1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Generic host process for win32 error + sound problems

Discussion in 'Malware and Virus Removal Archive' started by CRJ, 2010/01/12.

Page 1 of 2
  1. 2010/01/12
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    [Resolved] Generic host process for win32 error + sound problems

    Hi all. Having this extremely frustrating problem with my PC, and no luck with fixing thus far.

    First thing I noticed was no more sound coming from my speakers, but headphones plugged to both front and back output jacks work fine. My mother had just moved my computer from one room to another so I wrote it off as some setting that was likely accidentally changed somehow. I downloaded a few music mixing programs off the internet, then after 1 or 2 days of using them, I began getting sound card error messages when trying to play music files in Windows Media Player -- something about not having the right sound card, or then it is in use by another program. I'd have to reboot in order to play the file. Finally last night after another 2 days of sound problems, my computer froze. I forced it off, and it froze again on restart. Eventually I managed to get into system restore, thinking I possibly caught something from downloading one of the programs, but upon startup I was hit with various new error messages about different appication files that couldn't be found, etc. I undid the restore, and upon restarting got the first "Generic host process for win32 services has stopped working" message. If I send the report, or ignore it, it crashes my internet and takes anywhere from 15 minutes to an hour to come back. When I hit debug it seems to leave the net functional for a short time, but upon running any applications it then fails.

    After searching through various posts and fixes, I tried some so far also to no avail. I reset my windows firewall settings to default -- still received the message. Tried to install the hotfix patch -- it says what I am currently running is newer than the update. Tried to generally run Windows Update, it asks me to install a Windows Update file, I click ok, and the window stops loading and reads "done" but nothing happens. My computer is set to receive updates automatically, and I am running a Trend Micro HouseCall scan as I type this, but I am at a loss for anything further.

    If anyone can please help, I'd appreciate it very much! I work off this computer, so it's very important that I have everything up and running again ASAP. Thank you!

    ETA: I am running Windows XP.
     
    CRJ,
    #1
  2. 2010/01/12
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,680
    Likes Received:
    104
    If you want to post in this forum there's only one way:

    Read this post as indicated at the top of this forum & follow the instructions.
     
    Admin.,
    #2


  3. to hide this advert.

  4. 2010/01/12
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Hi, I am assuming you are referring to the section about the DDS program. I apologize if I was not clear enough in my post -- After getting the win32 error, I can't run any applications without the computer freezing. I got lucky just once by clicking fast and beating out the error message, and I got far enough to begin the HouseCall scan, but it has since gotten hung up and is no longer working. Generally though, I can't access the internet long enough to download anything. I'm beginning to face the fact that a system recovery might be my only option.
     
    CRJ,
    #3
  5. 2010/01/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I'd like to see, if the tool listed below will find anything....

    1. Download [ftp=ftp://ftp.drweb.com/pub/drweb/livecd/minDrWebLiveCD-5.0.1.iso]Dr.Web LiveCD[/ftp].
    2. Download, and install free Imgburn: http://www.imgburn.com/index.php?act=download
    3. Using Imgburn, burn minDrWebLiveCD-5.0.1.iso to a CD.
    4. Make sure that the CD/DVD drive is set as the first-boot device. Adjust corresponding BIOS settings, if necessary.
    5. Insert Dr.Web LiveCD into the drive and restart computer.
    6. As loading starts, a dialogue window will pop up:

    [​IMG]

    7. Press Enter to continue with DrWeb-LiveCD (Default) mode.
    8. The operating system will detect all available disk drives automatically. It will also try to connect to the local network, if available.
    9. Check the disks or folders you want to scan, and click on Start.

    Dr.Web LiveCD user manual: ftp://ftp.drweb.com/pub/drweb/livecd/LiveCD-ru.pdf
     
    broni,
    #4
  6. 2010/01/12
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    DDS Logs

    Got lucky again. Here are the requested logs:

    The 1st:

    DDS (Ver_09-12-01.01) - NTFSx86
    Run by HP_Administrator at 21:08:10.82 on Tue 01/12/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.218 [GMT -5:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\WINDOWS\system32\agrsmsvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\Program Files\Belkin\F1U201.401\usbshare.exe
    C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\HouseCall\housecall.bin
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\HP_Administrator\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uSearch Bar = hxxp://www.google.com/ie
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uStart Page = hxxp://www.yahoo.com/
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: KeyScramblerBHO Class: {2b9f5787-88a5-4945-90e7-c4b18563bc5e} - c:\program files\keyscrambler\KeyScramblerIE.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - n:\cleans~1\spybot~1\SDHelper.dll
    BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
    TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
    mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
    mRun: [PinnacleDriverCheck] c:\windows\system32\\PSDrvCheck.exe
    mRun: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\docume~1\hp_adm~1\startm~1\programs\startup\wkcalrem.lnk - c:\program files\common files\microsoft shared\works shared\WkCalRem.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\f1u201~1.lnk - c:\program files\belkin\f1u201.401\usbshare.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wpn111 configuration utility\wpn111.exe
    IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
    IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - c:\program files\keyscrambler\KeyScramblerIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - n:\cleans~1\spybot~1\SDHelper.dll
    Trusted Zone: jetblue.com\www
    Trusted Zone: yahoo.com\us.mg3.mail
    Trusted Zone: youtube.com\www
    DPF: {26522409-8BBF-4C5B-A4D3-CF4B1D6F255B} - hxxp://www.umediaserver.net/bin/UMediaControl5.cab
    DPF: {49232000-16E4-426C-A231-62846947304B} - hxxp://ipgweb.cce.hp.com/rdqnbk2/downloads/sysinfo.cab
    DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1230509302140
    DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229871112062
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263337063359
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
    LSA: Notification Packages = :\WINDOW
    Hosts: 127.0.0.1 www.spywareinfo.com

