1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active Msconfig can start but won't show up?

Discussion in 'Malware and Virus Removal Archive' started by pilau, 2010/01/14.

  1. 2010/01/14
    pilau

    pilau Inactive Thread Starter

    Joined:
    2007/05/21
    Messages:
    24
    Likes Received:
    0
    [Active] Msconfig can start but won't show up?

    This thread is posted in reference to this thread right here: http://www.windowsbbs.com/windows-xp/89913-msconfig-can-start-but-wont-show-up.html

    Hi everybody.

    I just installed a fresh XP Pro installation three days ago and have installed some sofware (including anti-virus). The problem is when I try to run msconfig (either through Win+run or via explorer or cmd), I can see it's process name on task manager but the window won't show up. It just isn't showing.

    I also validated this using a tool called cmdow, that lists all currently running window handles and msconfig does not appear on the list!

    I tried sfc /scannow, but it didn't change anything.

    What could be the problem? I am a very experienced user and have never encountered such an issue.

    Any help would be much appreciated. Thanks in advance.

    DDS logs:

    Here's the DDS.txt log:

    DDS (Ver_09-12-01.01) - NTFSx86
    Run by Tom at 12:22:00.84 on Thu 01/14/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.416 [GMT 2:00]

    AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    D:\Security\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Misc\RocketDock\RocketDock.exe
    D:\Misc\Styler\Styler.exe
    svchost.exe
    D:\Security\ESET NOD32 Antivirus\ekrn.exe
    C:\WINDOWS\system32\nvsvc32.exe
    D:\Maintenance\O.O Defrag Professional\oodag.exe
    D:\Audio\Winamp\winamp.exe
    D:\Internet\Mozilla Firefox\firefox.exe
    D:\Internet\uTorrent\uTorrent.exe
    E:\Downloads\Stuff\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = about:blank
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Loader Class: {f880a4a8-c436-4ac4-afd1-aa0bdc9552dd} - d:\misc\findexer\FindeXer.dll
    TB: StylerToolBar: {d2f8f919-690b-4ea2-9fa7-a203d1e04f75} - d:\misc\styler\tb\StylerTB.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    EB: FindeXer: {377d8121-efaa-4d1c-981b-8bfad9f10de3} - d:\misc\findexer\FindeXer.dll
    uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
    uRun: [RocketDock] "d:\misc\rocketdock\RocketDock.exe "
    uRun: [DAEMON Tools Lite] "d:\file system\daemon tools lite\DTLite.exe" -autorun
    uRun: [uTorrent] "d:\internet\utorrent\uTorrent.exe "
    mRun: [IMJPMIG8.1] c:\windows\ime\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [egui] "d:\security\eset nod32 antivirus\egui.exe" /hide /waitservice
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [OODefragTray] d:\maintenance\o.o defrag professional\oodtray.exe
    mRun: [Adobe Reader Speed Launcher] "d:\graphics\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    StartupFolder: c:\docume~1\tom\startm~1\programs\startup\styler.lnk - c:\docume~1\tom\applic~1\microsoft\installer\{e9ecf354-2422-4fdb-9abf-d8adac0ef941}\_585b207a.exe
    uPolicies-explorer: NoActiveDesktop = 01000000
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Notify: Antiwpa - antiwpa.dll
    SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - d:\misc\iconpackager\iprepair.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\b7er9chw.default\
    FF - prefs.js: browser.search.selectedEngine - Babylon Search
    FF - prefs.js: browser.startup.homepage - about:blank
    FF - component: c:\documents and settings\tom\application data\mozilla\firefox\profiles\b7er9chw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
    FF - plugin: d:\graphics\adobe\reader 9.0\reader\browser\nppdf32.dll
    FF - plugin: d:\graphics\picasa3\npPicasa3.dll
    FF - plugin: d:\video\k-lite codec pack\real\browser\plugins\nppl3260.dll
    FF - plugin: d:\video\k-lite codec pack\real\browser\plugins\nprpjplug.dll
    FF - plugin: d:\video\vlc\npvlc.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

    ============= SERVICES / DRIVERS ===============

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-11 108792]
    R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-9-11 96408]
    R2 ekrn;ESET Service;d:\security\eset nod32 antivirus\ekrn.exe [2009-12-31 735960]
    S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2009-12-21 27064]

