1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active XP now reboots every nite about 2 am

Discussion in 'Malware and Virus Removal Archive' started by pilotgal8, 2009/12/12.

  1. 2009/12/12
    pilotgal8 Lifetime Subscription

    pilotgal8 Well-Known Member Thread Starter

    Joined:
    2002/01/07
    Messages:
    459
    Likes Received:
    0
    [Active] XP now reboots every nite about 2 am

    DDS (Ver_09-07-30.01) - NTFSx86
    Run by Rosemary at 17:12:01.82 on Sat 12/12/2009
    Internet Explorer: 6.0.2900.5512
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2045.1021 [GMT -5:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    AV: iolo System Shield *On-access scanning enabled* (Updated) {2565CEEE-6BDB-4A6D-AD6D-F682F2695014}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    svchost.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
    C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
    C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe
    C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe
    C:\WINDOWS\system32\rsvp.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\AVG\AVG9\avgtray.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\WINDOWS\System32\vssvc.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\Rosemary\Desktop\dds.pif

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.goodsearch.com/
    uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
    uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    mDefault_Page_URL = hxxp://www.yahoo.com/
    mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
    mStart Page = hxxp://www.yahoo.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uInternet Connection Wizard,ShellNext = iexplore
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
    uRun: [PxDotNetLoader] "c:\program files\fidelity investments\fidelity active trader\system\ATPStartupAssistant.exe "
    uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
    uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
    mRun: [ehTray] c:\windows\ehome\ehtray.exe
    mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe "
    mRun: [IntelAudioStudio] "c:\program files\intel audio studio\IntelAudioStudio.exe" TRAY
    mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe "
    mRun: [CCUTRAYICON] c:\program files\intel\inteldh\ccu\CCU_TrayIcon.exe
    mRun: [NMSSupport] "c:\program files\common files\intel\inteldh\nms\support\IntelHCTAgent.exe" /startup
    mRun: [<NO NAME>]
    mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
    mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
    mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe "
    mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRunServices: [ZipMagic] c:\program files\ontrack\zipmagic\zm32nt.exe
    dRun: [braviax]
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
    IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    LSP: c:\windows\system32\iavlsp.dll
    Trusted Zone: turbotax.com
    DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
    DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
    DPF: {15B782AF-55D8-11D1-B477-006097098764} - hxxp://download.macromedia.com/pub/shockwave/cabs/authorware/awswax70.cab
    DPF: {2703049B-D81D-4763-A3C6-AF8932FCBD8F} - hxxps://am.hrblock.com/ActivexComponent/CheckFileStatus.CAB
    DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} - hxxp://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1182539247843
    DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182539214796
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} - hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
    DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
    Handler: x-atng - {7e8717b0-d862-11d5-8c9e-00010304f989} - c:\program files\fidelity investments\fidelity active trader\system\atngprot.dll
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: avgrsstarter - avgrsstx.dll
    AppInit_DLLs: cru629.dat
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-2 64160]
    R0 zmNTMon;zmNTMon;c:\windows\system32\drivers\ZmNTMon.sys [2007-12-3 5760]
    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-4 333192]
    R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-6-23 28424]
    R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-5-4 360584]
    R2 AMP;AMP;c:\windows\system32\drivers\amp.sys [2009-10-28 122408]
    R2 AMPSE;AMPSE;c:\windows\system32\drivers\ampse.sys [2009-10-28 1117224]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-11-8 285392]
    R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
    R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-3-18 650160]
    R2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-3-18 650160]
    R2 MCLServiceATL;Intel(R) Application Tracker;c:\program files\intel\inteldh\intel media server\shells\MCLServiceATL.exe [2006-11-10 170456]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 vseamps;vseamps;c:\program files\common files\authentium\antivirus5\vseamps.exe [2009-10-28 92712]
    R2 vsedsps;vsedsps;c:\program files\common files\authentium\antivirus5\vsedsps.exe [2009-10-28 117288]
    R2 vseqrts;vseqrts;c:\program files\common files\authentium\antivirus5\vseqrts.exe [2009-10-28 113192]
    R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
    R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1028432]
    S2 ioloProductUpdate;iolo Product Update Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-3-18 650160]
    S3 zmNTZip;zmNTZip;c:\program files\ontrack\zipmagic\zmNTZip.sys [2007-12-3 155576]