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\hp_adm~1\applic~1\mozilla\firefox\profiles\9jsma66v.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
    FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-6-21 335240]
    R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-6-21 27784]
    R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-6-21 108552]
    R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-6-21 908056]
    R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-6-21 297752]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-9-18 54752]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
    R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2007-10-1 113896]
    S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-9-28 24652]
    S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\drivers\athwpn.sys [2007-10-14 43392]
    S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2007-10-14 17149]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
    S3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [2006-12-9 91841]
    S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\drivers\WPN111.sys [2007-10-14 286720]

    =============== Created Last 30 ================

    2010-01-12 15:40:50 0 d-----w- c:\windows\system32\wbem\Repository
    2010-01-12 15:40:27 0 d-----w- c:\docume~1\hp_adm~1\applic~1\Acoustica
    2010-01-11 14:38:46 0 d-----w- c:\program files\Audacity
    2010-01-11 03:13:01 21 ----a-w- c:\documents and settings\hp_administrator\.javafx_ping_sent
    2010-01-11 03:12:58 0 ----a-w- c:\documents and settings\hp_administrator\.javafx_eula_accepted
    2010-01-11 03:10:54 57344 ----a-w- c:\windows\system32\Wnaspint.dll
    2010-01-11 03:10:42 0 d-----w- c:\program files\Acoustica Shared Effects
    2010-01-11 03:10:41 0 d-----w- c:\docume~1\alluse~1\applic~1\Acoustica
    2010-01-11 03:10:04 0 d-----w- c:\program files\Acoustica Mixcraft 4
    2010-01-10 20:54:00 225280 ----a-r- c:\windows\system32\ReWire.dll
    2010-01-10 20:53:57 774144 ----a-w- c:\windows\MTUn4873.exe
    2010-01-10 20:53:57 0 d-----w- c:\program files\MadTracker
    2010-01-10 19:47:52 0 d-----w- c:\program files\iPod
    2010-01-10 19:47:47 0 d-----w- c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2010-01-10 19:45:41 0 d-----w- c:\docume~1\alluse~1\applic~1\MP3 Remix
    2010-01-10 19:21:45 0 d-----w- c:\program files\Free Offers from Freeze.com
    2010-01-10 15:18:29 131856 ----a-w- c:\windows\system32\MSADODC.ocx
    2010-01-03 15:46:29 35840 ----a-w- c:\windows\system\LAUNCH32.DLL
    2010-01-03 15:46:29 26144 ----a-w- c:\windows\system\LAUNCH16.DLL
    2010-01-03 15:46:18 0 d-----w- C:\WISHBONE
    2010-01-01 22:55:27 0 d-----w- C:\Pepper
    2010-01-01 22:54:46 0 d-----w- C:\SIERRA

    ==================== Find3M ====================

    2010-01-05 04:53:42 16874 ----a-w- c:\docume~1\hp_adm~1\applic~1\wklnhst.dat
    2009-11-03 01:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-11-01 01:50:30 59 ----a-w- C:\PANCD.BAT
    2008-11-23 05:09:39 22 --sha-w- c:\windows\sminst\HPCD.sys
    2008-11-28 17:54:28 32768 --sha-w- c:\windows\system32\config\systemprofile\application data\microsoft\internet explorer\userdata\index.dat
    2008-11-28 17:54:28 16384 --sha-w- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
    2008-10-12 01:26:56 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008101120081012\index.dat
    2009-07-07 14:55:05 16384 --sha-w- c:\windows\temp\cookies\index.dat
    2009-07-07 14:55:05 16384 --sha-w- c:\windows\temp\history\history.ie5\index.dat
    2009-07-07 14:55:05 49152 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat

    ============= FINISH: 21:09:25.56 ===============

    The 2nd:

    DDS (Ver_09-12-01.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 1/20/2006 9:14:37 PM
    System Uptime: 1/12/2010 5:54:41 PM (4 hours ago)

    Motherboard: MSI | | AMETHYST-M
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ | Socket 939 | 1772/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 224 GiB total, 26.656 GiB free.
    D: is FIXED (FAT32) - 8 GiB total, 1.114 GiB free.
    E: is CDROM (CDFS)
    F: is CDROM ()
    G: is Removable
    H: is Removable
    I: is Removable
    J: is Removable
    N: is Removable