    =============== Created Last 30 ================

    2010-01-13 20:55:14 30762 ----a-w- c:\windows\scunin.dat
    2010-01-13 20:55:13 967 ----a-w- c:\windows\ScUnin.pif
    2010-01-13 20:55:13 94208 ----a-w- c:\windows\ScUnin.exe
    2010-01-11 09:52:35 364544 ----a-w- c:\windows\system32\MACDll.dll
    2010-01-11 09:52:35 246424 ----a-w- c:\windows\system32\unicows.dll
    2010-01-10 00:54:12 274288 ----a-w- c:\windows\system32\mucltui.dll
    2010-01-10 00:54:12 215920 ----a-w- c:\windows\system32\muweb.dll
    2010-01-10 00:54:12 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
    2010-01-09 21:55:40 0 d-----w- c:\documents and settings\tom\Tracing
    2010-01-09 21:48:57 0 d-----w- c:\program files\Microsoft
    2010-01-09 21:48:37 0 d-----w- c:\program files\Windows Live SkyDrive
    2010-01-09 21:41:02 0 d-----w- c:\program files\common files\Windows Live
    2010-01-07 13:11:16 0 d-----w- c:\program files\Bonjour
    2010-01-07 13:02:24 0 d-----w- c:\program files\common files\Macrovision Shared
    2010-01-05 10:06:00 218624 ----a-w- c:\windows\system32\uxtheme.uxtender
    2010-01-02 10:59:59 0 d--h--w- c:\windows\PIF
    2010-01-01 19:47:59 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
    2010-01-01 19:46:59 41216 -c--a-w- c:\windows\system32\dllcache\s3mt3d.sys
    2010-01-01 19:45:57 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys
    2010-01-01 19:44:59 20864 -c--a-w- c:\windows\system32\dllcache\lwadihid.sys
    2010-01-01 19:43:58 28700 -c--a-w- c:\windows\system32\dllcache\ibmexmp.sys
    2010-01-01 19:42:58 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
    2010-01-01 19:41:59 6912 -c--a-w- c:\windows\system32\dllcache\ctlfacem.sys
    2010-01-01 19:40:59 102400 -c--a-w- c:\windows\system32\dllcache\binlsvc.dll
    2010-01-01 19:39:51 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
    2010-01-01 15:19:20 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
    2010-01-01 15:18:25 0 d-----w- c:\docume~1\tom\applic~1\DAEMON Tools Lite
    2010-01-01 15:18:23 0 d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
    2010-01-01 13:13:10 282624 ----a-w- c:\windows\system32\cnvshell.dll
    2010-01-01 13:13:06 483328 ----a-w- c:\windows\system32\icpres.dll
    2010-01-01 13:13:05 1706800 ----a-w- c:\windows\system32\gdiplus.dll
    2010-01-01 12:53:55 0 d-----w- c:\docume~1\tom\applic~1\Mp3tag
    2010-01-01 10:47:44 260 ----a-w- c:\documents and settings\tom\Asterix
    2009-12-31 20:24:15 169 ----a-w- c:\windows\RtlRack.ini
    2009-12-31 10:53:07 250796 ----a-w- c:\windows\system32\oodbs.lor
    2009-12-31 08:36:13 0 d-----w- c:\windows\system32\oodag
    2009-12-31 07:36:31 266360 ----a-w- c:\windows\system32\TweakUI.exe
    2009-12-31 07:36:31 160217 ----a-w- c:\windows\system32\PowerToysLicense.rtf
    2009-12-30 22:48:23 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{1C533CDB-BAC7-4600-B3DE-0B628D9AC643}
    2009-12-30 22:09:42 0 d-----w- c:\docume~1\tom\applic~1\Styler
    2009-12-30 21:48:21 0 d-----w- c:\docume~1\tom\applic~1\FindeXer
    2009-12-30 07:30:15 1089593 -c----w- c:\windows\system32\dllcache\ntprint.cat
    2009-12-29 21:31:55 684032 ----a-w- c:\windows\system32\divx.dll
    2009-12-29 21:31:53 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest
    2009-12-29 21:31:52 84480 ----a-w- c:\windows\system32\ff_vfw.dll
    2009-12-29 21:31:52 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
    2009-12-29 21:31:51 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2009-12-29 21:31:51 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2009-12-29 16:24:08 0 d-----w- c:\windows\system32\XPSViewer
    2009-12-29 15:31:38 0 d-----w- c:\windows\system32\URTTemp