    ============== File Associations ===============

    JSEFile=NOTEPAD.EXE %1
    regfile=NOTEPAD.EXE %1
    scrfile=NOTEPAD.EXE %1
    VBEFile=NOTEPAD.EXE %1
    VBSFile=NOTEPAD.EXE %1

    =============== Created Last 30 ================

    2009-12-12 11:52 340 a---h--- C:\aaw7boot.cmd
    2009-12-11 09:14 <DIR> --d----- C:\symbols
    2009-12-10 11:01 <DIR> --d----- c:\program files\Debugging Tools for Windows (x86)
    2009-12-09 04:40 448 a------- c:\windows\system32\iolo.ini
    2009-12-07 06:14 3,255 a------- c:\windows\system32\wbem\Outlook_01ca772e6a2fa02c.mof
    2009-12-05 12:34 <DIR> --d----- c:\program files\common files\Authentium
    2009-12-05 12:34 118,784 a------- c:\windows\system32\iavlsp.dll
    2009-11-26 05:37 <DIR> --d----- c:\program files\MSXML 4.0

    ==================== Find3M ====================

    2009-12-02 11:23 93,096 a------- c:\windows\system32\IncContxMenu.dll
    2009-12-02 11:23 2,118,568 a------- c:\windows\system32\Incinerator.dll
    2009-11-10 08:04 360,584 ac------ c:\windows\system32\drivers\avgtdix.sys
    2009-11-08 09:45 333,192 ac------ c:\windows\system32\drivers\avgldx86.sys
    2009-11-08 09:45 12,464 a------- c:\windows\system32\avgrsstx.dll
    2009-10-29 14:08 3,070,976 -------- c:\windows\system32\dllcache\mshtml.dll
    2009-10-29 00:38 667,136 a------- c:\windows\system32\wininet.dll
    2009-10-29 00:38 667,136 -------- c:\windows\system32\dllcache\wininet.dll
    2009-10-29 00:38 1,509,888 -------- c:\windows\system32\dllcache\shdocvw.dll
    2009-10-29 00:38 627,712 -------- c:\windows\system32\dllcache\urlmon.dll
    2009-10-28 17:25 122,408 a----r-- c:\windows\system32\drivers\amp.sys
    2009-10-28 17:25 1,117,224 a----r-- c:\windows\system32\drivers\ampse.sys
    2009-10-21 00:38 75,776 a------- c:\windows\system32\strmfilt.dll
    2009-10-21 00:38 25,088 a------- c:\windows\system32\httpapi.dll
    2009-10-21 00:38 75,776 -------- c:\windows\system32\dllcache\strmfilt.dll
    2009-10-21 00:38 25,088 -------- c:\windows\system32\dllcache\httpapi.dll
    2009-10-20 11:20 265,728 a------- c:\windows\system32\drivers\http.sys
    2009-10-20 11:20 265,728 a------- c:\windows\system32\dllcache\http.sys
    2009-10-19 13:17 4,732,319 ac------ c:\docume~1\rosemary\applic~1\family.zip
    2009-10-13 05:30 270,336 a------- c:\windows\system32\oakley.dll
    2009-10-13 05:30 270,336 -------- c:\windows\system32\dllcache\oakley.dll
    2009-10-12 08:38 149,504 a------- c:\windows\system32\rastls.dll
    2009-10-12 08:38 149,504 -------- c:\windows\system32\dllcache\rastls.dll
    2009-10-12 08:38 79,872 a------- c:\windows\system32\raschap.dll
    2009-10-12 08:38 79,872 -------- c:\windows\system32\dllcache\raschap.dll
    2009-10-11 04:17 411,368 a------- c:\windows\system32\deploytk.dll
    2009-10-08 14:57 611,328 a------- c:\windows\system32\uiautomationcore.dll
    2009-10-08 14:57 220,160 a------- c:\windows\system32\oleacc.dll
    2009-10-08 14:57 220,160 a------- c:\windows\system32\dllcache\oleacc.dll
    2009-10-08 14:56 20,480 a------- c:\windows\system32\oleaccrc.dll
    2009-10-08 14:56 20,480 a------- c:\windows\system32\dllcache\oleaccrc.dll
    2009-09-25 00:37 81,920 a------- c:\windows\system32\ieencode.dll
    2009-09-24 20:23 2,403,528 a------- C:\AOS 18-20.zip
    2009-09-24 20:22 3,613,622 a------- C:\AOS 16-18.zip
    2009-09-24 20:22 3,810,098 a------- C:\AOS 13 - 15.zip
    2009-09-24 20:21 3,725,959 a------- C:\AOS 10-12.zip
    2009-09-24 20:21 3,991,357 a------- C:\AOS 7-9.zip
    2009-09-24 20:20 3,776,086 a------- C:\AOS 4-6.zip
    2009-09-24 20:20 3,459,310 a------- C:\AOS 1-3.zip
    2009-09-24 07:28 24,779,828 a------- C:\archive.zip
    2009-09-21 10:21 15,688 a------- c:\windows\system32\lsdelete.exe
    2009-01-22 11:38 60,744 ac------ c:\documents and settings\rosemary\g2mdlhlpx.exe
    2007-06-23 17:04 552 ac------ c:\docume~1\rosemary\applic~1\wklnhst.dat