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP82: 10/14/2009 2:16:27 AM - System Checkpoint
    RP83: 10/15/2009 3:17:24 AM - System Checkpoint
    RP84: 10/16/2009 1:37:00 AM - Software Distribution Service 3.0
    RP85: 10/17/2009 2:18:42 AM - System Checkpoint
    RP86: 10/17/2009 8:35:38 AM - Avg8 Update
    RP87: 10/18/2009 10:29:32 AM - System Checkpoint
    RP88: 10/19/2009 11:27:18 AM - System Checkpoint
    RP89: 10/20/2009 2:22:40 AM - Software Distribution Service 3.0
    RP90: 10/21/2009 8:25:03 AM - System Checkpoint
    RP91: 10/21/2009 9:42:22 AM - Avg8 Update
    RP92: 10/22/2009 10:31:30 AM - System Checkpoint
    RP93: 10/23/2009 1:51:46 AM - Software Distribution Service 3.0
    RP94: 10/24/2009 1:57:44 AM - System Checkpoint
    RP95: 10/25/2009 2:03:04 AM - System Checkpoint
    RP96: 10/26/2009 3:03:16 AM - System Checkpoint
    RP97: 10/27/2009 1:51:58 AM - Software Distribution Service 3.0
    RP98: 10/28/2009 2:03:19 AM - System Checkpoint
    RP99: 10/29/2009 7:08:06 AM - System Checkpoint
    RP100: 10/30/2009 1:51:54 AM - Software Distribution Service 3.0
    RP101: 10/31/2009 9:22:24 AM - System Checkpoint
    RP102: 11/1/2009 9:56:14 AM - System Checkpoint
    RP103: 11/2/2009 9:57:53 AM - System Checkpoint
    RP104: 11/3/2009 2:47:26 AM - Software Distribution Service 3.0
    RP105: 11/3/2009 10:46:38 AM - Avg8 Update
    RP106: 11/4/2009 11:59:03 AM - System Checkpoint
    RP107: 11/5/2009 12:00:06 PM - System Checkpoint
    RP108: 11/6/2009 10:44:44 AM - Avg8 Update
    RP109: 11/7/2009 2:47:52 AM - Software Distribution Service 3.0
    RP110: 11/8/2009 2:03:12 AM - System Checkpoint
    RP111: 11/9/2009 3:03:56 AM - System Checkpoint
    RP112: 11/10/2009 1:42:42 AM - Software Distribution Service 3.0
    RP113: 11/11/2009 1:50:55 AM - System Checkpoint
    RP114: 11/12/2009 2:19:44 AM - System Checkpoint
    RP115: 11/13/2009 2:20:23 AM - System Checkpoint
    RP116: 11/13/2009 2:25:43 AM - Software Distribution Service 3.0
    RP117: 11/14/2009 3:22:20 AM - System Checkpoint
    RP118: 11/15/2009 4:25:12 AM - System Checkpoint
    RP119: 11/16/2009 4:44:51 AM - System Checkpoint
    RP120: 11/17/2009 2:17:45 AM - Software Distribution Service 3.0
    RP121: 11/18/2009 2:45:17 AM - System Checkpoint
    RP122: 11/19/2009 3:45:20 AM - System Checkpoint
    RP123: 11/20/2009 2:17:53 AM - Software Distribution Service 3.0
    RP124: 11/21/2009 2:46:52 AM - System Checkpoint
    RP125: 11/22/2009 3:26:07 AM - System Checkpoint
    RP126: 11/23/2009 6:03:21 AM - System Checkpoint
    RP127: 11/24/2009 2:26:49 AM - Software Distribution Service 3.0
    RP128: 11/25/2009 5:52:54 AM - System Checkpoint
    RP129: 11/26/2009 6:10:45 AM - System Checkpoint
    RP130: 11/26/2009 8:46:50 AM - Avg8 Update
    RP131: 11/27/2009 2:17:39 AM - Software Distribution Service 3.0
    RP132: 11/28/2009 2:23:14 AM - System Checkpoint
    RP133: 11/29/2009 2:24:33 AM - System Checkpoint
    RP134: 11/30/2009 2:27:18 AM - System Checkpoint
    RP135: 12/1/2009 2:12:39 AM - Software Distribution Service 3.0
    RP136: 12/2/2009 2:27:59 AM - System Checkpoint
    RP137: 12/3/2009 3:27:59 AM - System Checkpoint
    RP138: 12/4/2009 2:18:38 AM - Software Distribution Service 3.0
    RP139: 12/5/2009 2:31:13 AM - System Checkpoint
    RP140: 12/6/2009 2:31:46 AM - System Checkpoint
    RP141: 12/7/2009 2:32:18 AM - System Checkpoint
    RP142: 12/8/2009 2:18:45 AM - Software Distribution Service 3.0
    RP143: 12/9/2009 2:32:30 AM - System Checkpoint
    RP144: 12/9/2009 8:16:45 AM - Avg8 Update
    RP145: 12/10/2009 8:32:29 AM - System Checkpoint
    RP146: 12/17/2009 9:45:10 AM - Avg8 Update
    RP147: 12/17/2009 9:46:11 AM - Avg8 Update
    RP148: 12/17/2009 10:03:34 AM - Software Distribution Service 3.0
    RP149: 12/22/2009 6:20:09 PM - Avg8 Update
    RP150: 12/22/2009 6:37:48 PM - Software Distribution Service 3.0
    RP151: 12/23/2009 7:21:55 PM - System Checkpoint
    RP152: 12/24/2009 7:22:51 PM - System Checkpoint
    RP153: 12/25/2009 2:26:51 AM - Software Distribution Service 3.0
    RP154: 12/27/2009 10:36:22 AM - System Checkpoint
    RP155: 12/31/2009 6:22:00 PM - Avg8 Update
    RP156: 12/31/2009 6:40:06 PM - Software Distribution Service 3.0
    RP157: 1/1/2010 6:57:58 PM - System Checkpoint
    RP158: 1/2/2010 7:34:29 PM - System Checkpoint
    RP159: 1/3/2010 9:45:15 PM - System Checkpoint
    RP160: 1/4/2010 9:47:05 AM - Avg8 Update
    RP161: 1/5/2010 2:07:07 AM - Software Distribution Service 3.0
    RP162: 1/6/2010 2:34:35 AM - System Checkpoint
    RP163: 1/7/2010 3:47:34 AM - System Checkpoint
    RP164: 1/8/2010 2:06:28 AM - Software Distribution Service 3.0
    RP165: 1/9/2010 2:35:08 AM - System Checkpoint
    RP166: 1/10/2010 3:34:54 AM - System Checkpoint
    RP167: 1/10/2010 11:38:44 AM - Revo Uninstaller's restore point - SoftwareClub Audio Converter Extractor Max 1.0.0.0
    RP168: 1/10/2010 11:50:16 AM - Revo Uninstaller's restore point - RelevantKnowledge
    RP169: 1/10/2010 3:56:05 PM - Revo Uninstaller's restore point - MixSense 1.0.1
    RP170: 1/11/2010 1:54:52 PM - Restore Operation
    RP171: 1/11/2010 2:04:04 PM - Avg8 Update
    RP172: 1/11/2010 2:30:54 PM - Restore Operation
    RP173: 1/11/2010 11:44:52 PM - Restore Operation
    RP174: 1/12/2010 10:34:23 AM - Restore Operation