    2009-12-29 14:13:30 0 d-----w- c:\windows\RegisteredPackages
    2009-12-29 13:50:37 49152 ----a-w- c:\windows\system32\ChCfg.exe
    2009-12-29 13:50:20 4017536 ----a-r- c:\windows\system32\drivers\alcxwdm.sys
    2009-12-29 13:50:10 0 d-----w- c:\program files\Realtek Sound Manager
    2009-12-29 13:50:09 164 ----a-w- c:\windows\avrack.ini
    2009-12-29 13:50:09 0 d-----w- c:\program files\AvRack
    2009-12-29 13:49:58 0 d-----w- c:\program files\Realtek AC97
    2009-12-29 13:49:56 141016 ----a-w- c:\windows\system32\alsndmgr.wav
    2009-12-29 13:49:56 10528768 ----a-w- c:\windows\system32\RTLCPL.exe
    2009-12-29 13:49:54 577536 ----a-w- c:\windows\soundman.exe
    2009-12-29 13:49:54 18804736 ----a-w- c:\windows\system32\alsndmgr.cpl
    2009-12-29 13:49:53 143360 ----a-w- c:\windows\system32\RtlCPAPI.dll
    2009-12-29 13:49:51 315392 ----a-w- c:\windows\alcupd.exe
    2009-12-29 13:49:51 217088 ----a-w- c:\windows\Alcrmv.exe
    2009-12-29 12:42:44 8 ----a-w- c:\windows\system32\nvModes.dat
    2009-12-29 12:33:49 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{807DF20C-D1F6-4D87-91A0-F7767E463806}
    2009-12-29 12:30:42 186500 ----a-w- c:\windows\system32\nvapps.xml
    2009-12-29 12:30:40 446464 ----a-w- c:\windows\system32\nvudisp.exe
    2009-12-29 12:30:40 18070 ----a-w- c:\windows\system32\nvdisp.nvu
    2009-12-29 12:30:40 0 d-----w- c:\windows\nview
    2009-12-29 12:26:31 446464 ----a-w- c:\windows\system32\NVUNINST.EXE
    2009-12-29 12:26:21 0 d-----w- c:\program files\NVIDIA
    2009-12-29 12:16:47 0 d-----w- c:\windows\pss
    2009-12-29 12:04:58 0 d-----w- c:\program files\sisagp
    2009-12-29 12:04:53 36992 ----a-w- c:\windows\system32\drivers\SISAGPX.SYS
    2009-12-29 12:04:45 9472 ----a-r- c:\windows\system32\drivers\sisperf.sys
    2009-12-29 12:04:45 49024 ----a-r- c:\windows\system32\drivers\sisidex.sys
    2009-12-29 12:04:40 4096 ----a-r- c:\windows\system32\drivers\siside.sys
    2009-12-29 11:26:54 4992 -c--a-w- c:\windows\system32\dllcache\mspqm.sys
    2009-12-29 11:26:54 4992 ----a-w- c:\windows\system32\drivers\MSPQM.sys
    2009-12-29 11:26:47 5376 -c--a-w- c:\windows\system32\dllcache\mspclock.sys
    2009-12-29 11:26:47 5376 ----a-w- c:\windows\system32\drivers\MSPCLOCK.sys
    2009-12-29 11:26:31 60160 -c--a-w- c:\windows\system32\dllcache\drmk.sys
    2009-12-29 11:26:31 60160 ----a-w- c:\windows\system32\drivers\drmk.sys
    2009-12-29 11:26:31 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll
    2009-12-29 11:26:31 4096 ----a-w- c:\windows\system32\ksuser.dll
    2009-12-29 11:26:31 146048 -c--a-w- c:\windows\system32\dllcache\portcls.sys
    2009-12-29 11:26:31 146048 ----a-w- c:\windows\system32\drivers\portcls.sys
    2009-12-29 11:26:30 129536 -c--a-w- c:\windows\system32\dllcache\ksproxy.ax
    2009-12-29 11:26:30 129536 ----a-w- c:\windows\system32\ksproxy.ax
    2009-12-29 11:24:06 0 d-----w- c:\documents and settings\tom\WINDOWS
    2009-12-29 11:19:34 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
    2009-12-29 11:19:16 327168 ----a-w- c:\windows\IsUninst.exe
    2009-12-29 11:09:33 0 d-sh--w- c:\documents and settings\tom\PrivacIE
    2009-12-29 11:07:13 0 d-sh--w- c:\documents and settings\tom\IETldCache
    2009-12-29 11:00:44 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2009-12-29 11:00:43 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
    2009-12-29 11:00:43 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
    2009-12-29 11:00:42 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2009-12-29 11:00:42 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
    2009-12-29 11:00:40 11069952 -c----w- c:\windows\system32\dllcache\ieframe.dll