    ============= FINISH: 17:12:53.39 ===============
     
  2. 2009/12/12
    pilotgal8 Lifetime Subscription

    pilotgal8 Well-Known Member Thread Starter

    Joined:
    2002/01/07
    Messages:
    459
    Likes Received:
    0
    Attach.txt


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-07-30.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 6/22/2007 2:13:23 PM
    System Uptime: 12/12/2009 1:15:40 AM (16 hours ago)

    Motherboard: Intel Corporation | | D975XBX
    Processor: Intel(R) Pentium(R) D CPU 3.20GHz | J3E1 | 3200/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 233 GiB total, 178.099 GiB free.
    D: is CDROM ()
    E: is Removable
    F: is Removable
    G: is Removable
    H: is Removable
    J: is Removable

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP880: 9/14/2009 9:23:12 AM - System Checkpoint
    RP881: 9/15/2009 10:47:37 AM - System Checkpoint
    RP882: 9/16/2009 1:01:16 PM - System Checkpoint
    RP883: 9/17/2009 4:54:19 PM - System Checkpoint
    RP884: 9/18/2009 5:35:08 PM - System Checkpoint
    RP885: 9/19/2009 8:56:03 AM - 9-19-09 B4 cleanup
    RP886: 9/20/2009 10:32:47 AM - System Checkpoint
    RP887: 9/21/2009 2:49:29 PM - System Checkpoint
    RP888: 9/22/2009 3:20:35 PM - System Checkpoint
    RP889: 9/23/2009 4:13:05 PM - System Checkpoint
    RP890: 9/24/2009 7:51:21 AM - Removed Adobe Reader 8.1.6
    RP891: 9/24/2009 7:52:42 AM - Installed Adobe Reader 9.1.
    RP892: 9/25/2009 8:10:36 AM - System Checkpoint
    RP893: 9/26/2009 9:29:22 AM - System Checkpoint
    RP894: 9/27/2009 1:00:27 PM - System Checkpoint
    RP895: 9/28/2009 7:37:05 PM - System Checkpoint
    RP896: 9/29/2009 7:58:29 PM - System Checkpoint
    RP897: 9/30/2009 8:33:01 PM - System Checkpoint
    RP898: 10/1/2009 11:10:04 PM - System Checkpoint
    RP899: 10/2/2009 11:41:50 PM - System Checkpoint
    RP900: 10/4/2009 6:26:22 AM - System Checkpoint
    RP901: 10/5/2009 7:55:49 AM - System Checkpoint
    RP902: 10/5/2009 8:14:09 AM - Avg8 Update
    RP903: 10/5/2009 8:14:55 AM - Avg8 Update
    RP904: 10/6/2009 11:04:27 AM - System Checkpoint
    RP905: 10/7/2009 8:45:11 AM - Avg8 Update
    RP906: 10/8/2009 11:36:45 AM - System Checkpoint
    RP907: 10/9/2009 11:54:51 AM - System Checkpoint
    RP908: 10/10/2009 12:27:23 PM - System Checkpoint
    RP909: 10/11/2009 3:45:50 PM - System Checkpoint
    RP910: 10/12/2009 7:33:24 PM - System Checkpoint
    RP911: 10/13/2009 8:00:07 PM - System Checkpoint
    RP912: 10/14/2009 8:18:08 AM - Software Distribution Service 3.0
    RP913: 10/14/2009 8:58:31 AM - Software Distribution Service 3.0
    RP914: 10/14/2009 9:13:53 AM - Installed Java(TM) 6 Update 15
    RP915: 10/15/2009 12:08:50 PM - System Checkpoint
    RP916: 10/16/2009 2:00:14 PM - System Checkpoint
    RP917: 10/17/2009 9:01:46 AM - Avg8 Update
    RP918: 10/18/2009 10:03:47 AM - System Checkpoint
    RP919: 10/19/2009 10:11:01 AM - System Checkpoint
    RP920: 10/20/2009 6:45:13 AM - Software Distribution Service 3.0
    RP921: 10/21/2009 6:56:19 AM - System Checkpoint
    RP922: 10/21/2009 9:01:35 AM - Avg8 Update
    RP923: 10/22/2009 10:43:20 AM - System Checkpoint
    RP924: 10/23/2009 4:11:50 AM - Software Distribution Service 3.0
