Solved iexplore.exe multiple processes (keeps spawning)

Shima · 2009/12/08

[Resolved] iexplore.exe multiple processes (keeps spawning)

Running Windows XP and within 10 seconds of booting 2x iexplore.exe processes appear in the task manager, even if I have not opened a browser window. If I end either one of the processes, but disappear, only to be back in the process list again 10-20 seconds later.

If I let them hang around the number of iexplore.exe processes will jump up to 4, then one will end naturally, then a little later a fresh one will spawn again and so on. The number of processes hovers between 2 and 4 (3 and 5 if i actually have an IE window open)

I have tried AVG free version, Ad-aware free version, Spyware Doctor free version, Spybot search and destroy too - nothing picks anything up. I have tried googling for hours on end but you guys seem to be the only ones out there that seems to have a clue, so I was hoping you could help me.

I have tried this in safe mode too and the same behavior exists.

I have tried updating a lot of software, and upgraded from IE7 to IE 8 today. Somewhere along the line my automatic updates were turned off (i dont remember doing it), so I have 40 windows updates today too. I think I just made it worse.

Spybot search and destroy fails to run properly. Just winds up with another process in the list. The Mbam tool from your site also does the same thing!

Dont know if its related (I assume it is), but Spyware Doctor pops up with "A threat has been detected" every couple of minutes saying an application attempted to access a file "C:\windows\system32\H8SRTTIDCJIMMVU.DLL ", but this file does not exist.

I have run the dds.scr script and the following 2 replies to this thread are the results

Thanks in advance for any help you can provide
Paul aka Shima

Shima · 2009/12/08

DDS.txt
======

DDS (Ver_09-12-01.01) - NTFSx86
Run by Paul Ryan at 3:23:29.31 on Wed 09/12/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1524 [GMT 11:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Paul Ryan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.facebook.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\twext.exe,
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {07AA283A-43D7-4CBE-A064-32A21112D94D} - No File
TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [CurseClient] c:\program files\curse\CurseClient.exe -silent
uRun: [richtx64.exe] c:\docume~1\paulry~1\locals~1\temp\richtx64.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe "
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe "
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {F4430FE8-2638-42e5-B849-800749B94EED} - c:\program files\partygaming.net\partypokernet\RunPF.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1189955538984
DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.new.facebook.com/controls/contactx.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1189954458312
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-12-9 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-12-8 207792]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1184912]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-12-8 359624]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-12-8 1141712]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

=============== Created Last 30 ================

2009-12-08 16:20:17 15880 ----a-w- c:\windows\system32\lsdelete.exe
2009-12-08 15:55:06 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-12-08 15:51:17 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-12-08 15:51:06 0 d-----w- c:\program files\Lavasoft
2009-12-08 14:44:43 0 d-sh--w- c:\documents and settings\paul ryan\IECompatCache
2009-12-08 11:35:42 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-08 11:35:42 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-08 11:35:42 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-08 11:35:41 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-08 11:27:46 0 d-sh--w- c:\documents and settings\paul ryan\PrivacIE
2009-12-08 11:24:22 0 d-sh--w- c:\documents and settings\paul ryan\IETldCache
2009-12-08 11:20:45 0 d-----w- c:\windows\ie8updates
2009-12-08 11:20:42 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-12-08 11:19:12 0 dc-h--w- c:\windows\ie8
2009-12-08 11:01:03 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-12-08 10:46:17 0 d-----w- c:\windows\ServicePackFiles
2009-12-08 07:29:48 0 d-----w- C:\$AVG
2009-12-08 06:07:51 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat
2009-12-08 06:07:51 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-12-08 06:07:46 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-12-08 06:07:46 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat
2009-12-08 06:07:46 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-12-08 06:07:46 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-12-08 06:07:40 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat
2009-12-08 06:07:40 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-12-08 06:07:37 0 d-----w- c:\program files\Spyware Doctor
2009-12-08 06:07:37 0 d-----w- c:\program files\common files\PC Tools
2009-12-08 06:07:37 0 d-----w- c:\docume~1\paulry~1\applic~1\PC Tools
2009-12-08 06:07:37 0 d-----w- c:\docume~1\alluse~1\applic~1\PC Tools
2009-12-08 05:38:28 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
2009-12-08 05:38:18 0 d-----w- c:\windows\SxsCaPendDel
2009-12-08 05:09:18 194 ----a-w- c:\windows\system32\srcr.dat