    ==== Installed Programs ======================

    1000Tour
    1200
    1200_Help
    1200Trb
    2x1/4x1 USB Peripheral Switch
    Acoustica Effects Pack
    Acoustica Mixcraft 4.1
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 7.0.9
    Adobe Shockwave Player
    Agere Systems PCI-SV92PP Soft Modem
    AIM 6
    AiO_Scan
    AiO_Scan_CDA
    AiOSoftware
    AiOSoftwareNPI
    AnalogX Vocal Remover
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI - Software Uninstall Utility
    ATI Control Panel
    ATI Display Driver
    Audacity 1.2.6
    AutoUpdate
    AVG Free 8.5
    Barnyard Invasion from HP Media Center (remove only)
    Bonjour
    Boris Graffiti
    BufferChm
    CameraDrivers
    CCleaner (remove only)
    Click'N Design 3D (V5)
    CP_AtenaShokunin1Config
    CP_CalendarTemplates1
    cp_LightScribeConfig
    cp_LightScribePlugin
    CP_Package_Basic1
    CP_Package_Variety1
    CP_Package_Variety2
    CP_Package_Variety3
    CP_Panorama1Config
    Creative WebCam Live! Driver (1.02.03.0606)
    Creative WebCam Live! User's Guide (English)
    CueTour
    Customer Experience Enhancement
    Destinations
    DeviceManagementQFolder
    DiscAPI (Studio 10)
    DISCover
    DivX Content Uploader
    DivX Converter
    DocProc
    DocumentViewer
    DocumentViewerQFolder
    Fax
    Fax_CDA
    Form Workshop 500
    FrostWire 4.18.3
    FXCM Trading Station II
    GemMaster Mystic
    GIMP 2.6.7
    Google Earth
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB954708)
    HP Boot Optimizer
    HP Deskjet Printer Preload
    HP DigitalMedia Archive
    HP Document Viewer 5.3
    HP Game Console and games
    HP Image Zone 5.3
    HP Image Zone for Media Center PC
    HP Imaging Device Functions 5.3
    HP Multimedia Keyboard Software
    HP Photosmart 330,380,420,470,7800,8000,8200 Series
    HP Photosmart Cameras 5.0
    HP PSC & OfficeJet 5.3.A
    HP PSC & OfficeJet 5.3.B
    HP Software Update
    HP Solution Center & Imaging Support Tools 5.3
    HPProductAssistant
    HpSdpAppCoreApp
    InstantShareDevices
    InterVideo WinDVD Player
    iTunes
    J2SE Runtime Environment 5.0 Update 5
    Java(TM) 6 Update 7
    Junk Mail filter update
    KeyScrambler
    Languages of the World
    LightScribe 1.4.52.1
    MadTracker 2
    Magic Bullet Looks Studio
    MAGIX Music Manager (US)
    MAGIX Photo Manager (US)
    MAGIX Ringtone Maker 2 (US)
    Mah Jong Quest from HP Media Center (remove only)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Easy Assist v2
    Microsoft English TTS Engine
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Money 2005
    Microsoft Office 2003 Edition 60 Days Trial Welcome Tour
    Microsoft Office Live Add-in 1.3
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft WinUsb 1.0
    Microsoft Works
    Microsoft XML Parser
    Morpheus Photo Mixer v3.10
    Mozilla Firefox (3.0.17)
    MSVCRT
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 6.0 Parser (KB933579)
    muvee autoProducer 4.5
    muvee autoProducer unPlugged 1.2
    NETGEAR WPN111 Smart Wizard Wireless Utility
    NewCopy
    NewCopy_CDA
    PanoStandAlone
    PCsync
    PhotoGallery
    Pinnacle Hollywood FX for Studio
    Pinnacle Instant DVD Recorder
    Pinnacle Studio 12
    Pinnacle Studio 12 Ultimate Plugins
    proDAD Heroglyph 2.0
    proDAD Vitascene 1.0
    ProductContext
    PS2
    PSPrinters08
    PSTAPlugin
    Python 2.2 pywin32 extensions (build 203)
    Python 2.2.3
    Quicken 2006
    QuickTime
    RandMap
    RAPID (Studio 10)
    Readme
    RealPlayer
    Remove IntelliMover Demo
    Revo Uninstaller 1.85
    Rhapsody Player Engine
    Riding Star
    Roll
    SAPI Wrapper
    Scan
    ScannerCopy
    Security Update for CAPICOM (KB931906)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 8 (KB969897)
    Segoe UI
    SightSpeed (remove only)
    SkinsHP1
    SmartSound Quicktracks Plugin
    SolutionCenter
    Sonic Express Labeler
    Sonic MyDVD Plus
    Sonic RecordNow Audio
    Sonic RecordNow Copy
    Sonic RecordNow Data
    Sonic Update Manager
    Sonic_PrimoSDK
    Spybot - Search & Destroy
    Status
    Studio 10
    Studio 10 Bonus DVD
    StyleXP (remove only)
    SureThing Express Labeler
    TrayApp
    TTS Wrapper
    Tunatic
    Unload
    Update for Windows Internet Explorer 8 (KB971180)
    Updates from HP (remove only)
    Viewpoint Media Player
    WebFldrs XP
    WebReg
    Windows Defender
    Windows Easy Transfer
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live Mail
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Presentation Foundation
    Windows Resource Kit Tools - SubInAcl.exe
    Windows XP Service Pack 3
    XML Paper Specification Shared Components Pack 1.0
    Yahoo! Browser Services
    Yahoo! Install Manager
    Yahoo! Internet Mail
    Yahoo! Messenger
    Yahoo! Toolbar
    Zoo Tycoon: Complete Collection