    2009-12-29 11:00:34 0 d-----w- c:\windows\ie8updates
    2009-12-29 11:00:30 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2009-12-29 10:58:34 0 dc-h--w- c:\windows\ie8
    2009-12-29 09:18:13 2560 ------w- c:\windows\system32\xpsp4res.dll
    2009-12-29 09:17:53 0 d-----w- c:\docume~1\tom\applic~1\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
    2009-12-29 09:13:47 2145280 -c--a-w- c:\windows\system32\dllcache\ntkrnlmp.exe
    2009-12-29 09:13:45 2023936 -c--a-w- c:\windows\system32\dllcache\ntkrpamp.exe
    2009-12-29 09:03:09 13588 ----a-w- c:\windows\system32\wpa.bak
    2009-12-29 09:01:50 0 d-----w- c:\program files\Activation
    2009-12-29 09:01:47 5376 ----a-w- c:\windows\system32\antiwpa.dll
    2009-12-29 08:46:27 0 d-----w- c:\windows\system32\PreInstall
    2009-12-29 08:46:24 0 d--h--w- c:\windows\$hf_mig$
    2009-12-29 08:31:04 0 d-----w- c:\windows\system32\SoftwareDistribution
    2009-12-28 21:17:23 0 d-----w- c:\docume~1\tom\applic~1\uTorrent
    2009-12-28 21:16:23 119808 -c--a-w- c:\windows\system32\dllcache\mtstocom.exe
    2009-12-28 21:16:15 27648 -c--a-w- c:\windows\system32\dllcache\rw001ext.dll
    2009-12-28 21:16:04 29184 -c--a-w- c:\windows\system32\dllcache\rw330ext.dll
    2009-12-28 21:14:36 294912 -c----w- c:\windows\system32\dllcache\dlimport.exe
    2009-12-28 21:12:00 0 d-----w- c:\windows\network diagnostic
    2009-12-28 21:11:58 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys
    2009-12-28 21:11:57 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
    2009-12-28 21:10:56 19569 ----a-w- c:\windows\005410_.tmp
    2009-12-28 20:47:33 0 d-----w- c:\windows\system32\wbem\AutoRecover
    2009-12-28 20:45:48 0 d-s---w- c:\windows\system32\Microsoft
    2009-12-28 20:42:28 316640 ----a-w- c:\windows\WMSysPr9.prx
    2009-12-28 20:40:59 7168 -c--a-w- c:\windows\system32\dllcache\iisfecnv.dll
    2009-12-28 20:39:42 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
    2009-12-28 20:39:29 8704 -c--a-w- c:\windows\system32\dllcache\snmptrap.exe
    2009-12-28 20:39:22 72192 -c--a-w- c:\windows\system32\dllcache\fxscom.dll
    2009-12-28 20:39:10 55296 -c--a-w- c:\windows\system32\dllcache\fxsevent.dll
    2009-12-28 20:39:09 18944 -c--a-w- c:\windows\system32\dllcache\lprmon.dll
    2009-12-28 20:38:54 35328 -c--a-w- c:\windows\system32\dllcache\iprip.dll
    2009-12-28 20:38:47 33792 -c--a-w- c:\windows\system32\dllcache\lmmib2.dll
    2009-12-28 20:38:37 331264 -c--a-w- c:\windows\system32\dllcache\aqueue.dll
    2009-12-28 20:38:37 101888 -c--a-w- c:\windows\system32\dllcache\evntagnt.dll
    2009-12-28 20:35:45 2897920 -c--a-w- c:\windows\system32\dllcache\xpsp2res.dll
    2009-12-28 20:35:45 2897920 ------w- c:\windows\system32\xpsp2res.dll
    2009-12-28 20:34:55 19528 ----a-w- c:\windows\002331_.tmp
    2009-12-28 20:34:53 0 d-----w- c:\windows\system32\ReinstallBackups
    2009-12-28 20:34:36 26144 ----a-w- c:\windows\system32\spupdsvc.exe
    2009-12-28 20:04:59 9216 -c--a-w- c:\windows\system32\dllcache\kbdnecat.dll
    2009-12-28 19:53:34 0 d-----w- c:\program files\common files\ODBC
    2009-12-28 19:53:32 0 d-----w- c:\program files\common files\SpeechEngines
    2009-12-28 19:53:11 0 d-----r- c:\documents and settings\all users\Documents
    2009-12-28 18:30:42 0 d-sh--w- c:\documents and settings\all users\DRM
    2009-12-28 18:29:12 0 d-----w- c:\program files\common files\MSSoap
    2009-12-28 18:28:26 0 d--h--w- c:\program files\WindowsUpdate
    2009-12-28 18:28:26 0 d-----w- c:\program files\Online Services
    2009-12-28 18:28:20 0 d-----w- c:\program files\Messenger
    2009-12-28 18:28:09 0 d-----w- c:\program files\MSN Gaming Zone
    2009-12-28 18:27:59 0 d-----w- c:\program files\Windows NT

