.DAT
    2003-07-15 15:33 225,280 a------- c:\windows\inf\i386\rtscan.dll
    2002-10-09 10:11 61,440 a------- c:\windows\inf\i386\onetUSD.dll
    2002-08-23 15:06 13,824 a------- c:\windows\inf\i386\Usbscan.sys
    2002-08-23 14:59 40,960 a------- c:\windows\inf\i386\CopyInf.exe
    2002-07-09 09:23 36,864 a------- c:\windows\inf\i386\Vizmicro.dll
    2002-05-20 09:20 172,032 a------- c:\windows\inf\i386\viceo.dll
    2008-09-23 14:21 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008092320080924\index.dat

    ============= FINISH: 16:51:15.56 ===============

    Attach.txt-----


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-07-30.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 16/12/2003 18:33:38
    System Uptime: 09/03/2009 15:16:32 (4273 hours ago)

    Motherboard: Gigabyte Technology Co., Ltd. | | 7VKMP
    Processor: AMD Duron(tm) Processor | Socket-A | 1212/100mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 149 GiB total, 126.268 GiB free.
    E: is CDROM ()
    F: is Removable
    G: is Removable
    H: is Removable
    I: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
    Description: Dual-Mode Digital Camera
    Device ID: ROOT\IMAGE\0001
    Manufacturer: AIPTEK
    Name: Dual-Mode Digital Camera
    PNP Device ID: ROOT\IMAGE\0001
    Service: MR97310_VGA_DUAL_CAMERA

    ==== System Restore Points ===================

    RP912: 20/07/2009 14:22:43 - System Checkpoint
    RP913: 22/07/2009 12:57:33 - Software Distribution Service 3.0
    RP914: 28/07/2009 19:59:28 - Software Distribution Service 3.0
    RP915: 30/07/2009 21:34:17 - Software Distribution Service 3.0
    RP916: 01/08/2009 12:22:35 - System Checkpoint
    RP917: 04/08/2009 16:34:28 - System Checkpoint
    RP918: 07/08/2009 10:29:30 - System Checkpoint
    RP919: 08/08/2009 15:15:04 - System Checkpoint
    RP920: 09/08/2009 16:05:31 - System Checkpoint
    RP921: 12/08/2009 12:10:45 - System Checkpoint
    RP922: 13/08/2009 21:23:33 - Software Distribution Service 3.0
    RP923: 16/08/2009 12:51:55 - System Checkpoint
    RP924: 18/08/2009 15:54:14 - Software Distribution Service 3.0
    RP925: 20/08/2009 16:47:33 - System Checkpoint
    RP926: 21/08/2009 16:56:20 - System Checkpoint
    RP927: 22/08/2009 18:01:59 - System Checkpoint
    RP928: 23/08/2009 12:37:29 - Avg8 Update
    RP929: 23/08/2009 12:39:42 - Avg8 Update
    RP930: 25/08/2009 14:30:58 - System Checkpoint
    RP931: 26/08/2009 11:56:51 - Software Distribution Service 3.0
    RP932: 27/08/2009 15:28:07 - Installed USB20 PC Camera-268
    RP933: 27/08/2009 15:51:07 - Installed USB20 PC Camera-268
    RP934: 27/08/2009 16:04:30 - Installed USB20 PC Camera-268
    RP935: 27/08/2009 16:27:10 - Installed USB20 PC Camera-268
    RP936: 27/08/2009 16:40:08 - Installed USB20 PC Camera-268
    RP937: 27/08/2009 20:26:47 - Removed USB20 PC Camera-268
    RP938: 27/08/2009 20:33:45 - Installed USB20 PC Camera-268
    RP939: 27/08/2009 20:43:49 - Unsigned driver install
    RP940: 29/08/2009 17:31:50 - Installed DirectX
    RP941: 31/08/2009 08:54:07 - System Checkpoint
    RP942: 01/09/2009 16:24:59 - Unsigned driver install
    RP943: 03/09/2009 16:07:40 - System Checkpoint