==================== Find3M ====================

2009-09-30 04:34:52 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-25 16:41:28 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-09-25 16:41:26 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-09-25 16:41:26 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-09-25 16:41:26 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-09-25 16:41:26 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-09-25 16:41:26 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-09-25 16:41:26 696320 ----a-w- c:\windows\system32\DivX.dll

============= FINISH: 3:24:12.09 ===============

Shima · 2009/12/08

ATTACH.TXT
=========

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 30/08/2007 6:44:58 PM
System Uptime: 12/09/2009 2:56:05 AM (2113 hours ago)

Motherboard: MICRO-STAR INTERNATIONAL CO.,LTD | | MS-7345
Processor: Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz | CPU 1 | 2671/333mhz
Processor: Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz | CPU 1 | 2671/333mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 298 GiB total, 164.008 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP699: 10/09/2009 6:24:12 AM - System Checkpoint
RP700: 11/09/2009 7:12:43 AM - System Checkpoint
RP701: 12/09/2009 8:12:34 AM - System Checkpoint
RP702: 13/09/2009 9:13:39 AM - System Checkpoint
RP703: 14/09/2009 9:42:28 AM - System Checkpoint
RP704: 15/09/2009 10:10:19 AM - System Checkpoint
RP705: 16/09/2009 1:29:42 PM - System Checkpoint
RP706: 18/09/2009 6:11:11 AM - System Checkpoint
RP707: 19/09/2009 8:43:54 AM - System Checkpoint
RP708: 20/09/2009 9:26:54 AM - System Checkpoint
RP709: 21/09/2009 9:50:28 AM - System Checkpoint
RP710: 22/09/2009 10:17:11 AM - System Checkpoint
RP711: 23/09/2009 12:24:05 PM - System Checkpoint
RP712: 24/09/2009 6:28:31 PM - System Checkpoint
RP713: 25/09/2009 9:51:49 PM - System Checkpoint
RP714: 26/09/2009 10:38:45 PM - System Checkpoint
RP715: 27/09/2009 11:17:29 PM - System Checkpoint
RP716: 29/09/2009 3:15:29 AM - System Checkpoint
RP717: 30/09/2009 3:17:28 AM - System Checkpoint
RP718: 30/09/2009 2:34:46 PM - Installed Java(TM) 6 Update 16
RP719: 1/10/2009 4:54:15 PM - System Checkpoint
RP720: 2/10/2009 8:29:12 PM - System Checkpoint
RP721: 3/10/2009 9:16:59 PM - System Checkpoint
RP722: 4/10/2009 10:54:27 PM - System Checkpoint
RP723: 5/10/2009 11:17:00 PM - System Checkpoint
RP724: 7/10/2009 1:11:34 AM - System Checkpoint
RP725: 7/10/2009 9:21:12 AM - Avg8 Update
RP726: 7/10/2009 9:21:45 AM - Avg8 Update
RP727: 8/10/2009 8:58:22 AM - Avg8 Update
RP728: 9/10/2009 9:01:28 AM - System Checkpoint
