1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active What is causing my computer to constantly freeze?

Discussion in 'Malware and Virus Removal Archive' started by 601x106, 2009/07/05.

  1. 2009/07/05
    601x106

    601x106 Inactive Thread Starter

    Joined:
    2008/04/22
    Messages:
    12
    Likes Received:
    0
    [Active] What is causing my computer to constantly freeze?

    So my computer constantly freezes every 10-30mins or so. I'm wondering if it's a hardware problem, (Didn't install anything new lately) or if it's a virus. I just use MBAM scanner and here's the log.

    Malwarebytes' Anti-Malware 1.38
    Database version: 2297
    Windows 5.1.2600 Service Pack 2

    7/5/2009 11:21:40 AM
    mbam-log-2009-07-05 (11-21-40).txt

    Scan type: Quick Scan
    Objects scanned: 88583
    Time elapsed: 3 minute(s), 46 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 9
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\autocomplete.cautocomplete (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{2b0378e2-af97-413b-bde9-043094121de3} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{9677d5d8-b782-4800-bc73-16a59fc8d5b7} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{9452efd9-fe71-4678-a595-4751f4224c5d} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9452efd9-fe71-4678-a595-4751f4224c5d} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9452efd9-fe71-4678-a595-4751f4224c5d} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\autocomplete.cautocomplete.1 (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{2b0378e2-af97-413b-bde9-043094121de3} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\AutoComplete.dll (Trojan.BHO) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\AutoComplete.dll (Trojan.BHO) -> Quarantined and deleted successfully.

    Thanks in advance
     
    601x106,
    #1
  2. 2009/07/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Read this post, then post the requested log(s).
     
    broni,
    #2


  3. to hide this advert.

  4. 2009/07/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    BTW, your MBAM version is well outdated. Always update the program before running it.
     
    broni,
    #3
  5. 2009/07/05
    601x106

    601x106 Inactive Thread Starter

    Joined:
    2008/04/22
    Messages:
    12
    Likes Received:
    0
    Oh ok i did the DDS thing.
    Attach.txt:

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-06-26.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 8/2/2008 9:07:45 AM
    System Uptime: 7/5/2009 7:55:29 PM (1 hours ago)

    Motherboard: ASUSTeK Computer INC. | | M2N-SLI DELUXE
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 6000+ | Socket AM2 | 3013/200mhz
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 6000+ | Socket AM2 | 3013/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 233 GiB total, 125.456 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    G: is CDROM (CDFS)
    H: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {36FC9E60-C465-11CF-8056-444553540000}
    Description: Logitech USB Camera (QuickCam S5500)
    Device ID: USB\VID_046D&PID_09A1\178C2720
    Manufacturer: Logitech
    Name: Logitech USB Camera (QuickCam S5500)
    PNP Device ID: USB\VID_046D&PID_09A1\178C2720
    Service: usbccgp