    RP925: 10/24/2009 6:11:57 AM - System Checkpoint
    RP926: 10/25/2009 8:07:57 AM - System Checkpoint
    RP927: 10/26/2009 9:56:04 AM - System Checkpoint
    RP928: 10/27/2009 10:01:14 AM - System Checkpoint
    RP929: 10/28/2009 12:38:10 PM - System Checkpoint
    RP930: 10/29/2009 6:47:56 AM - Software Distribution Service 3.0
    RP931: 10/30/2009 8:14:36 AM - System Checkpoint
    RP932: 10/31/2009 9:27:44 AM - System Checkpoint
    RP933: 11/1/2009 9:58:29 AM - System Checkpoint
    RP934: 11/2/2009 11:00:31 AM - System Checkpoint
    RP935: 11/3/2009 9:44:39 AM - Avg8 Update
    RP936: 11/4/2009 12:46:15 PM - System Checkpoint
    RP937: 11/5/2009 2:41:28 PM - System Checkpoint
    RP938: 11/6/2009 9:45:02 AM - Avg8 Update
    RP939: 11/7/2009 9:49:49 AM - System Checkpoint
    RP940: 11/7/2009 11:15:47 AM - Software Distribution Service 3.0
    RP941: 11/8/2009 9:45:00 AM - Installed AVG Free 9.0
    RP942: 11/9/2009 11:00:14 AM - System Checkpoint
    RP943: 11/10/2009 8:03:49 AM - Avg8 Update
    RP944: 11/10/2009 8:04:48 AM - Avg8 Update
    RP945: 11/11/2009 6:45:41 AM - Software Distribution Service 3.0
    RP946: 11/12/2009 7:21:50 AM - System Checkpoint
    RP947: 11/12/2009 8:09:48 AM - Avg8 Update
    RP948: 11/13/2009 9:42:36 AM - System Checkpoint
    RP949: 11/14/2009 10:44:53 AM - System Checkpoint
    RP950: 11/15/2009 11:23:26 AM - System Checkpoint
    RP951: 11/16/2009 12:15:58 PM - System Checkpoint
    RP952: 11/17/2009 3:28:53 PM - System Checkpoint
    RP953: 11/18/2009 4:58:00 PM - System Checkpoint
    RP954: 11/19/2009 9:12:28 PM - System Checkpoint
    RP955: 11/20/2009 9:38:03 AM - Avg8 Update
    RP956: 11/20/2009 9:38:47 AM - Avg8 Update
    RP957: 11/21/2009 11:30:08 AM - System Checkpoint
    RP958: 11/22/2009 12:22:43 PM - System Checkpoint
    RP959: 11/23/2009 12:38:12 PM - System Checkpoint
    RP960: 11/24/2009 1:09:51 PM - System Checkpoint
    RP961: 11/25/2009 4:15:38 PM - System Checkpoint
    RP962: 11/26/2009 5:36:02 AM - Software Distribution Service 3.0
    RP963: 11/27/2009 5:49:49 AM - System Checkpoint
    RP964: 11/28/2009 12:33:24 PM - System Checkpoint
    RP965: 11/29/2009 1:52:54 PM - System Checkpoint
    RP966: 11/30/2009 2:41:48 PM - System Checkpoint
    RP967: 12/1/2009 3:31:54 PM - System Checkpoint
    RP968: 12/2/2009 7:00:49 PM - System Checkpoint
    RP969: 12/3/2009 7:03:55 PM - System Checkpoint
    RP970: 12/4/2009 8:15:53 PM - System Checkpoint
    RP971: 12/5/2009 9:09:39 PM - System Checkpoint
    RP972: 12/6/2009 11:25:00 PM - System Checkpoint
    RP973: 12/7/2009 11:32:56 PM - System Checkpoint
    RP974: 12/9/2009 12:20:08 AM - System Checkpoint
    RP975: 12/9/2009 4:31:14 AM - Software Distribution Service 3.0
    RP976: 12/10/2009 5:32:12 AM - System Checkpoint
    RP977: 12/10/2009 7:06:12 AM - Installed Java(TM) 6 Update 17
    RP978: 12/10/2009 11:01:04 AM - Installed Debugging Tools for Windows (x86)
    RP979: 12/10/2009 11:30:38 AM - Installed Debugging Tools for Windows (x86)
    RP980: 12/11/2009 9:10:25 AM - Installed Debugging Tools for Windows
    RP981: 12/12/2009 8:20:52 AM - Avg8 Update
    RP982: 12/12/2009 8:22:34 AM - Avg8 Update

