Inactive AXWIN Frame Window: svchost.exe

[Inactive] AXWIN Frame Window: svchost.exe

Hello everyone, I'm a new member, I have a problem with this error AxWin Frame Window: svchost.exe
I do not know if it's a virus.
After I get the error the pc does not open any application and are forced to reboot via the reset tower
Sorry for the language but I'm Italian

 

Hi Moncicci, welcome to WindowsBBS

As indicated at the start of this forum, please *** READ THIS BEFORE POSTING IN THIS FORUM *** then post the requested logs in this thread.

NOTES:

When posting the logs ensure word wrap is switched off (in notepad Uncheck Format->Word Wrap) as this makes them difficult to read.

Be aware that only Malware analysts will advise and they are often busy. Your post will be taken on a first come first served basis but it may take a while before you receive a reply.

 

Scan with COMBOFIX

ComboFix 10-10-03.03 - Enzo 04/10/2010 16.17.19.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.3454.3069 [GMT 2:00]
Eseguito da: c:\documents and settings\Enzo\Desktop\ComboFix.exe

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Enzo\Dati applicazioni\inst.exe
c:\windows\system32\crt.dat
c:\windows\system32\fsc.txt
c:\windows\system32\ide.txt
c:\windows\system32\logs
c:\windows\system32\lpe.txt
c:\windows\system32\qks.txt
c:\windows\system32\shimg.dll

c:\windows\system32\DRIVERS\cdrom.sys . . . è infetto!! . . . Failed to find a valid replacement.
.
((((((((((((((((((((((((( Files Creati Da 2010-09-04 al 2010-10-04 )))))))))))))))))))))))))))))))))))
.