    ==================== Find3M ====================

    2010-01-05 10:06:00 218624 ----a-w- c:\windows\system32\uxtheme.dll
    2009-12-30 09:20:54 27064 ----a-w- c:\windows\system32\drivers\revoflt.sys
    2009-12-28 18:28:42 21640 ----a-w- c:\windows\system32\emptyregdb.dat
    2009-12-21 00:41:02 27192 ----a-w- c:\windows\system32\revoflt.sys
    2009-12-14 19:15:14 2146304 ----a-w- c:\windows\system32\GPhotos.scr
    2009-11-13 22:57:16 922112 ------w- c:\windows\system32\imapi2fs.dll
    2009-11-13 22:57:16 426496 ------w- c:\windows\system32\imapi2.dll
    2009-11-12 09:38:30 68372 ----a-w- c:\windows\fonts\BERTHAM.ttf
    2009-10-29 07:45:38 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll

    ============= FINISH: 12:22:23.31 ===============


    Here's the Attach.txt log:

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-12-01.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 28/12/2009 20:32:48
    System Uptime: 13/01/2010 09:47:31 (27 hours ago)

    Motherboard: Gigabyte Technology Co., Ltd. | | GA-8S648
    Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Socket 478 | 2813/133mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 16 GiB total, 7.443 GiB free.
    D: is FIXED (NTFS) - 59 GiB total, 53.847 GiB free.
    E: is FIXED (NTFS) - 466 GiB total, 164.007 GiB free.
    F: is CDROM ()
    G: is CDROM (CDFS)
    H: is CDROM (CDFS)

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP23: 29/12/2009 16:17:13 - Revo Uninstaller Pro's restore point - Winamp
    RP24: 29/12/2009 16:18:19 - Revo Uninstaller Pro's restore point - Winamp
    RP25: 29/12/2009 17:16:44 - Software Distribution Service 3.0
    RP26: 29/12/2009 17:31:35 - Installed Microsoft .NET Framework 1.1
    RP27: 29/12/2009 18:23:17 - Installed %1 %2.
    RP28: 29/12/2009 18:23:21 - Printer Driver Microsoft XPS Document Writer Installed
    RP29: 29/12/2009 19:30:19 - Installed Windows KB954550-v5.
    RP30: 29/12/2009 19:30:27 - Printer Driver Microsoft XPS Document Writer Installed
    RP31: 29/12/2009 23:30:26 - Installed K-Lite Mega Codec Pack
    RP32: 30/12/2009 09:27:35 - Printer Driver Microsoft XPS Document Writer Installed
    RP33: 30/12/2009 09:36:10 - Software Distribution Service 3.0
    RP34: 30/12/2009 19:33:57 - Software Distribution Service 3.0
    RP35: 30/12/2009 19:59:56 - Software Distribution Service 3.0
    RP36: 30/12/2009 20:18:07 - Software Distribution Service 3.0
    RP37: 30/12/2009 23:32:36 - Before Findexer
    RP38: 31/12/2009 00:08:22 - Installed Styler
    RP39: 31/12/2009 10:32:13 - Installed O&O Defrag Professional.
    RP40: 01/01/2010 11:01:33 - System Checkpoint
    RP41: 01/01/2010 16:53:54 - Installed Windows XP -- Software Updates KB952011.
    RP42: 01/01/2010 17:19:20 - SPTD setup V1.62
    RP43: 02/01/2010 18:44:55 - System Checkpoint
    RP44: 03/01/2010 19:22:28 - System Checkpoint
    RP45: 04/01/2010 20:36:05 - System Checkpoint
    RP46: 05/01/2010 21:24:04 - System Checkpoint
    RP47: 06/01/2010 21:50:24 - System Checkpoint
    RP48: 07/01/2010 22:08:24 - System Checkpoint
    RP49: 08/01/2010 22:09:22 - System Checkpoint
    RP50: 09/01/2010 23:08:17 - System Checkpoint
    RP51: 11/01/2010 11:37:35 - System Checkpoint
    RP52: 12/01/2010 12:39:13 - System Checkpoint
    RP53: 13/01/2010 13:03:37 - System Checkpoint