    ==== Installed Programs ======================


    2000 TurboTax for Windows
    7200
    7200_Help
    7200Trb
    Acrobat.com
    Ad-Aware
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Photoshop 7.0
    Adobe Product/Adobe Studio Update 10/2001
    Adobe Reader 8.1.2 Security Update 1 (KB403742)
    Adobe Reader 9.2
    Advanced Analyzer
    AiO_Scan
    AiOSoftware
    AnswerWorks 4.0 Runtime - English
    AnswerWorks 5.0 English Runtime
    ATI Display Driver
    Avery Wizard 3.1
    AVG Free 9.0
    AVSDK5
    Broderbund Media Manager
    BufferChm
    Carbonite
    Compatibility Pack for the 2007 Office system
    Copy
    Coupon Printer for Windows
    CP_AtenaShokunin1Config
    cp_dwShrek2Albums1
    cp_dwShrek2Cards1
    CreativeProjects
    CreativeProjectsTemplates
    Critical Update for Windows Media Player 11 (KB959772)
    CueTour
    Debugging Tools for Windows
    Debugging Tools for Windows (x86)
    Destinations
    Director
    DocProc
    DocumentViewer
    doPDF 5.0 printer
    EasyCleaner
    Fax
    Fidelity Active Trader Pro®
    Google Earth
    Google Updater
    GoToMeeting 4.0.0.320
    High Definition Audio Driver Package - KB888111
    Hotfix for Microsoft .NET Framework 3.0 (KB932471)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB915800-v4)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    HP Extended Capabilities 4.7
    HP Image Zone 4.7
    HP Officejet 7200 series
    HP Product Assistant
    HP Product Detection
    HP PSC & OfficeJet 4.7
    HP Update
    HPSystemDiagnostics
    InstantShare
    Intel Audio Studio 2.0
    Intel(R) Matrix Storage Manager
    Intel(R) PRO Network Connections Drivers
    Intel(R) Quick Resume Technology Drivers
    Intel® Viivâ„¢ Software
    Intuit Entitlement Client
    iolo technologies' System Mechanic Professional
    ItsDeductible Express
    Java 2 Runtime Environment, SE v1.4.1_02
    Java Web Start
    Java(TM) 6 Update 17
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    LaserJet 1020 series
    Macromedia Shockwave Player
    Malwarebytes' Anti-Malware
    MarketResearch
    MediaShow 3.0
    Microsoft .NET Framework 1.0 Hotfix (KB953295)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Digital Image Library 9 - Blocker
    Microsoft Digital Image Standard 2006
    Microsoft Digital Image Standard 2006 Editor
    Microsoft Digital Image Standard 2006 Library
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Office 2003 Primary Interop Assemblies
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft Streets & Trips 2006
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual Studio 2005 Tools for Office Runtime
    Microsoft Web Publishing Wizard 1.52
    Microsoft Works Suite 2006 Setup Launcher
    mIRC
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    MSXML 6.0 Parser (KB933579)
    OIB4 Training Install Kit
    Ontrack ZipMagic 4.0
    OrchidWiz Encyclopedia
    OrderReminder HP LaserJet 1020
    PanoStandAlone
    PCI SoftV92 Modem
    Pdf995
    PhotoGallery
    PowerDVD
    PowerProducer
    PowerStarter
    ProductContext
    ProSeries Basic Edition 2007
    QFolder
    QuickBooks
    QuickBooks Premier: Accountant Edition 2007
    QuickBooks Pro 2009
    Quicken 2007
    QuoteTracker
    Readme
    RegScrubXP 3.25
    SafeCast Shared Components
    Scan
    ScannerCopy
    Security Update for CAPICOM (KB931906)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Search 4 - KB963093
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974455)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB976325)
    Shockwave
    SigmaTel Audio
    SkinsHP1
    Spelling Dictionaries Support For Adobe Reader 8
    Spybot - Search & Destroy
    SpywareBlaster 4.1
    SupportSoft Assisted Service
    TaxCut Premium + State + Efile 2008
    Text Twist 2 (remove only)
    The Print Shop
    TrayApp
    TurboTax 2008
    TurboTax 2008 wgaiper
    TurboTax 2008 WinPerFedFormset
    TurboTax 2008 WinPerProgramHelp
    TurboTax 2008 WinPerReleaseEngine
    TurboTax 2008 WinPerTaxSupport
    TurboTax 2008 WinPerUserEducation
    TurboTax 2008 wrapper
    TurboTax Deluxe 2002
    TurboTax Deluxe 2003
    TurboTax Deluxe 2004
    TurboTax Deluxe 2005
    TurboTax Deluxe 2007
    TurboTax Deluxe Deduction Maximizer 2006
    TurboTax ItsDeductible 2005
    TurboTax ItsDeductible 2006
    Tweak UI
    Unload
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Windows (KB971513)
    Update for Windows Media Player 10 (KB913800)
    Update for Windows Media Player 10 (KB926251)
    Update for Windows XP (KB943729)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951618-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB976749)
    Update Rollup 2 for Windows XP Media Center Edition 2005
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    Visual Studio 2005 Tools for Office Second Edition Runtime
    VNC 4.0
    WebFldrs XP
    WebReg
    WexTech AnswerWorks
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Presentation Foundation
    Windows Search 4.0
    Windows XP Media Center Edition 2005 KB908250
    Windows XP Media Center Edition 2005 KB925766
    Windows XP Media Center Edition 2005 KB973768
    Windows XP Service Pack 3
    Works Upgrade
    XML Paper Specification Shared Components Pack 1.0
    Yahoo! Messenger
    Yahoo! Search Protection
    Yahoo! Software Update
    Yahoo! Toolbar