RP729: 10/10/2009 9:25:16 AM - System Checkpoint
RP730: 11/10/2009 5:24:18 PM - System Checkpoint
RP731: 12/10/2009 6:35:37 PM - System Checkpoint
RP732: 13/10/2009 7:33:13 PM - System Checkpoint
RP733: 15/10/2009 1:40:29 AM - System Checkpoint
RP734: 16/10/2009 1:42:07 AM - System Checkpoint
RP735: 17/10/2009 2:16:15 AM - System Checkpoint
RP736: 17/10/2009 8:38:29 AM - Avg8 Update
RP737: 19/10/2009 1:22:37 AM - System Checkpoint
RP738: 20/10/2009 2:19:32 AM - System Checkpoint
RP739: 21/10/2009 6:41:54 AM - System Checkpoint
RP740: 21/10/2009 8:39:33 AM - Avg8 Update
RP741: 22/10/2009 1:22:35 PM - System Checkpoint
RP742: 23/10/2009 9:57:50 PM - System Checkpoint
RP743: 25/10/2009 2:01:17 AM - System Checkpoint
RP744: 26/10/2009 3:47:47 AM - System Checkpoint
RP745: 27/10/2009 4:11:52 AM - System Checkpoint
RP746: 28/10/2009 5:04:16 AM - System Checkpoint
RP747: 29/10/2009 5:38:10 AM - System Checkpoint
RP748: 30/10/2009 6:38:10 AM - System Checkpoint
RP749: 31/10/2009 7:38:29 AM - System Checkpoint
RP750: 1/11/2009 8:38:10 AM - System Checkpoint
RP751: 2/11/2009 9:38:10 AM - System Checkpoint
RP752: 3/11/2009 9:39:33 AM - Avg8 Update
RP753: 4/11/2009 10:38:10 AM - System Checkpoint
RP754: 5/11/2009 3:54:55 PM - System Checkpoint
RP755: 6/11/2009 4:18:42 PM - System Checkpoint
RP756: 7/11/2009 8:25:23 AM - Avg8 Update
RP757: 8/11/2009 3:25:18 PM - System Checkpoint
RP758: 9/11/2009 11:42:38 PM - System Checkpoint
RP759: 11/11/2009 1:27:11 AM - System Checkpoint
RP760: 12/11/2009 1:59:31 AM - System Checkpoint
RP761: 13/11/2009 3:33:01 PM - System Checkpoint
RP762: 14/11/2009 9:20:18 PM - System Checkpoint
RP763: 16/11/2009 2:59:33 AM - System Checkpoint
RP764: 17/11/2009 3:13:01 AM - System Checkpoint
RP765: 18/11/2009 4:04:59 AM - System Checkpoint
RP766: 19/11/2009 8:18:47 AM - System Checkpoint
RP767: 21/11/2009 10:43:41 AM - System Checkpoint
RP768: 22/11/2009 11:11:50 AM - System Checkpoint
RP769: 23/11/2009 1:16:35 PM - System Checkpoint
RP770: 24/11/2009 1:42:22 PM - System Checkpoint
RP771: 25/11/2009 1:46:09 PM - System Checkpoint
RP772: 26/11/2009 8:18:27 AM - Avg8 Update
RP773: 27/11/2009 8:26:58 AM - System Checkpoint
RP774: 28/11/2009 10:08:05 AM - System Checkpoint
RP775: 29/11/2009 11:38:51 PM - System Checkpoint
RP776: 1/12/2009 12:48:21 AM - System Checkpoint
RP777: 2/12/2009 5:09:19 AM - System Checkpoint
RP778: 3/12/2009 6:03:07 AM - System Checkpoint
RP779: 4/12/2009 10:45:04 AM - System Checkpoint
RP780: 5/12/2009 11:03:07 AM - System Checkpoint
RP781: 6/12/2009 12:21:14 PM - System Checkpoint
RP782: 7/12/2009 1:31:42 PM - System Checkpoint
RP783: 8/12/2009 10:31:32 PM - System Checkpoint