    ==== System Restore Points ===================

    RP171: 4/7/2009 11:03:52 AM - System Checkpoint
    RP172: 4/8/2009 9:03:54 PM - Removed Rappelz_USA
    RP173: 4/9/2009 10:36:54 PM - System Checkpoint
    RP174: 4/10/2009 11:28:15 PM - System Checkpoint
    RP175: 4/12/2009 9:21:20 PM - System Checkpoint
    RP176: 4/13/2009 10:36:54 PM - System Checkpoint
    RP177: 4/14/2009 11:08:53 PM - Software Distribution Service 3.0
    RP178: 4/16/2009 10:20:18 PM - System Checkpoint
    RP179: 4/17/2009 10:50:41 PM - System Checkpoint
    RP180: 4/19/2009 7:52:20 PM - System Checkpoint
    RP181: 4/21/2009 7:03:18 PM - System Checkpoint
    RP182: 4/23/2009 7:42:18 PM - System Checkpoint
    RP183: 4/24/2009 10:53:52 PM - System Checkpoint
    RP184: 4/26/2009 11:08:48 AM - System Checkpoint
    RP185: 4/30/2009 10:33:14 PM - System Checkpoint
    RP186: 5/2/2009 12:44:33 AM - System Checkpoint
    RP187: 5/3/2009 2:00:12 PM - System Checkpoint
    RP188: 5/4/2009 8:16:22 PM - System Checkpoint
    RP189: 5/5/2009 11:25:54 PM - System Checkpoint
    RP190: 5/7/2009 5:05:03 PM - System Checkpoint
    RP191: 5/8/2009 7:21:40 PM - System Checkpoint
    RP192: 5/10/2009 3:18:52 AM - System Checkpoint
    RP193: 5/11/2009 8:59:31 PM - System Checkpoint
    RP194: 5/12/2009 11:07:17 PM - Software Distribution Service 3.0
    RP195: 5/16/2009 8:16:20 PM - System Checkpoint
    RP196: 5/18/2009 9:32:37 PM - System Checkpoint
    RP197: 5/19/2009 10:58:45 PM - System Checkpoint
    RP198: 5/20/2009 6:14:18 PM - Installed Oblivion
    RP199: 5/20/2009 6:24:16 PM - Installed DirectX 9.0
    RP200: 5/20/2009 6:34:17 PM - Installed Oblivion - Knights of the Nine
    RP201: 5/20/2009 6:44:16 PM - Installed Oblivion - Knights of the Nine
    RP202: 5/20/2009 6:54:17 PM - Installed Oblivion - Knights of the Nine
    RP203: 5/23/2009 11:19:52 PM - System Checkpoint
    RP204: 5/25/2009 12:12:00 AM - System Checkpoint
    RP205: 5/26/2009 7:50:21 PM - System Checkpoint
    RP206: 5/27/2009 11:01:03 PM - System Checkpoint
    RP207: 5/28/2009 11:46:50 PM - System Checkpoint
    RP208: 5/31/2009 12:13:36 PM - System Checkpoint
    RP209: 6/1/2009 8:19:05 PM - System Checkpoint
    RP210: 6/3/2009 7:09:46 PM - System Checkpoint
    RP211: 6/4/2009 11:06:16 PM - System Checkpoint
    RP212: 6/6/2009 7:34:46 AM - System Checkpoint
    RP213: 6/7/2009 7:42:35 AM - System Checkpoint
    RP214: 6/8/2009 7:53:23 AM - System Checkpoint
    RP215: 6/9/2009 10:10:03 AM - System Checkpoint
    RP216: 6/10/2009 12:22:25 AM - Software Distribution Service 3.0
    RP217: 6/11/2009 10:57:37 AM - System Checkpoint
    RP218: 6/17/2009 4:08:02 PM - System Checkpoint
    RP219: 6/19/2009 12:53:03 PM - System Checkpoint
    RP220: 6/22/2009 12:06:57 AM - System Checkpoint
    RP221: 6/23/2009 8:12:42 PM - System Checkpoint
    RP222: 6/24/2009 10:21:17 PM - System Checkpoint
    RP223: 6/26/2009 11:16:59 AM - System Checkpoint
    RP224: 6/27/2009 8:29:35 PM - System Checkpoint
    RP225: 6/28/2009 8:46:00 PM - System Checkpoint
    RP226: 6/30/2009 12:18:59 AM - System Checkpoint
    RP227: 7/1/2009 12:51:11 PM - System Checkpoint
    RP228: 7/2/2009 1:31:56 PM - System Checkpoint
    RP229: 7/4/2009 1:13:51 PM - Restore Operation
    RP230: 7/4/2009 4:03:54 PM - Restore Operation
    RP231: 7/4/2009 4:09:43 PM - Removed Battlefield 2(TM)
    RP232: 7/4/2009 4:10:21 PM - Removed Call of Duty(R) - World at War(TM)
    RP233: 7/4/2009 5:55:44 PM - Installed Windows XP KB916089.
    RP234: 7/4/2009 5:59:10 PM - Logitech Webcam Software v12.0.1278
    RP235: 7/4/2009 7:14:28 PM - Software Distribution Service 3.0
    RP236: 7/4/2009 11:56:41 PM - Logitech Webcam Software v12.0.1278