2010-10-02 18:45 . 2010-10-02 18:45 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Sandlot Games
2010-09-29 20:11 . 2010-09-29 20:11 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\Yahoo!
2010-09-29 12:44 . 2010-09-29 12:44 -------- d-----w- C:\spoolerlogs
2010-09-29 10:59 . 2010-10-03 21:47 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\HPAppData
2010-09-29 10:58 . 2010-09-29 10:58 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\WEBREG
2010-09-29 10:54 . 2010-09-29 10:54 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\HP
2010-09-29 10:51 . 2010-09-29 21:57 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Yahoo! Companion
2010-09-29 10:51 . 2010-09-29 10:51 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\Yahoo!
2010-09-29 10:51 . 2010-09-29 10:51 -------- d-----w- c:\programmi\Yahoo!
2010-09-29 10:50 . 2010-09-29 10:50 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\HP Product Assistant
2010-09-29 10:46 . 2010-09-29 10:54 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\HP
2010-09-29 10:42 . 2008-10-28 03:27 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
2010-09-29 10:42 . 2008-10-28 03:27 49920 ----a-r- c:\windows\system32\drivers\HPZid412.sys
2010-09-29 10:42 . 2010-09-29 10:58 170711 ----a-w- c:\windows\hpoins38.dat
2010-09-29 10:42 . 2009-06-04 17:59 622 ------w- c:\windows\hpomdl38.dat
2010-09-29 10:42 . 2009-04-20 10:23 123904 ----a-w- c:\windows\system32\hpf3l70w.dll
2010-09-29 10:42 . 2009-04-20 10:23 315904 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpfpp70w.dll
2010-09-29 10:42 . 2009-04-15 14:53 452408 ----a-r- c:\windows\system32\hpzids01.dll
2010-09-29 10:42 . 2008-10-28 03:27 21568 ----a-r- c:\windows\system32\drivers\HPZius12.sys
2010-09-29 10:41 . 2009-02-10 13:03 315392 ----a-r- c:\windows\system32\hposc_p02a.dll
2010-09-29 10:41 . 2008-10-28 03:27 372736 ----a-r- c:\windows\system32\hppldcoi.dll
2010-09-29 10:41 . 2008-10-28 03:27 309760 ----a-r- c:\windows\system32\difxapi.dll
2010-09-29 10:41 . 2009-02-10 13:03 966656 ----a-r- c:\windows\system32\hpost_p02e.dll
2010-09-29 10:41 . 2009-02-10 13:03 712704 ----a-r- c:\windows\system32\hposwia_p02e.dll
2010-09-26 09:24 . 2010-09-26 09:24 5248 ----a-w- c:\windows\system32\giveio.sys
2010-09-25 15:27 . 2010-09-25 15:27 -------- d-----w- c:\programmi\SSC Service Utility
2010-09-15 20:27 . 2010-09-08 18:45 615568 ----a-w- c:\documents and settings\Enzo\Dati applicazioni\Mozilla\Firefox\Profiles\3tozdhmd.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-09-15 20:27 . 2010-09-08 18:45 640264 ----a-w- c:\documents and settings\Enzo\Dati applicazioni\Mozilla\Firefox\Profiles\3tozdhmd.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-09-10 16:53 . 2010-09-10 16:53 -------- d-----w- c:\documents and settings\LocalService\Dati applicazioni\McAfee
2010-09-08 16:50 . 2010-09-08 16:50 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\McAfee
2010-09-08 16:50 . 2010-09-10 16:52 -------- d-----w- c:\programmi\McAfee Security Scan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-04 14:16 . 2009-11-21 13:20 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-10-04 10:00 . 2009-09-27 11:37 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\vlc
2010-10-01 09:37 . 2010-05-04 17:05 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\Vso
2010-09-30 12:56 . 2009-12-04 21:05 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\FileZilla
2010-09-30 09:23 . 2009-09-27 11:43 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\dvdcss
2010-09-29 19:35 . 2010-05-26 16:29 -------- d-----w- c:\programmi\JDownloader
2010-09-29 19:27 . 2010-05-25 16:16 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-09-29 10:54 . 2009-09-26 18:34 123880 ----a-w- c:\documents and settings\Enzo\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2010-09-29 10:51 . 2009-09-30 13:57 -------- d-----w- c:\programmi\HP
2010-09-28 15:18 . 2009-09-26 20:42 -------- d-----w- c:\programmi\Elaborate Bytes
2010-09-19 18:23 . 2009-10-08 16:19 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\VideoReDo-TVSuite
2010-09-19 17:45 . 2009-09-26 21:32 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\Temp
2010-09-14 23:28 . 2009-09-29 15:40 -------- d-----w- c:\programmi\Mozilla Thunderbird
2010-09-13 14:14 . 2010-04-15 15:30 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\Winamp
2010-09-10 13:28 . 2010-05-25 15:40 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\QuickScan
2010-08-29 10:24 . 2010-08-29 10:20 -------- d-----w- c:\programmi\CamStudio
2010-08-29 10:17 . 2010-08-29 10:17 -------- d-----w- c:\programmi\Cute Screen Recorder
2010-08-17 11:20 . 2010-08-17 11:16 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\Mozilla-Cache
2010-08-17 11:16 . 2010-03-15 14:05 -------- d-----w- c:\programmi\PartyItalia
2010-08-12 13:43 . 2010-08-12 13:43 -------- d-----w- c:\programmi\SDA
2010-08-06 19:12 . 2010-08-06 19:07 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\BSplayer
2010-08-06 19:07 . 2010-08-06 19:07 -------- d-----w- c:\documents and settings\Enzo\Dati applicazioni\BSplayer Pro
2010-08-06 19:07 . 2010-08-06 19:07 -------- d-----w- c:\programmi\Webteh
2010-08-06 09:15 . 2009-12-29 18:47 -------- d-----w- c:\programmi\File comuni\Apple
2010-07-11 15:23 . 2001-08-31 15:00 83422 ----a-w- c:\windows\system32\perfc010.dat
2010-07-11 15:23 . 2001-08-31 15:00 488988 ----a-w- c:\windows\system32\perfh010.dat
2009-10-10 15:00 . 2009-09-26 21:23 952 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

------- Sigcheck -------

[-] 2009-08-10 . 5AE1C2695F6523AD98B948F2887D8C5E . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys

[-] 2009-08-11 . 56F7866726C75C66167714D61CE84344 . 689152 . . [5.82] . . c:\windows\system32\comctl32.dll
[7] 2008-11-04 . 7FBD83168FEFD38A648CDE0A615B263E . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5705_x-ww_36cfed49\comctl32.dll
[7] 2001-08-31 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

[-] 2009-08-11 . 4DA3F8FBADB5D983B3717C8E4E3078E7 . 6273024 . . [8.00.6001.22902] . . c:\windows\system32\mshtml.dll

[-] 2009-08-10 . 45E0191FD9AF35CC5704EAD0C49BE266 . 2288640 . . [5.1.2600.5755] . . c:\windows\system32\ntoskrnl.exe

[-] 2009-08-11 . C84590DFD964CA7A7F3BCD5DEC519373 . 486912 . . [5.1.2600.5577] . . c:\windows\system32\user32.dll