    ==== Event Viewer Messages From Past Week ========

    1/7/2010 1:17:16 AM, error: ati2mtag [45062] - CRT invalid display type
    1/12/2010 6:00:51 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
    1/12/2010 5:42:08 PM, error: Dhcp [1002] - The IP address lease 192.168.1.3 for the Network Card with network address 0013D3DA856C has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
    1/12/2010 12:03:39 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    1/12/2010 12:01:14 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK8 AvgLdx86 AvgMfx86 Fips PCLEPCI StyleXPHelper
    1/12/2010 12:00:12 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    1/12/2010 10:42:24 AM, error: WinDefend [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.71.2030.0 Loading engine version: 1.1.5302.0
    1/11/2010 7:39:34 PM, error: Service Control Manager [7034] - The StyleXPService service terminated unexpectedly. It has done this 1 time(s).
    1/11/2010 6:55:24 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    1/11/2010 2:37:40 PM, error: WinDefend [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.71.1885.0 Loading engine version: 1.1.5302.0
    1/11/2010 2:01:44 PM, error: WinDefend [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.71.1885.0 Loading engine version: 1.1.5302.0
    1/11/2010 11:54:57 PM, error: WinDefend [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.71.1885.0 Loading engine version: 1.1.5302.0
    1/10/2010 11:29:25 AM, error: Service Control Manager [7000] - The Viewpoint Manager Service service failed to start due to the following error: Access is denied.

    ==== End Of File ===========================

    Broni, I'll start on your instructions next.
     
    CRJ,
    #5
  7. 2010/01/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Disregard my previous post, since you're able to run DDS.

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.


    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Please, never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE. If Combofix asks you to install Recovery Console, please allow it.

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!


    Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Installer under Version 2.0.2
    [DO NOT download version 2.0.3 (beta)]
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator
     
    broni,
    #6
  8. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Broni, I will begin your Combo fix instructions first thing in the morning. (Been battling this nearly 20 hours now and yet to sleep.) In the meantime, HouseCall was able to finish a full scan. It came up with the following one file:

    File: A0023951.exe
    Threat: TROJ_Generic.DIT
    Type: Generic
    Risk: -- (2 out of 3 bars)

    Is it just coincidental that this thing is called GENERIC?

    ETA: Just answered my own question. Fixed in TrendMicro, rebooted, same win32 error message.
     
    Last edited: 2010/01/13
    CRJ,
    #7
  9. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Ok, here's where I'm at. I began the ComboFix process. Couldn't get into AVG or Windows Firewall to disable -- it said something about the service not being running and asked if I wanted to start. I clicked yes, it said the service could not be started. I uninstalled AVG since I plan to put on a new AV anyway. Rebooted, and... no win32 message! I recalled reading a post that said even after it's removed, the error message will show up one final time since it's related to the previous startup.

    Anyway, I continued on just to be sure. Windows Firewall became accessible. I disabled everything as instructed, began the scan. ComboFix deleted a few files, and then rebooted my computer, reached "Preparing Log Report. Do not run any programs until ComboFix has finished." when a new error popped up, which reads as follows:

    "Windows - No Disk, Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c "

    Options are Cancel, Try Again, Continue.
     
    CRJ,
    #8
  10. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    ComboFix

    Ok, ComboFix failed to finish after the No Disk error. "Try again" and "continue" just kept bringing up the error. Finally chose cancel and started ComboFix again, which finished this time, however didn't reboot? Here is the log. HJT log to follow.

    ComboFix 10-01-12.05 - HP_Administrator 01/13/2010 10:49:47.2.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.555 [GMT -5:00]
    Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
    FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    c:\windows\kb913800.exe
    c:\windows\system32\ps2.bat
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2009-12-13 to 2010-01-13 )))))))))))))))))))))))))))))))
    .

    2010-01-12 15:40 . 2010-01-12 15:40 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-01-10 19:47 . 2010-01-12 15:39 -------- d-----w- c:\program files\iPod
    2010-01-10 19:47 . 2010-01-10 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2010-01-10 19:45 . 2010-01-12 15:40 -------- d-----w- c:\documents and settings\All Users\Application Data\MP3 Remix
    2010-01-10 19:31 . 2010-01-12 15:38 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Mixxx
    2010-01-10 19:30 . 2010-01-10 19:30 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
    2010-01-10 19:21 . 2010-01-12 15:38 -------- d-----w- c:\program files\Free Offers from Freeze.com
    2010-01-03 15:46 . 1996-06-27 13:54 26144 ----a-w- c:\windows\system\LAUNCH16.DLL
    2010-01-03 15:46 . 1996-06-27 13:54 35840 ----a-w- c:\windows\system\LAUNCH32.DLL
    2010-01-03 15:46 . 2010-01-12 15:38 -------- d-----w- C:\WISHBONE
    2010-01-01 22:55 . 2010-01-01 23:01 -------- d-----w- C:\Pepper
    2010-01-01 22:54 . 2010-01-01 22:54 -------- d-----w- C:\SIERRA

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-01-13 14:46 . 2009-06-21 18:04 -------- d-----w- c:\program files\AVG
    2010-01-12 18:37 . 2006-10-30 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-01-12 15:43 . 2005-11-30 10:38 151096 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-01-12 15:40 . 2010-01-11 03:10 -------- d-----w- c:\program files\Acoustica Mixcraft 4
    2010-01-12 15:40 . 2010-01-11 14:38 -------- d-----w- c:\program files\Audacity
    2010-01-12 15:40 . 2010-01-12 15:40 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Acoustica
    2010-01-12 15:40 . 2010-01-11 03:10 -------- d-----w- c:\program files\Acoustica Shared Effects
    2010-01-12 15:40 . 2006-10-13 01:50 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Apple Computer
    2010-01-12 15:40 . 2010-01-10 20:53 -------- d-----w- c:\program files\MadTracker
    2010-01-12 15:39 . 2006-10-13 01:49 -------- d-----w- c:\program files\iTunes
    2010-01-12 15:39 . 2009-06-25 04:06 -------- d-----w- c:\program files\Common Files\Apple
    2010-01-12 15:39 . 2009-06-25 04:09 -------- d-----w- c:\program files\QuickTime
    2010-01-12 15:38 . 2008-07-22 19:08 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\GetRightToGo
    2010-01-11 03:10 . 2010-01-11 03:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Acoustica
    2010-01-10 16:24 . 2009-10-03 20:07 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\FrostWire
    2010-01-05 04:53 . 2006-01-22 17:39 16874 ----a-w- c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
    2009-12-23 01:24 . 2006-07-31 17:15 -------- d-----w- c:\program files\Mp3 My Mp3 2.0
    2009-11-03 01:42 . 2009-10-03 05:32 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-11-01 01:50 . 2009-11-01 01:47 59 ----a-w- C:\PANCD.BAT
    2008-11-23 05:09 . 2008-11-23 05:09 22 --sha-w- c:\windows\SMINST\HPCD.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "updateMgr "= "c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
    "PinnacleDriverCheck "= "c:\windows\system32\\PSDrvCheck.exe" [2004-03-11 406016]
    "PD0630 STISvc "= "P0630Pin.dll" [2005-06-05 36864]
    "SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