    ==== Installed Programs ======================

    µTorrent
    Adobe AIR
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe ExtendScript Toolkit 2
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Linguistics CS3
    Adobe PDF Library Files
    Adobe Photoshop CS3
    Adobe Reader 9.2
    Adobe Setup
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS3
    C-Media WDM Audio Driver
    ESET NOD32 Antivirus
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB976098-v2)
    IconPackager
    ImageConverter Plus 7.0
    K-Lite Mega Codec Pack 4.8.5
    Medieval CUE Splitter
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB953297)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Monkey's Audio
    Mozilla Firefox (3.5)
    Mp3tag v2.45a
    MSVCRT
    MSXML 6.0 Parser (KB925673)
    NVIDIA Drivers
    O&O Defrag Professional
    PDF Settings
    Picasa 3
    Realtek AC'97 Audio
    Revo Uninstaller Pro 2.0.5
    Revo Uninstaller Pro w Loader
    RocketDock 1.3.5
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371-v2)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB976325)
    Segoe UI
    SiSAGP driver
    Skype web features
    Skype™ 4.1
    Starcraft
    Styler
    Tweak UI
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Windows (KB971513)
    Update for Windows Internet Explorer 8 (KB975364)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    VLC media player 1.0.3
    WebFldrs XP
    Winamp
    Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format Runtime
    Windows Presentation Foundation
    Windows XP Service Pack 3
    WinRAR archiver
    XML Paper Specification Shared Components Pack 1.0

    ==== Event Viewer Messages From Past Week ========

    13/01/2010 23:07:35, error: Server [2505] - The server could not bind to the transport \Device\NwlnkNb because another computer on the network has the same name. The server could not start.
    13/01/2010 23:07:35, error: Server [2505] - The server could not bind to the transport \Device\NwlnkIpx because another computer on the network has the same name. The server could not start.
    07/01/2010 17:50:22, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 120 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    07/01/2010 16:50:22, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 60 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    07/01/2010 16:20:21, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 30 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    07/01/2010 16:05:21, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    07/01/2010 16:04:56, error: SideBySide [59] - Generate Activation Context failed for D:\Security\ESET NOD32 Antivirus\MFC80U.DLL. Reference error message: The operation completed successfully. .
    07/01/2010 16:04:56, error: SideBySide [58] - Syntax error in manifest or policy file "D:\Security\ESET NOD32 Antivirus\Microsoft.VC80.MFCLOC.MANIFEST" on line 5.
    07/01/2010 16:04:56, error: SideBySide [34] - Component identity found in manifest does not match the identity of the component requested
    07/01/2010 06:32:16, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 960 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    ==== End Of File ===========================
     
  2. 2010/01/14
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    No CODE tags - thanks - makes the logs impossible to read.
     

  3. to hide this advert.

  4. 2010/01/14
    pilau

    pilau Inactive Thread Starter

    Joined:
    2007/05/21
    Messages:
    24
    Likes Received:
    0
    Sorry about that. Do you have some insights, PeteC? :)
     
  5. 2010/01/14
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc…) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

    References for the risk of these programs are here, and here.

    I would strongly recommend that you uninstall them,

    Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.

    A Malware expert will have a look at your log in due course.
     
  6. 2010/01/14
    pilau

    pilau Inactive Thread Starter

    Joined:
    2007/05/21
    Messages:
    24
    Likes Received:
    0
    Thank you for your help and thank you for your warning. Only for the record, I use uTorrent to share my band's music through torrents.
     
  7. 2010/01/14
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I don't really see anything, but let's run couple of scans....

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    RESTART COMPUTER

    STEP 4. Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Installer under Version 2.0.2
    [DO NOT download version 2.0.3 (beta)]
    Install, and run it.
    Post HijackThis log.
    NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.