[-] 2009-08-11 . 1242353E585301265219795B272B20CF . 982016 . . [8.00.6001.22896] . . c:\windows\system32\wininet.dll

[-] 2009-08-11 . C1346D928DAB6DA201887267EA8028ED . 1504256 . . [6.00.2900.5634] . . c:\windows\explorer.exe

[-] 2009-08-11 . 7F4C43F75EBF781352DB3B5EF6BF8230 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[-] 2009-08-10 . 90F006C8436E12843C2D72A938D8ACCA . 2167296 . . [5.1.2600.5755] . . c:\windows\system32\ntkrnlpa.exe

.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]
"BluetoothAuthenticationAgent "= "bthprops.cpl" [2008-04-13 110592]
"VirtualCloneDrive "= "c:\programmi\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2009-08-11 40448]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
HP Digital Imaging Monitor.lnk - c:\programmi\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp "= 1 (0x1)
"NoSMConfigurePrograms "= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp "= 1 (0x1)
"NoSMConfigurePrograms "= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R220 Series]
2006-12-25 03:00 177664 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATIAIE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-10-06 15:48 133104 ----atw- c:\documents and settings\Enzo\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 14:24 54840 ----a-w- c:\programmi\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2009-08-17 01:03 13877248 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2009-08-17 01:03 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\programmi\QT Lite\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-04-12 15:33 16132608 ----a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-02-10 21:32 61440 ----a-w- c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe "=

R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [14/07/2010 1.54.11 11264]
R2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [15/10/2009 11.42.25 14976]
S1 DumpDrv;Crash Dump Driver;c:\windows\system32\drivers\dumpdrv.sys [10/08/2009 18.28.14 9472]
S1 vcdrom;Virtual CD-ROM Device Driver;\??\c:\documents and settings\Enzo\Desktop\Nuova cartella\VCdRom.sys --> c:\documents and settings\Enzo\Desktop\Nuova cartella\VCdRom.sys [?]
S2 pqysyz;Universal Microsoft;c:\windows\system32\svchost.exe -k netsvcs [10/08/2009 18.25.09 14848]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\programmi\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 14.49.20 227232]
S3 SPC1000;USB2.0 PC Camera (SPC1000);c:\windows\system32\DRIVERS\spc1000.sys --> c:\windows\system32\DRIVERS\spc1000.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
pqysyz
.
Contenuto della cartella 'Scheduled Tasks'

2010-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-343818398-776561741-682003330-1004Core.job
- c:\documents and settings\Enzo\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2009-10-06 15:48]

2010-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-343818398-776561741-682003330-1004UA.job
- c:\documents and settings\Enzo\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2009-10-06 15:48]

2010-10-04 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\programmi\Ask.com\UpdateTask.exe [2010-01-20 08:34]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Enzo\Dati applicazioni\Mozilla\Firefox\Profiles\3tozdhmd.default\
FF - prefs.js: browser.startup.homepage - www.google.it
FF - component: c:\documents and settings\Enzo\Dati applicazioni\Mozilla\Firefox\Profiles\3tozdhmd.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\documents and settings\Enzo\Dati applicazioni\Mozilla\Firefox\Profiles\3tozdhmd.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\Enzo\Impostazioni locali\Dati applicazioni\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\programmi\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\programmi\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\npPandoWebInst.dll

---- FIREFOX POLICIES ----
c:\programmi\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbaam7a8h ", true);
c:\programmi\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-iTunesHelper - c:\programmi\iTunes\iTunesHelper.exe



Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A9EEEC5]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80ecf28
\Driver\ACPI -> ACPI.sys @ 0xb7f7fcb8
\Driver\atapi -> atapi.sys @ 0xb7f11852
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xb7dd5bb0
PacketIndicateHandler -> NDIS.sys @ 0xb7de2b21
SendHandler -> NDIS.sys @ 0xb7dc087b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath "= "\??\c:\programmi\CyberLink\PowerDVD\000.fcl "

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pqysyz]
"ServiceDll "= "c:\windows\system32\ncyoi.dll "
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(780)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\WININET.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\cscui.dll

- - - - - - - > 'lsass.exe'(840)
c:\windows\system32\WININET.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\scecli.dll
.
Ora fine scansione: 2010-10-04 16:28:41
ComboFix-quarantined-files.txt 2010-10-04 14:28

Pre-Run: 230.840.283.136 byte disponibili
Post-Run: 230.913.130.496 byte disponibili

- - End Of File - - AE971AFE24E53893E6BAE1C8F64E3B4E