    c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
    wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    F1U201.401.lnk - c:\program files\Belkin\F1U201.401\usbshare.exe [2006-1-27 135168]
    NETGEAR WPN111 Smart Wizard.lnk - c:\program files\NETGEAR\WPN111 Configuration Utility\wpn111.exe [2007-10-14 491606]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @= "Service "

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
    backup=c:\windows\pss\Google Updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
    backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
    backup=c:\windows\pss\Kodak software updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
    backup=c:\windows\pss\Updates from HP.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^wkcalrem.LNK]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\wkcalrem.LNK
    backup=c:\windows\pss\wkcalrem.LNKStartup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASM
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EmailScan
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
    2005-08-03 00:19 77312 ----a-w- c:\windows\arpwrmsg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
    2004-07-18 05:10 339968 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
    2006-04-12 01:43 1073152 ----a-w- c:\program files\DISC\DISCover.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
    2005-09-27 00:42 61440 ----a-w- c:\program files\DISC\DISCUpdateMgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    2005-08-05 21:56 64512 ----a-w- c:\windows\ehome\ehtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2005-05-12 07:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
    2005-09-21 10:41 1605740 ----a-w- c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
    2005-06-01 23:35 49152 ----a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2006-10-04 00:03 185784 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "ATI Smart "=2 (0x2)
    "Ati HotKey Poller "=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=

    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [9/18/2009 4:03 PM 54752]
    R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]
    R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [10/1/2007 10:49 AM 113896]
    S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [9/28/2008 10:49 AM 24652]
    S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\drivers\athwpn.sys [10/14/2007 6:40 PM 43392]
    S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [10/14/2007 6:40 PM 17149]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 9:48 PM 704864]
    S3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [12/9/2006 9:11 PM 91841]
    S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\drivers\WPN111.sys [10/14/2007 6:40 PM 286720]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

    2010-01-13 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
    .
    .
    ------- Supplementary Scan -------
    .
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uStart Page = hxxp://www.yahoo.com/
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    Trusted Zone: jetblue.com\www
    Trusted Zone: yahoo.com\us.mg3.mail
    Trusted Zone: youtube.com\www
    FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\9jsma66v.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
    MSConfigStartUp-AOLSPScheduler - c:\program files\Common Files\AOL\1137965914\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-01-13 10:56
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(736)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(700)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2010-01-13 11:00:30
    ComboFix-quarantined-files.txt 2010-01-13 16:00

    Pre-Run: 28,980,076,544 bytes free
    Post-Run: 28,922,335,232 bytes free

    - - End Of File - - BADE2EF790E378BF2852970C5811BBCA
     
    CRJ,
    #9
  11. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    HJT Log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:42:35 AM, on 1/13/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\agrsmsvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - N:\CLEANS~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - S-1-5-18 Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: F1U201.401.lnk = ?
    O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
    O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - N:\CLEANS~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - N:\CLEANS~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.youtube.com
    O16 - DPF: {26522409-8BBF-4C5B-A4D3-CF4B1D6F255B} - http://www.umediaserver.net/bin/UMediaControl5.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk2/downloads/sysinfo.cab
    O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com.../en/x86/MuCatalogWebControl.cab?1230509302140
    O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229871112062
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263337063359
    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 10436 bytes
     
    CRJ,
    #10
  12. 2010/01/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    broni,
    #11
  13. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Ran both removal tools. AVG found nothing, assuming because I uninstalled with Revo Uninstaller. Norton leftovers were from years ago, so that ran normally. Restarted, without the last Windows error appearing. Began ComboFix again, and made it to "Completed Stage_3" when this new Windows error appeared:

    "Windows - Application Error, The exception Privileged instruction.
    (0xc0000096) occurred in the application at location 0x00390199.

    Click on OK to terminate the program
    Click on CANCEL to debug the program "

    I haven't touched it yet, since ComboFix still seems to be running the background so far -- on Stage_32 right now. I will post the logs if I get through it.

    I also apologize for the numerous posts. I'm going back and forth between separate laptop and the infected computer, and my previous posts haven't shown up yet, otherwise I'd simply edit with the new info.
     
    CRJ,
    #12
  14. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Fresh logs after AVG/Norton removal tools

    Here are the new logs. The Windows Application error disappeared on it's own when ComboFix finished.

    ComboFix:

    ComboFix 10-01-12.05 - HP_Administrator 01/13/2010 12:21:52.3.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.587 [GMT -5:00]
    Running from: c:\documents and settings\HP_Administrator\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((( Files Created from 2009-12-13 to 2010-01-13 )))))))))))))))))))))))))))))))
    .