==== Installed Programs ======================

AAC Decoder
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Reader 7.0.7
Ahead InCD EasyWrite Reader
AutoUpdate
BitTorrent
Bonjour
Curse Client
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DNA
DVD Suite
e-tax 2008
e-tax 2009
FLV Player 2.0, build 24
H.264 Decoder
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB976098-v2)
Java(TM) 6 Update 16
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 1.1 SP1 with KB886903 Hotfix
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MKV Splitter
MSXML 6.0 Parser (KB933579)
Nero 6
Nero Media Player
NeroVision Express 2
NVIDIA Drivers
PowerDVD
PowerProducer
QuickTime
Real Alternative 1.7.5
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Spyware Doctor 7.0
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows XP (KB894391)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB973687)
VC80CRTRedist - 8.0.50727.4053
Ventrilo Client
WebFldrs XP
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinZip 12.1
World of Warcraft
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

9/12/2009 2:30:18 AM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 bfa7f976, parameter3 8a324980, parameter4 00000000.
9/12/2009 2:30:02 AM, error: System Error [1003] - Error code 00000071, parameter1 00000000, parameter2 00000000, parameter3 00000000, parameter4 00000000.
9/12/2009 12:44:43 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
9/12/2009 12:15:23 AM, error: DCOM [10000] - Unable to start a DCOM Server: {0002DF01-0000-0000-C000-000000000046}. The error: "%2" Happened while starting this command: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
9/12/2009 1:44:41 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments " " in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
8/12/2009 9:58:16 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 2.0 Service Pack 1 Security Update for Windows 2000, Windows Server 2003, and Windows XP (KB953300).
8/12/2009 8:58:19 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
8/12/2009 7:58:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
8/12/2009 7:43:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
8/12/2009 6:26:03 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
8/12/2009 6:26:03 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
8/12/2009 6:26:03 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/12/2009 6:26:03 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/12/2009 6:26:03 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
8/12/2009 6:26:03 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/12/2009 6:26:03 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
8/12/2009 6:16:31 PM, error: Service Control Manager [7034] - The Cyberlink RichVideo Service(CRVS) service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 6:16:23 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 6:16:13 PM, error: Service Control Manager [7034] - The Browser Defender Update Service service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 6:15:55 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 6:15:50 PM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 6:15:22 PM, error: Service Control Manager [7034] - The PC Tools Auxiliary Service service terminated unexpectedly. It has done this 1 time(s).
8/12/2009 11:01:05 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
8/12/2009 10:30:28 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
8/12/2009 10:30:28 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
8/12/2009 10:29:28 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
8/12/2009 10:26:21 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
8/12/2009 10:26:21 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/12/2009 10:25:40 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AVG Free WatchDog service to connect.
8/12/2009 10:25:40 PM, error: Service Control Manager [7000] - The AVG Free WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/12/2009 10:21:37 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Microsoft XML Core Services 6.0 Service Pack 2 (KB973686).
8/12/2009 10:21:28 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070652: Security Update for Microsoft Office Excel 2003 (KB955466).
8/12/2009 10:02:18 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft XML Core Services 6.0 Service Pack 2 (KB954459).

==== End Of File ===========================

Admin. · 2009/12/08

I see you have P2P software ( Limewire, BitTorrent, uTorrent etc… ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are here, and here.

I would strongly recommend that you uninstall them,

Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.

A Malware expert will have a look at your log in due course.

broni · 2009/12/08

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE. If Combofix asks you to install Recovery Console, please allow it.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator

Shima · 2009/12/09

Advice taken, and lesson learned. I have ununstalled BitTorrent.

Did you want me to post fresh logs to show this?

I'm having trouble running Combofix. It shows in the task manager but doesnt appear to do anything. I had switched off all anti-virus and anti-malware software, but didnt know how to turn off script blocking. Could this cause the problem?

broni · 2009/12/09

Stop Combofix through Task Manager and delete Combofix file.
I'm sending you PM.

Shima · 2009/12/10

Advice in PM taken and acted upon.

Please refer to PM for results and questions.

broni · 2009/12/10

Only download link was a secret. Combofix log is not, so please, paste the log right here.

Shima · 2009/12/10

Combofix.txt

ComboFix 09-12-09.04 - Paul Ryan 10/12/2009 18:18:01.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1752 [GMT 11:00]
Running from: c:\load-cf\8824\8824.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Paul Ryan\Application Data\wiaserva.log
c:\recycler\S-1-5-21-484763869-179605362-725345543-1003
c:\windows\system32\drivers\H8SRTnbtkvxyrav.sys
c:\windows\system32\h8srtcfg.dat
c:\windows\system32\H8SRTnfgnkjnefv.dat
c:\windows\system32\H8SRTtidcjiimvu.dll
c:\windows\system32\H8SRTxkerwxmgip.dll
c:\windows\system32\srcr.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys

((((((((((((((((((((((((( Files Created from 2009-11-10 to 2009-12-10 )))))))))))))))))))))))))))))))
.