    ==== Installed Programs ======================

    µTorrent
    Acrobat.com
    Adobe AIR
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe ExtendScript Toolkit 2
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Linguistics CS3
    Adobe PDF Library Files
    Adobe Photoshop CS3
    Adobe Reader 9
    Adobe Setup
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS3
    AIM 6
    AIM MusicLink 2.2.0.0
    Apple Mobile Device Support
    Apple Software Update
    AviSynth 2.5
    BitTornado 0.3.17
    ConvertXtoDVD 2.2.2.256
    Dual-Core Optimizer
    EO Video 1.36
    ESET NOD32 Antivirus
    Google Toolbar for Internet Explorer
    High Definition Audio Driver Package - KB888111
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB916089)
    Hotfix for Windows XP (KB952287)
    ijji FireFox Launcher 1.0
    ImgBurn
    iTunes
    Java(TM) 6 Update 3
    Java(TM) 6 Update 7
    JMB36X Raid Configurer
    LibUSB-Win32-0.1.12.1
    Linksys Updater
    Logitech Desktop Messenger
    Logitech QuickCam Driver Package
    Logitech Updater
    Malwarebytes' Anti-Malware
    Marsu-Fix
    Microsoft .NET Framework 2.0
    Microsoft .NET Framework 3.0
    Microsoft Application Error Reporting
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft IntelliPoint 6.3
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Software Update for Web Folders (English) 12
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 Redistributable
    MSXML 6 Service Pack 2 (KB954459)
    NVIDIA Drivers
    NVIDIA ForceWare Network Access Manager
    NVIDIA PhysX v8.10.17
    Oblivion
    Panda ActiveScan 2.0
    PDF Settings
    PeerGuardian 2.0
    QuickTime
    RealPlayer
    Security Update for Windows Internet Explorer 7 (KB938127-v2)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB944338-v2)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB970238)
    SoundMAX
    Spybot - Search & Destroy
    Update for Windows XP (KB898461)
    Update for Windows XP (KB904942)
    Update for Windows XP (KB925720)
    Update for Windows XP (KB932823-v3)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Ventrilo Client
    VideoLAN VLC media player 0.8.6h
    Videora iPod touch Converter 4.02
    Viewpoint Media Player
    WebFldrs XP
    Winamp
    Windows Communication Foundation
    Windows Imaging Component
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Media Format Runtime
    Windows Presentation Foundation
    Windows Workflow Foundation
    Windows XP Service Pack 2
    WinRAR archiver
    XML Paper Specification Shared Components Pack 1.0

    ==== Event Viewer Messages From Past Week ========

    7/5/2009 2:08:00 AM, error: Cdrom [11] - The driver detected a controller error on \Device\CdRom2.
    7/5/2009 2:07:34 AM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk0\D.
    7/5/2009 2:07:18 AM, error: Cdrom [11] - The driver detected a controller error on \Device\CdRom0.
    7/4/2009 4:11:22 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
    7/4/2009 4:02:18 PM, error: DCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {BC866CF2-5486-41F7-B46B-9AA49CF3EBB1} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.
    7/4/2009 11:56:21 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
    7/4/2009 11:56:21 PM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\Admin\LOCALS~1\Temp\AIM_69~1.1\imappver.dll. Reference error message: The operation completed successfully. .
    7/4/2009 11:56:21 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
    7/1/2009 2:23:57 PM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).
    7/1/2009 2:23:57 PM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s).