    ==== Event Viewer Messages From Past Week ========

    12/8/2009 1:19:09 AM, error: System Error [1003] - Error code 1000007f, parameter1 00000008, parameter2 80042000, parameter3 00000000, parameter4 00000000.
    12/7/2009 3:08:24 AM, error: System Error [1003] - Error code 1000000a, parameter1 0000001e, parameter2 00000002, parameter3 00000001, parameter4 806e6a16.
    12/7/2009 3:05:42 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Beep
    12/7/2009 3:05:33 AM, error: Service Control Manager [7023] - The Intel(R) Quick Resume technology service terminated with the following error: The system could not find the environment option that was entered.
    12/7/2009 3:05:26 AM, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The system cannot find the file specified.
    12/7/2009 3:05:26 AM, error: Service Control Manager [7000] - The iolo Product Update Service service failed to start due to the following error: The executable program that this service is configured to run in does not implement the service.
    12/7/2009 12:31:40 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service ntmssvc with arguments "-Service" in order to run the server: {D61A27C6-8F53-11D0-BFA0-00A024151983}
    12/7/2009 1:20:53 AM, error: System Error [1003] - Error code 1000007f, parameter1 00000008, parameter2 bab38d70, parameter3 00000000, parameter4 00000000.
    12/7/2009 1:18:07 AM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
    12/6/2009 8:04:51 PM, error: Service Control Manager [7034] - The iolo System Service service terminated unexpectedly. It has done this 1 time(s).
    12/6/2009 8:04:51 PM, error: Service Control Manager [7034] - The iolo FileInfoList Service service terminated unexpectedly. It has done this 1 time(s).
    12/6/2009 1:14:48 AM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 0016761F508E has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

    ==== End Of File ===========================
     

  3. to hide this advert.

  4. 2009/12/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    How do you know?
    Did you check Task Scheduler?
    What does make you think, it's an infection?
     
  5. 2009/12/13
    pilotgal8 Lifetime Subscription

    pilotgal8 Well-Known Member Thread Starter

    Joined:
    2002/01/07
    Messages:
    459
    Likes Received:
    0
    No schedulled tasks. I posted here on Ari's request per the prior post under this Title in the Win XP forum. Every night the machine reboots.
     
  6. 2009/12/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It's still unclear.
    You leave the computer on and it restarts around 2AM?
    How do you know?
    You don't sleep around 2AM?
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.