    2010-01-12 15:40 . 2010-01-12 15:40 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-01-10 19:47 . 2010-01-12 15:39 -------- d-----w- c:\program files\iPod
    2010-01-10 19:47 . 2010-01-10 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2010-01-10 19:45 . 2010-01-12 15:40 -------- d-----w- c:\documents and settings\All Users\Application Data\MP3 Remix
    2010-01-10 19:31 . 2010-01-12 15:38 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Mixxx
    2010-01-10 19:30 . 2010-01-10 19:30 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
    2010-01-10 19:21 . 2010-01-12 15:38 -------- d-----w- c:\program files\Free Offers from Freeze.com
    2010-01-03 15:46 . 1996-06-27 13:54 26144 ----a-w- c:\windows\system\LAUNCH16.DLL
    2010-01-03 15:46 . 1996-06-27 13:54 35840 ----a-w- c:\windows\system\LAUNCH32.DLL
    2010-01-03 15:46 . 2010-01-12 15:38 -------- d-----w- C:\WISHBONE
    2010-01-01 22:55 . 2010-01-01 23:01 -------- d-----w- C:\Pepper
    2010-01-01 22:54 . 2010-01-01 22:54 -------- d-----w- C:\SIERRA

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-01-13 16:42 . 2010-01-13 16:42 -------- d-----w- c:\program files\Trend Micro
    2010-01-12 18:37 . 2006-10-30 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-01-12 15:43 . 2005-11-30 10:38 151096 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-01-12 15:40 . 2010-01-11 03:10 -------- d-----w- c:\program files\Acoustica Mixcraft 4
    2010-01-12 15:40 . 2010-01-11 14:38 -------- d-----w- c:\program files\Audacity
    2010-01-12 15:40 . 2010-01-12 15:40 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Acoustica
    2010-01-12 15:40 . 2010-01-11 03:10 -------- d-----w- c:\program files\Acoustica Shared Effects
    2010-01-12 15:40 . 2006-10-13 01:50 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Apple Computer
    2010-01-12 15:40 . 2010-01-10 20:53 -------- d-----w- c:\program files\MadTracker
    2010-01-12 15:39 . 2006-10-13 01:49 -------- d-----w- c:\program files\iTunes
    2010-01-12 15:39 . 2009-06-25 04:06 -------- d-----w- c:\program files\Common Files\Apple
    2010-01-12 15:39 . 2009-06-25 04:09 -------- d-----w- c:\program files\QuickTime
    2010-01-12 15:38 . 2008-07-22 19:08 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\GetRightToGo
    2010-01-11 03:10 . 2010-01-11 03:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Acoustica
    2010-01-10 16:24 . 2009-10-03 20:07 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\FrostWire
    2010-01-05 04:53 . 2006-01-22 17:39 16874 ----a-w- c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
    2009-12-23 01:24 . 2006-07-31 17:15 -------- d-----w- c:\program files\Mp3 My Mp3 2.0
    2009-11-03 01:42 . 2009-10-03 05:32 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-11-01 01:50 . 2009-11-01 01:47 59 ----a-w- C:\PANCD.BAT
    2008-11-23 05:09 . 2008-11-23 05:09 22 --sha-w- c:\windows\SMINST\HPCD.sys
    .

    ((((((((((((((((((((((((((((( SnapShot@2010-01-13_15.57.01 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2005-08-31 05:07 . 2010-01-13 15:18 83856 c:\windows\system32\perfc009.dat
    + 2005-08-31 05:07 . 2010-01-13 17:24 83856 c:\windows\system32\perfc009.dat
    + 2005-08-31 05:07 . 2010-01-13 17:24 469276 c:\windows\system32\perfh009.dat
    - 2005-08-31 05:07 . 2010-01-13 15:18 469276 c:\windows\system32\perfh009.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "updateMgr "= "c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender "= "c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
    "PinnacleDriverCheck "= "c:\windows\system32\\PSDrvCheck.exe" [2004-03-11 406016]
    "PD0630 STISvc "= "P0630Pin.dll" [2005-06-05 36864]
    "SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

    c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
    wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    F1U201.401.lnk - c:\program files\Belkin\F1U201.401\usbshare.exe [2006-1-27 135168]
    NETGEAR WPN111 Smart Wizard.lnk - c:\program files\NETGEAR\WPN111 Configuration Utility\wpn111.exe [2007-10-14 491606]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @= "Service "

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
    backup=c:\windows\pss\Google Updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
    backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk
    backup=c:\windows\pss\Kodak software updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
    backup=c:\windows\pss\Updates from HP.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^wkcalrem.LNK]
    path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\wkcalrem.LNK
    backup=c:\windows\pss\wkcalrem.LNKStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
    2005-08-03 00:19 77312 ----a-w- c:\windows\arpwrmsg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
    2004-07-18 05:10 339968 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
    2006-04-12 01:43 1073152 ----a-w- c:\program files\DISC\DISCover.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
    2005-09-27 00:42 61440 ----a-w- c:\program files\DISC\DISCUpdateMgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    2005-08-05 21:56 64512 ----a-w- c:\windows\ehome\ehtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2005-05-12 07:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
    2005-09-21 10:41 1605740 ----a-w- c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
    2005-06-01 23:35 49152 ----a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2006-10-04 00:03 185784 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "ATI Smart "=2 (0x2)
    "Ati HotKey Poller "=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=

    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [9/18/2009 4:03 PM 54752]
    R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]
    R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [10/1/2007 10:49 AM 113896]
    S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [9/28/2008 10:49 AM 24652]
    S3 ATHFMWDL;NETGEAR WPN111 Bootloader driver;c:\windows\system32\drivers\athwpn.sys [10/14/2007 6:40 PM 43392]
    S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [10/14/2007 6:40 PM 17149]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [8/5/2009 9:48 PM 704864]
    S3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [12/9/2006 9:11 PM 91841]
    S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\drivers\WPN111.sys [10/14/2007 6:40 PM 286720]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