    ==== End Of File ===========================
     
    Last edited: 2009/07/05
    601x106,
    #4
  6. 2009/07/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    This is only half of DDS log.
     
    broni,
    #5
  7. 2009/07/05
    601x106

    601x106 Inactive Thread Starter

    Joined:
    2008/04/22
    Messages:
    12
    Likes Received:
    0
    DDS.txt:

    DDS (Ver_09-06-26.01) - NTFSx86
    Run by Admin at 20:08:17.95 on Sun 07/05/2009
    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_07
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.3582.2957 [GMT -7:00]

    AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\WINDOWS\system32\java.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Admin\Application Data\U3\0000162673752477\LaunchPad.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\Documents and Settings\Admin\Desktop\dban-1.0.7_i386.exe
    C:\Documents and Settings\Admin\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com
    uDefault_Page_URL = hxxp://www.google.com
    mDefault_Page_URL = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
    TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
    uRun: [Aim6]
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
    mRun: [JMB36X IDE Setup] c:\windows\jm\JMInsIDE.exe
    mRun: [36X Raid Configurer] c:\windows\system32\JMRaidSetup.exe boot
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [nwiz] nwiz.exe /install
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
    mRun: [amd_dc_opt] c:\program files\amd\dual-core optimizer\amd_dc_opt.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [w3dr.exe] c:\program files\warcraft iii\w3dr.exe
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe "
    mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe "
    mRun: [WinampAgent] "c:\program files\winamp\winampa.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    LSP: %SYSTEMROOT%\system32\nvappfilter.dll
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll

    ============= SERVICES / DRIVERS ===============

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-7-5 28544]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-3-13 33800]
    R2 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2008-3-13 472320]
    R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-1-15 204800]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-8-2 24652]
    R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [2009-3-24 28672]
    S3 FAELZZZ;FAELZZZ;\??\c:\documents and settings\admin\desktop\ryugj_engine\ggggg\ggggg.sys --> c:\documents and settings\admin\desktop\ryugj_engine\ggggg\ggggg.sys [?]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

    =============== Created Last 30 ================

    2009-07-05 11:17 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-05 11:17 19,096 a------- c:\windows\system32\drivers\mbam.sys
    2009-07-05 10:27 28,544 a------- c:\windows\system32\drivers\pavboot.sys
    2009-07-05 10:26 <DIR> --d----- c:\program files\Panda Security
    2009-07-04 16:05 <DIR> --d----- c:\windows\system32\wbem\Repository
    2009-07-04 13:42 <DIR> --d----- c:\docume~1\admin\applic~1\Malwarebytes
    2009-07-04 13:42 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2009-07-04 13:42 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
    2009-06-22 08:25 <DIR> --d----- c:\program files\Perfect World Entertainment
    2009-06-18 17:08 <DIR> --d----- c:\windows\system32\LogFiles
    2009-06-11 13:17 <DIR> --d----- c:\program files\Subagames
    2009-06-11 12:48 <DIR> --d----- c:\program files\Pando Networks

    ==================== Find3M ====================

    2009-07-04 23:39 0 a------- c:\windows\system32\drivers\lvuvc.hs
    2009-07-04 23:39 0 a------- c:\windows\system32\drivers\logiflt.iad
    2009-05-07 08:44 344,064 a------- c:\windows\system32\localspl.dll
    2009-04-28 21:56 827,392 a------- c:\windows\system32\wininet.dll
    2009-04-28 21:55 78,336 a------- c:\windows\system32\ieencode.dll
    2009-04-17 02:58 1,846,656 a------- c:\windows\system32\win32k.sys
    2009-04-15 08:11 584,192 a------- c:\windows\system32\rpcrt4.dll
    2009-04-15 08:11 584,192 a------- c:\windows\system32\rpcrt4(2).dll
    2008-08-10 21:33 87,608 a------- c:\docume~1\admin\applic~1\inst.exe
    2008-08-10 21:33 47,360 a------- c:\docume~1\admin\applic~1\pcouffin.sys

    ============= FINISH: 20:08:35.81 ===============
     
    601x106,
    #6
  8. 2009/07/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.
     
    broni,
    #7

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...