2009-12-10 07:06 . 2009-12-10 07:06 -------- d-----w- C:\Load-CF
2009-12-09 07:41 . 2009-12-09 07:41 -------- d-----w- c:\program files\Trend Micro
2009-12-09 06:39 . 2009-10-29 07:45 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-12-09 06:39 . 2009-10-29 07:45 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-08 18:16 . 2009-12-08 18:16 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-12-08 18:16 . 2009-12-08 18:16 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2009-12-08 16:30 . 2009-12-08 16:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-08 16:30 . 2009-12-08 16:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-08 15:51 . 2009-12-10 04:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-12-08 14:44 . 2009-12-08 14:44 -------- d-sh--w- c:\documents and settings\Paul Ryan\IECompatCache
2009-12-08 11:35 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-08 11:35 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-08 11:35 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-08 11:35 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-08 11:28 . 2009-12-08 11:28 -------- d-----w- c:\documents and settings\Paul Ryan\Local Settings\Application Data\PCHealth
2009-12-08 11:27 . 2009-12-08 11:27 -------- d-sh--w- c:\documents and settings\Paul Ryan\PrivacIE
2009-12-08 11:26 . 2009-12-08 11:26 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-12-08 11:24 . 2009-12-08 11:24 -------- d-sh--w- c:\documents and settings\Paul Ryan\IETldCache
2009-12-08 11:20 . 2009-12-09 17:04 -------- d-----w- c:\windows\ie8updates
2009-12-08 11:20 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-12-08 11:19 . 2009-12-08 13:20 -------- dc-h--w- c:\windows\ie8
2009-12-08 11:01 . 2004-08-04 12:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-12-08 10:46 . 2009-12-08 10:46 -------- d-----w- c:\windows\ServicePackFiles
2009-12-08 09:00 . 2009-12-08 09:00 -------- d-----w- c:\documents and settings\Paul Ryan\Local Settings\Application Data\Threat Expert
2009-12-08 07:29 . 2009-12-08 15:25 -------- d-----w- C:\$AVG
2009-12-08 06:07 . 2009-10-30 00:11 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-12-08 06:07 . 2009-11-09 00:20 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-12-08 06:07 . 2009-10-06 05:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-12-08 06:07 . 2009-09-02 22:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-12-08 06:07 . 2009-12-10 07:05 -------- d-----w- c:\program files\Spyware Doctor
2009-12-08 06:07 . 2009-12-08 06:29 -------- d-----w- c:\program files\Common Files\PC Tools
2009-12-08 06:07 . 2009-12-08 06:07 -------- d-----w- c:\documents and settings\Paul Ryan\Application Data\PC Tools
2009-12-08 06:07 . 2009-12-08 06:07 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-12-08 06:07 . 2009-12-10 07:05 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-08 05:38 . 2009-12-08 15:25 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-08 05:38 . 2009-12-08 05:45 -------- d-----w- c:\windows\SxsCaPendDel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-10 02:26 . 2009-12-09 17:08 4904 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2009-12-09 10:42 . 2007-08-30 11:01 42168 ----a-w- c:\documents and settings\Paul Ryan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-09 10:25 . 2007-08-30 12:42 -------- d-----w- c:\program files\BitTorrent
2009-12-08 15:51 . 2009-06-19 00:06 -------- d-----w- c:\program files\Google
2009-12-08 15:32 . 2007-12-16 19:06 -------- d-----w- c:\program files\PartyGaming.Net
2009-12-08 13:45 . 2008-03-15 07:28 -------- d-----w- c:\program files\Yahoo!
2009-12-08 11:31 . 2007-09-21 21:45 -------- d-----w- c:\program files\chatClient
2009-12-08 11:29 . 2008-09-27 04:09 -------- d-----w- c:\program files\Common Files\Apple
2009-12-08 09:35 . 2008-05-27 03:35 -------- d-----w- c:\program files\AVG
2009-12-08 07:43 . 2007-08-30 12:42 -------- d-----w- c:\documents and settings\Paul Ryan\Application Data\BitTorrent
2009-11-06 16:30 . 2007-09-21 23:06 -------- d-----w- c:\program files\DivX
2009-11-06 16:30 . 2009-11-06 16:29 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-10-29 07:45 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-23 17:43 . 2009-10-23 17:43 -------- d-----w- c:\program files\Curse
2009-10-21 06:00 . 2006-02-28 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:00 . 2006-02-28 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 14:58 . 2006-02-28 12:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-14 04:48 . 2007-08-30 09:16 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-10-13 10:53 . 2006-02-28 12:00 266752 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:54 . 2006-02-28 12:00 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:54 . 2006-02-28 12:00 112128 ----a-w- c:\windows\system32\rastls.dll
2009-09-30 04:34 . 2009-09-30 04:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-30 04:34 . 2009-09-30 04:34 152576 ----a-w- c:\documents and settings\Paul Ryan\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-09-25 16:41 . 2009-09-25 16:41 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-09-25 16:41 . 2009-09-25 16:41 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-09-25 16:41 . 2009-09-25 16:41 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-09-25 16:41 . 2009-09-25 16:41 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-09-25 16:41 . 2009-09-25 16:41 696320 ----a-w- c:\windows\system32\DivX.dll
2009-09-11 14:33 . 2006-02-28 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CurseClient "= "c:\program files\Curse\CurseClient.exe -silent" [X]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe -atboottime" [X]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz "= "nwiz.exe" [2007-06-28 1626112]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"LanguageShortcut "= "c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"RTHDCPL "= "RTHDCPL.EXE" [2007-05-28 16132608]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-09-30 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Games\\World of Warcraft\\Repair.exe "=
"c:\\Games\\World of Warcraft\\BackgroundDownloader.exe "=
"c:\\Games\\World of Warcraft\\Launcher.exe "=
"c:\\Games\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe "=
"c:\\Program Files\\Curse\\CurseClient.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [8/12/2009 5:07 PM 207792]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [8/12/2009 5:07 PM 359624]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
AddRemove-BitTorrent DNA - c:\program files\DNA\btdna.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-10 18:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-12-10 18:25:10
ComboFix-quarantined-files.txt 2009-12-10 07:25