    2010-01-13 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
    .
    .
    ------- Supplementary Scan -------
    .
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uStart Page = hxxp://www.yahoo.com/
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    Trusted Zone: jetblue.com\www
    Trusted Zone: yahoo.com\us.mg3.mail
    Trusted Zone: youtube.com\www
    FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\9jsma66v.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-01-13 12:30
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(732)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(372)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2010-01-13 12:33:55
    ComboFix-quarantined-files.txt 2010-01-13 17:33
    ComboFix2.txt 2010-01-13 16:00

    Pre-Run: 29,112,860,672 bytes free
    Post-Run: 29,073,309,696 bytes free

    - - End Of File - - 120F04A30B534D97C416B29798FA4554

    HJT:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:34:42 PM, on 1/13/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\agrsmsvc.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\NETGEAR\WPN111 Configuration Utility\wpn111.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - N:\CLEANS~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
    O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O4 - S-1-5-18 Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe (User 'SYSTEM')
    O4 - .DEFAULT Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: F1U201.401.lnk = ?
    O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
    O9 - Extra 'Tools' menuitem: &KeyScrambler... - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - N:\CLEANS~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - N:\CLEANS~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://www.youtube.com
    O16 - DPF: {26522409-8BBF-4C5B-A4D3-CF4B1D6F255B} - http://www.umediaserver.net/bin/UMediaControl5.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqnbk2/downloads/sysinfo.cab
    O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com.../en/x86/MuCatalogWebControl.cab?1230509302140
    O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229871112062
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263337063359
    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 10226 bytes
     
    CRJ,
    #13
  15. 2010/01/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Don't worry about it at all :)

    As for the error...thanks for letting me know...keep me updated on those, but we'll worry about it, if it's still there after your computer is declared clean.

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start> "Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall "
    Restart computer.

    Delete following file (unless, you're familiar with it):
    - C:\PANCD.BAT

    Now, download and install one of these:

    - Avira free antivirus: http://www.free-av.com/en/download/1/avira_antivir_personal__free_antivirus.html
    - Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html

    - free Comodo Internet Security (firewall + AV): http://www.personalfirewall.comodo.com/
    NOTE. During installation, Comodo will also allow you to install AV only, or firewall only, if you prefer to combine one Comodo product with some other product.

    If you decide to install Avast, or Avira, make sure, Windows firewall is turned on, or use Comodo firewall..
    If you decide to install Comodo Internet Security, or just Comodo firewall, make sure, Windows firewall is turned off.

    IMPORTANT! Make sure, you use only ONE antivirus, and ONE firewall.

    After installation, update the program and run full scan.

    Let me know, when you're done and if anything was found.
     
    broni,
    #14
  16. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Ok. PANCD is just a computer game. I'm holed up with a broken hip, so I've been living off computer games and music software.

    I uninstalled Combofix and rebooted. Sad to report I got the Generic win32 error back upon restart. Just when I thought HouseCall nabbed it. :mad:

    Installed Avira, which is the AV I was going to go with anyway. Ran full scan, and it found the following:

    cc_20090621_142852.reg -- HEUR/HTML.Malware
    KillIt.exe -- APPL/KillApp.A
    KillWind.exe -- APPL/KillApplicat.A
    A0023330.dll -- ADSPY/AdSpy.Gen
    A0023331.dll -- ADSPY/AdSpy.Gen
    A0023332.exe -- ADSPY/AdSpy.Gen
    A0023962.dll -- ADSPY/AdSpy.Gen
    A0023963.dll -- ADSPY/AdSpy.Gen
    A0024897.exe -- ADSPY/AdSpy.Gen
    A0024904.exe -- HEUR/Malware
    A0029783.exe -- ADSPY/AdSpy.Gen
    A0029790.exe -- HEUR/Malware
    A0030536.exe -- ADSPY/AdSpy.Gen
    A0031320.exe -- ADSPY/AdSpy.Gen
    A0031327.exe -- HEUR/Malware
    A0034240.exe -- HEUR/Malware
    A0034242.exe -- ADSPY/AdSpy.Gen

    Repair all?
     
    CRJ,
    #15
  17. 2010/01/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I'm sorry about your illness :(

    Surely, fix all those.

    That error is not necessary linked to an infection, but we'll see, when we're done with cleaning.

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3.
    Post fresh HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #16
  18. 2010/01/13
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Thanks, broni. I'll get to this right now.

    Is it ok that Avira only quarantined the files? Or is it supposed to delete them?
     
    CRJ,
    #17
  19. 2010/01/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Quarantine is simply a precaution (in case some good files was removed). If after running any AV, your computer is doing fine couple of days later, you can empty the vault. Those files are harmless, because they can do any damage from the vault.
     
    broni,
    #18
  20. 2010/01/14
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    SUPERantispyware

    Wow.. 19 hour scan, and it comes up with nothing.

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 01/14/2010 at 03:31 PM

    Application Version : 4.33.1000

    Core Rules Database Version : 4475
    Trace Rules Database Version: 2293

    Scan type : Complete Scan
    Total Scan Time : 18:41:35

    Memory items scanned : 241
    Memory threats detected : 0
    Registry items scanned : 6971
    Registry threats detected : 0
    File items scanned : 208548
    File threats detected : 0

    I really can't figure this out. This restart brought no Generic win32 message. :confused:
     
    CRJ,
    #19
  21. 2010/01/14
    CRJ

    CRJ Inactive Thread Starter

    Joined:
    2010/01/12
    Messages:
    26
    Likes Received:
    0
    Malwarebytes scan is currently running.

    Avira Antivir Guard just popped up with "Attention, Detection! A virus or unwanted program was found! What should happen with the file?

    C:\System Volume Information\...\A0035589.exe

    Contains recognition pattern of the APPL/KillApp.A application

    Options are:

    Move to quarantine, Delete, Rename, Deny access, Ignore. "

    What to do? :confused:
     
    CRJ,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...