    ==== Installed Programs ======================


    ACDSee for PENTAX 2.0
    Adobe Acrobat 5.0
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Flash Player 10 ActiveX
    Adobe Help Center 2.0
    Adobe Photoshop 7.0
    Adobe Photoshop CS2
    Adobe Photoshop Elements 4.0
    Adobe Reader 7.1.0
    Adobe Stock Photos 1.0
    Adobe Type Manager 4.0
    Adobe® Photoshop® Album Starter Edition 3.0
    Ahead InCD EasyWrite Reader
    Ahead NeroMediaPlayer
    AVG Free 8.5
    BBC iPlayer Download Manager
    Children's Encyclopedia
    Critical Update for Windows Media Player 11 (KB959772)
    Data Access Objects (DAO) 3.5
    DECAdry Express Business Cards 3.0
    Digital Camera Plus Manager
    Disc2Phone
    EPSON PhotoQuicker3.2
    EPSON Printer Software
    Explorers & Innovators
    Family Tree
    getPlus(R) for Adobe
    Google Toolbar for Internet Explorer
    HighMAT Extension to Microsoft Windows XP CD Writing Wizard
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB954708)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    IBM ViaVoice TTS Runtime v5.0 - US English
    Jasc Digital Camera Support v5.0
    Java(TM) 6 Update 11
    Java(TM) 6 Update 7
    Junk Mail filter update
    KODAK Picture CD Volume 2 Issue 3-International English
    Lexibook SyncMan English Help Files
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Data Access Components KB870669
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Live Add-in 1.3
    Microsoft Office XP Professional with FrontPage
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Web Publishing Wizard 1.52
    Microsoft Word Viewer 97
    Mozilla Firefox (2.0.0.20)
    MSVCRT
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    My DSC
    Nero - Burning Rom
    OmniPage SE
    Paint Shop Pro 7
    PaperPort 8.0 SE
    Photodex Presenter
    Picasa 3
    Post Office Broadband Assistant
    Post Office Broadband Support Controls
    QuickTime
    RealPlayer
    RichFX Player
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973869)
    Segoe UI
    ShopperReports
    Sony Ericsson PC Suite
    Spinner Plus
    Spyware Doctor 6.0
    TextBridge Pro 9.0
    UFD Utility
    Ulead Photo Express 3.0 SE
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB973815)
    USB20 PC Camera-268
    VideoLive Mail 4.0
    VNC Free Edition 4.1.2
    WebFldrs XP
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage v1.3.0254.0
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    Xerox One Touch

    ==== Event Viewer Messages From Past Week ========

    28/08/2009 11:50:45, error: Dhcp [1002] - The IP address lease 192.168.0.2 for the Network Card with network address 000D611B7779 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
    27/08/2009 15:35:50, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
    27/08/2009 15:35:50, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/08/2009 13:46:56, error: Service Control Manager [7022] - The KService service hung on starting.

    ==== End Of File ===========================

    Any assistance offered will be greatly appreciated.
     
  2. 2009/09/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    What the weird things are?

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Terminate memory threats before quarantining.

    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.

    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    RESTART COMPUTER

    STEP 4. Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     

  3. to hide this advert.

  4. 2009/09/05
    wildfire

    wildfire Getting Old Thread Starter

    Joined:
    2008/04/21
    Messages:
    4,649
    Likes Received:
    124
    Broni, thanks for looking in. My friend has created the username of victoriaxxxx

    Hopefully they'll respond and they do know that I'm keeping an eye on this thread. victoria is a beginner so be easy ;)

    The wierd things are 1) A new webcam with built in mike. The camera works but sound doesn't. When starting MS Word (Sorry I don't recall the version) Mouse movement is restricted inside the window. menu bar and task bar is unavailable. Task manager works though so closing MS Word through TM does the job, not an ideal msolution as I'm sure you understand.
     
  5. 2009/09/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No problem.
    Will they continue here, or are they going to start new thread?
     
  6. 2009/09/12
    wildfire

    wildfire Getting Old Thread Starter

    Joined:
    2008/04/21
    Messages:
    4,649
    Likes Received:
    124
    Sorry broni.

    I've no computer right now but visiting victoriaxxx on Monday. I've made/received numerous phone calls and they are struggling. I'll post Monday PM (UK Time) in this thread so would appreciate if you kept it open.
     
  7. 2009/09/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Not a problem :)
     
  8. 2009/09/21
    wildfire

    wildfire Getting Old Thread Starter

    Joined:
    2008/04/21
    Messages:
    4,649
    Likes Received:
    124
    Broni,

    Due to (sensible) posting restrictions in this part of the board I'll advise my friends to start a new thread. Once they do I'll follow up with a link back to this one.

    In the meantime consider this closed and thanks for your assistance and patience.
     
  9. 2009/09/21
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Not a problem :)
     
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.