Pre-Run: 174,098,944,000 bytes free
Post-Run: 174,635,356,160 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 549D51988CB79E805F3795FE5F92B6C1

Shima · 2009/12/10

Hijackthis.log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:37:41 PM, on 10/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1189955538984
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.new.facebook.com/controls/contactx.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1189954458312
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 5858 bytes

broni · 2009/12/10

I don't see any AV program running. You said something about AVG, but I don't see it active. Explain, please.

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\system32\PerfStringBackup.TMP


Folder::

Driver::

Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

Shima · 2009/12/11

I was running AVG version 8.5 and it didnt pick anything up.

After looking at their website, I realised version 9 was available. I tried to install this version and the install failed. I removed AVG 8.5 to try and have a "clean" install, but version 9 failed to install again, hence why it is missing from my system.

I havent tried to reinstall it yet, since you havent given me the "officially clean" yet.

Combofix log:
ComboFix 09-12-09.04 - Paul Ryan 12/12/2009 3:35.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1633 [GMT 11:00]
Running from: c:\documents and settings\Paul Ryan\Desktop\8824.exe
Command switches used :: c:\documents and settings\Paul Ryan\Desktop\cfscript.txt

FILE ::
"c:\windows\system32\PerfStringBackup.TMP "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\PerfStringBackup.TMP

.
((((((((((((((((((((((((( Files Created from 2009-11-11 to 2009-12-11 )))))))))))))))))))))))))))))))
.

2009-12-10 07:06 . 2009-12-10 07:06 -------- d-----w- C:\Load-CF
2009-12-09 07:41 . 2009-12-09 07:41 -------- d-----w- c:\program files\Trend Micro
2009-12-09 06:39 . 2009-10-29 07:45 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-12-09 06:39 . 2009-10-29 07:45 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-08 18:16 . 2009-12-08 18:16 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-12-08 18:16 . 2009-12-08 18:16 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE
2009-12-08 16:30 . 2009-12-10 07:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-08 16:30 . 2009-12-10 07:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-08 15:51 . 2009-12-10 04:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-12-08 14:44 . 2009-12-08 14:44 -------- d-sh--w- c:\documents and settings\Paul Ryan\IECompatCache
2009-12-08 11:35 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-08 11:35 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-08 11:35 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-08 11:35 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-08 11:28 . 2009-12-08 11:28 -------- d-----w- c:\documents and settings\Paul Ryan\Local Settings\Application Data\PCHealth
2009-12-08 11:27 . 2009-12-08 11:27 -------- d-sh--w- c:\documents and settings\Paul Ryan\PrivacIE
2009-12-08 11:26 . 2009-12-08 11:26 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-12-08 11:24 . 2009-12-08 11:24 -------- d-sh--w- c:\documents and settings\Paul Ryan\IETldCache
2009-12-08 11:20 . 2009-12-09 17:04 -------- d-----w- c:\windows\ie8updates
2009-12-08 11:20 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-12-08 11:19 . 2009-12-08 13:20 -------- dc-h--w- c:\windows\ie8
2009-12-08 11:01 . 2004-08-04 12:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-12-08 10:46 . 2009-12-08 10:46 -------- d-----w- c:\windows\ServicePackFiles
2009-12-08 09:00 . 2009-12-08 09:00 -------- d-----w- c:\documents and settings\Paul Ryan\Local Settings\Application Data\Threat Expert
2009-12-08 07:29 . 2009-12-08 15:25 -------- d-----w- C:\$AVG
2009-12-08 06:07 . 2009-10-30 00:11 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-12-08 06:07 . 2009-11-09 00:20 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-12-08 06:07 . 2009-10-06 05:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-12-08 06:07 . 2009-09-02 22:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-12-08 06:07 . 2009-12-11 16:35 -------- d-----w- c:\program files\Spyware Doctor
2009-12-08 06:07 . 2009-12-08 06:29 -------- d-----w- c:\program files\Common Files\PC Tools
2009-12-08 06:07 . 2009-12-08 06:07 -------- d-----w- c:\documents and settings\Paul Ryan\Application Data\PC Tools
2009-12-08 06:07 . 2009-12-08 06:07 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-12-08 06:07 . 2009-12-11 16:25 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-08 05:38 . 2009-12-08 15:25 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2009-12-08 05:38 . 2009-12-08 05:45 -------- d-----w- c:\windows\SxsCaPendDel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-09 10:42 . 2007-08-30 11:01 42168 ----a-w- c:\documents and settings\Paul Ryan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-09 10:25 . 2007-08-30 12:42 -------- d-----w- c:\program files\BitTorrent
2009-12-08 15:51 . 2009-06-19 00:06 -------- d-----w- c:\program files\Google
2009-12-08 15:32 . 2007-12-16 19:06 -------- d-----w- c:\program files\PartyGaming.Net
2009-12-08 13:45 . 2008-03-15 07:28 -------- d-----w- c:\program files\Yahoo!
2009-12-08 11:31 . 2007-09-21 21:45 -------- d-----w- c:\program files\chatClient
2009-12-08 11:29 . 2008-09-27 04:09 -------- d-----w- c:\program files\Common Files\Apple
2009-12-08 09:35 . 2008-05-27 03:35 -------- d-----w- c:\program files\AVG
2009-12-08 07:43 . 2007-08-30 12:42 -------- d-----w- c:\documents and settings\Paul Ryan\Application Data\BitTorrent
2009-11-06 16:30 . 2007-09-21 23:06 -------- d-----w- c:\program files\DivX
2009-11-06 16:30 . 2009-11-06 16:29 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-10-29 07:45 . 2006-02-28 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-10-23 17:43 . 2009-10-23 17:43 -------- d-----w- c:\program files\Curse
2009-10-21 06:00 . 2006-02-28 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:00 . 2006-02-28 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 14:58 . 2006-02-28 12:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-14 04:48 . 2007-08-30 09:16 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-10-13 10:53 . 2006-02-28 12:00 266752 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:54 . 2006-02-28 12:00 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:54 . 2006-02-28 12:00 112128 ----a-w- c:\windows\system32\rastls.dll
2009-09-30 04:34 . 2009-09-30 04:35 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-30 04:34 . 2009-09-30 04:34 152576 ----a-w- c:\documents and settings\Paul Ryan\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-09-25 16:41 . 2009-09-25 16:41 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-09-25 16:41 . 2009-09-25 16:41 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-09-25 16:41 . 2009-09-25 16:41 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-09-25 16:41 . 2009-09-25 16:41 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-09-25 16:41 . 2009-09-25 16:41 696320 ----a-w- c:\windows\system32\DivX.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-12-10_07.24.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-11 02:38 . 2009-12-11 02:38 16384 c:\windows\Temp\Perflib_Perfdata_ec.dat
+ 2009-12-11 02:38 . 2009-12-11 02:38 16384 c:\windows\Temp\Perflib_Perfdata_204.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CurseClient "= "c:\program files\Curse\CurseClient.exe -silent" [X]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe -atboottime" [X]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"nwiz "= "nwiz.exe" [2007-06-28 1626112]
"RemoteControl "= "c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"LanguageShortcut "= "c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"RTHDCPL "= "RTHDCPL.EXE" [2007-05-28 16132608]
"NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-09-30 149280]
"ISTray "= "c:\program files\Spyware Doctor\pctsTray.exe" [2009-11-18 1243088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\system32\\dpvsetup.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Games\\World of Warcraft\\Repair.exe "=
"c:\\Games\\World of Warcraft\\BackgroundDownloader.exe "=
"c:\\Games\\World of Warcraft\\Launcher.exe "=
"c:\\Games\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe "=
"c:\\Program Files\\Curse\\CurseClient.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [8/12/2009 5:07 PM 207792]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [8/12/2009 5:07 PM 359624]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - PCTSDInjDriver32
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-12 03:39
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-12-12 03:40:49
ComboFix-quarantined-files.txt 2009-12-11 16:40
ComboFix2.txt 2009-12-10 07:25

Pre-Run: 174,553,755,648 bytes free
Post-Run: 174,557,327,360 bytes free

- - End Of File - - 257DBB65EBC3300C7254EB3F20EF98B8

Shima · 2009/12/11

Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:49:33 AM, on 12/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1189955538984
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.new.facebook.com/controls/contactx.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1189954458312
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 6045 bytes

broni · 2009/12/11

I havent tried to reinstall it yet, since you havent given me the "officially clean" yet.
Click to expand...

Very good.

How is the computer doing right now?

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Restart computer.

Now, you're ready to put some AV program on.
I suggest, you skip AVG. I stopped recommending it, starting with ver. 8.0
Run AVG Remover: http://www.avg.com/us-en/download-tools

Download and install one of these:

- Avira free antivirus: http://www.free-av.com/en/download/1/avira_antivir_personal__free_antivirus.html
- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html

- free Comodo Internet Security (firewall + AV): http://www.personalfirewall.comodo.com/
NOTE. During installation, Comodo will also allow you to install AV only, or firewall only, if you prefer to combine one Comodo product with some other product.

If you decide to install Avast, or Avira, make sure, Windows firewall is turned on, or use Comodo firewall..
If you decide to install Comodo Internet Security, or just Comodo firewall, make sure, Windows firewall is turned off.

IMPORTANT! Make sure, you use only ONE antivirus, and ONE firewall.

After installation, update the program and run full scan.

When done...

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Shima · 2009/12/11

"broni said: ↑

How is the computer doing right now?
Click to expand...

Much better - and thanks again for all the help so far.

No more rogue processes spawning, no more AVG. I have installed the applications recommended in your last post and removed Spyware Doctor too.

Logs to follow...

Shima · 2009/12/11

Superantispyware log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/12/2009 at 01:49 PM

Application Version : 4.31.1000

Core Rules Database Version : 4363
Trace Rules Database Version: 2207

Scan type : Complete Scan
Total Scan Time : 01:54:35

Memory items scanned : 205
Memory threats detected : 0
Registry items scanned : 5365
Registry threats detected : 0
File items scanned : 57051
File threats detected : 0

Shima · 2009/12/11

MBAM log

Malwarebytes' Anti-Malware 1.42
Database version: 3348
Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

12/12/2009 3:53:59 PM
mbam-log-2009-12-12 (15-53-59).txt

Scan type: Full Scan (C:\|)
Objects scanned: 170717
Time elapsed: 25 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\DomPlayer (Trojan.Swizzor) -> Quarantined and deleted successfully.

Files Infected:
C:\System Volume Information\_restore{33AB0827-7D49-43FC-BED6-EF1A98ADEE46}\RP783\A0145012.sys (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{33AB0827-7D49-43FC-BED6-EF1A98ADEE46}\RP783\A0145013.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{33AB0827-7D49-43FC-BED6-EF1A98ADEE46}\RP783\A0145014.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Shima · 2009/12/11

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:57:42 PM, on 12/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Curse\CurseClient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe "
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1189955538984
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - http://www.new.facebook.com/controls/contactx.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1189954458312
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6287 bytes

broni · 2009/12/12

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

Open JavaRa.exe again and select Search For Updates.

Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

==============================================================

Print this post out, since you won't have an access to it, at some point.

1. Open HijackThis.

2. Close all windows, except for HijackThis.

3. Put checkmarks next to the following HijackThis entries:

- R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
- O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
- O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
- O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
- O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
- O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

- O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
- O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
- O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
- O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
- O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
- O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

5. Click on Fix checked button.

6. Restart computer.

7. Post new HijackThis log.

Log in or Sign up

Solved iexplore.exe multiple processes (keeps spawning)

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Admin. Administrator Administrator Staff

broni Moderator Malware Analyst

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved iexplore.exe multiple processes (keeps spawning)

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Admin. Administrator Administrator Staff

broni Moderator Malware Analyst

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Shima Inactive Thread Starter

Shima Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches