1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive [InActive] iexplore.exe virus

Discussion in 'Malware and Virus Removal Archive' started by incubus, 2009/10/11.

  1. 2009/10/11
    incubus

    incubus Inactive Thread Starter

    Joined:
    2009/10/11
    Messages:
    3
    Likes Received:
    0
    I have read around and found that i am now pretty certain i have the iexplore virus. i have done multiple scans with AVG, windows live one care & now i'm scanning with trend micro house call.. I know i have it because task mamager says iexplore is running in the processes and when i try to delete it it just keeps returning, i get pop ups once in a while, but i fear that they will become more frequent. I do not use iexplore.. hence my suspicions of it being in the task manager!

    sorry for the please help :/ just got to the bit about not putting that in the rules.

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 16/12/2008 03:48:28
    System Uptime: 10/11/2009 19:40:50 (-719 hours ago)

    Motherboard: ASUSTeK Computer INC. | | P5KPL-AM
    Processor: Intel Pentium III Xeon processor | Socket 775 | 2341/333mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 699 GiB total, 610.266 GiB free.
    D: is CDROM ()
    E: is Removable
    F: is CDROM ()
    G: is Removable
    H: is Removable
    J: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID:
    Description: Audio Device on High Definition Audio Bus
    Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&A78EA25&0&0001
    Manufacturer:
    Name: Audio Device on High Definition Audio Bus
    PNP Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&A78EA25&0&0001
    Service:

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Realtek RTL8102E Family PCI-E Fast Ethernet NIC
    Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_83471043&REV_02\4&38D2602C&0&00E1
    Manufacturer: Realtek Semiconductor Corp.
    Name: Realtek RTL8102E Family PCI-E Fast Ethernet NIC
    PNP Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_83471043&REV_02\4&38D2602C&0&00E1
    Service: RTLE8023xp

    Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
    Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
    Device ID: ACPI\PNP0303\4&2C575ACB&0
    Manufacturer: (Standard keyboards)
    Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
    PNP Device ID: ACPI\PNP0303\4&2C575ACB&0
    Service: i8042prt

    Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
    Description: Microsoft PS/2 Mouse
    Device ID: ACPI\PNP0F03\4&2C575ACB&0
    Manufacturer: Microsoft
    Name: Microsoft PS/2 Mouse
    PNP Device ID: ACPI\PNP0F03\4&2C575ACB&0
    Service: i8042prt

    Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
    Description: Nokia N95 8GB
    Device ID: ROOT\WPD\0000
    Manufacturer: Nokia
    Name: Nokia N95 8GB
    PNP Device ID: ROOT\WPD\0000
    Service: WUDFRd

    ==== System Restore Points ===================

    RP147: 14/07/2009 17:20:58 - Installed Windows Internet Explorer 8.
    RP148: 14/07/2009 17:21:35 - Software Distribution Service 3.0
    RP149: 14/07/2009 17:54:59 - Removed Safari
    RP150: 16/07/2009 17:04:25 - Software Distribution Service 3.0
    RP151: 19/07/2009 03:00:11 - System Checkpoint
    RP152: 20/07/2009 03:50:50 - System Checkpoint
    RP153: 21/07/2009 05:53:40 - System Checkpoint
    RP154: 22/07/2009 06:38:22 - System Checkpoint
    RP155: 26/07/2009 21:14:24 - Avg8 Update
    RP156: 30/07/2009 19:35:13 - System Checkpoint
    RP157: 31/07/2009 00:05:40 - Software Distribution Service 3.0
    RP158: 03/08/2009 14:14:37 - System Checkpoint
    RP159: 03/08/2009 21:36:12 - Installed Belkin Bluetooth Software
    RP160: 03/08/2009 21:42:47 - Unsigned driver install
    RP161: 03/08/2009 21:44:46 - Removed Belkin Bluetooth Software
    RP162: 03/08/2009 21:45:40 - Installed Belkin Bluetooth Software
    RP163: 03/08/2009 22:52:54 - Unsigned driver install
    RP164: 03/08/2009 22:55:35 - Removed Belkin Bluetooth Software
    RP165: 04/08/2009 23:53:05 - Installed Java(TM) 6 Update 15
    RP166: 06/08/2009 12:42:05 - Installed COWON Media Center - jetAudio Basic
    RP167: 07/08/2009 12:51:11 - System Checkpoint
    RP168: 08/08/2009 16:09:58 - System Checkpoint
    RP169: 22/08/2009 18:43:59 - Software Distribution Service 3.0
    RP170: 23/08/2009 12:30:55 - Printer Driver Microsoft XPS Document Writer Installed
    RP171: 23/08/2009 15:33:18 - Software Distribution Service 3.0
    RP172: 23/08/2009 15:38:51 - Removed Call of Duty(R) 4 - Modern Warfare(TM)
    RP173: 27/08/2009 12:44:10 - Software Distribution Service 3.0
    RP174: 27/08/2009 12:45:55 - Unsigned driver install
    RP175: 27/08/2009 13:00:21 - Unsigned driver install
    RP176: 28/08/2009 11:17:23 - Avg8 Update
    RP177: 28/08/2009 11:18:56 - Avg8 Update
    RP178: 01/09/2009 22:32:13 - Software Distribution Service 3.0
    RP179: 03/09/2009 14:02:39 - System Checkpoint
    RP180: 05/09/2009 12:28:21 - System Checkpoint
    RP181: 06/09/2009 21:16:40 - System Checkpoint
    RP182: 08/09/2009 02:18:29 - System Checkpoint
    RP183: 09/09/2009 15:52:56 - System Checkpoint
    RP184: 09/09/2009 22:28:56 - Software Distribution Service 3.0
    RP185: 15/09/2009 17:28:00 - System Checkpoint
    RP186: 16/09/2009 18:45:56 - System Checkpoint
    RP187: 21/09/2009 19:00:18 - System Checkpoint
    RP188: 21/09/2009 22:21:39 - Installed Microsoft Windows Journal Viewer
    RP189: 24/09/2009 21:39:26 - System Checkpoint
    RP190: 24/09/2009 22:26:42 - Unsigned driver install
    RP191: 27/09/2009 21:00:48 - System Checkpoint
    RP192: 29/09/2009 13:35:12 - System Checkpoint
    RP193: 06/10/2009 14:38:43 - Avg8 Update
    RP194: 06/10/2009 14:39:51 - Avg8 Update
    RP195: 07/10/2009 16:05:39 - Avg8 Update
    RP196: 08/10/2009 17:13:42 - System Checkpoint
    RP197: 09/10/2009 18:59:30 - System Checkpoint

    ==== Installed Programs ======================

    µTorrent
    AC3Filter (remove only)
    Adobe After Effects CS3
    Adobe After Effects CS3 Presets
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe ExtendScript Toolkit 2
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Linguistics CS3
    Adobe MotionPicture Color Files
    Adobe PDF Library Files
    Adobe Photoshop CS3
    Adobe Setup
    Adobe Shockwave Player 11.5
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe Video Profiles
    Adobe WinSoft Linguistics Plugin
    Adobe XMP DVA Panels CS3
    Adobe XMP Panels CS3
    Apple Software Update
    ATI - Software Uninstall Utility
    ATI Catalyst Control Center
    ATI Display Driver
    Audacity 1.3.6 (Unicode)
    AutoUpdate
    AVG 8.5
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center HydraVision Full
    ccc-core-preinstall
    ccc-core-static
    ccc-utility
    CCC Help English
    CiD Help
    CoreVorbis Audio Decoder (remove only)
    Critical Update for Windows Media Player 11 (KB959772)
    Direct Show Ogg Vorbis Filter (remove only)
    DivX Player
    DivX Pro Trial
    ffdshow (remove only)
    foobar2000 v0.9.6.1 beta 2
    Guitar Pro 5.0
    High Definition Audio Driver Package - KB888111
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Huffyuv AVI lossless video codec (Remove Only)
    Java(TM) 6 Update 13
    Java(TM) 6 Update 15
    jZip
    Live 7.0.3
    Magic ISO Maker v5.5 (build 0276)
    MediaMonkey 3.1
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
    Microsoft User-Mode Driver Framework Feature Pack 1.5
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Windows Journal Viewer
    Morgan Stream Switcher
    Mozilla Firefox (3.5.3)
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 6.0 Parser (KB933579)
    OpenOffice.org 3.1
    PC Connectivity Solution
    PDF Settings
    Platform
    QuickTime
    RealPlayer
    REALTEK GbE & FE Ethernet PCI-E NIC Driver
    Reason 4.0
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973869)
    Segoe UI
    Skins
    Skype™ 3.8
    Sony Media Manager 2.2
    Sony Vegas 7.0e
    SoulSeek 157 NS 13e
    Spotify
    Trust Tablet Driver
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB971930)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB973815)
    VIA Platform Device Manager
    Virtual DJ - Atomix Productions
    Vista Icon Pack v3 System Patch
    VLC media player 1.0.0
    WebFldrs XP
    Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    XML Paper Specification Shared Components Pack 1.0
    XviD MPEG-4 Video Codec
    Zoom Wireless-G USB

    ==== Event Viewer Messages From Past Week ========

    05/10/2009 21:38:25, error: Schannel [36881] - The certificate received from the remote server has expired. The SSL connection request has failed. The attached data contains the server certificate.
    05/10/2009 18:47:21, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt

    ==== End Of File ===========================


    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\System32\Drivers\WTSRV.EXE
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\WINDOWS\system32\WTClient.exe
    C:\WINDOWS\system32\wisptis.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Zoom Wireless-G USB\WLANUTL.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Java\jre6\bin\java.exe
    C:\Documents and Settings\michael\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.co.uk/
    uSearch Page = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
    uSearch Bar = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/sb/*http://uk.yahoo.com/search/ie.html
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
    uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [WaitIso] c:\docume~1\michael\applic~1\openbias\TITLERECT.exe
    mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
    mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [Nokia FastStart] "c:\program files\nokia\nokia music\NokiaMusic.exe" /command:faststart
    mRun: [VIPv3_Auto_Update]
    mRun: [Vistadrv]
    mRun: [VisualTooltip]
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [WTClient] WTClient.exe
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [inter wipe surf store] c:\documents and settings\all users\application data\dupe axis inter wipe\atom support.exe
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\zoomwi~1.lnk - c:\program files\zoom wireless-g usb\WLANUTL.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file://c:\program files\scrabble\images\stg_drm.ocx
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file://c:\program files\scrabble\images\armhelper.ocx
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: AtiExtEvent - Ati2evxx.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\michael\applic~1\mozilla\firefox\profiles\8mj7unnk.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.lovefilm.com/welcome/beta.html
    FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=60655&p=
    FF - component: c:\documents and settings\michael\application data\mozilla\firefox\profiles\8mj7unnk.default\extensions\{0141db0d-d129-4511-9916-af110cfffe75}\components\Engine.dll
    FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-25 335240]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-12-25 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-25 108552]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-12-25 908056]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-12-25 297752]
    R2 ZDCNDIS5;ZDCNDIS5 NDIS5.1 Protocol Driver;c:\windows\system32\ZDCNDIS5.sys [2009-1-25 20736]
    R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [2009-8-27 18944]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-12-16 222976]
    R3 XG762NXP;Zoom 802.11g XG762 Driver;c:\windows\system32\drivers\WlanUZXP.SYS [2009-1-25 519168]
    S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;\??\c:\progra~1\belkin\belkin~1.11g\dnindis5.sys --> c:\progra~1\belkin\belkin~1.11g\DNINDIS5.SYS [?]

    =============== Created Last 30 ================

    2009-10-11 20:01 <DIR> --d----- c:\documents and settings\michael\.housecall6.6
    2009-10-08 16:11 <DIR> --d----- c:\program files\OpenBias
    2009-10-08 16:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\dupe axis inter wipe
    2009-10-08 16:03 <DIR> --d----- c:\docume~1\michael\applic~1\OpenBias
    2009-09-27 20:02 <DIR> --d----- c:\program files\common files\xing shared
    2009-09-21 22:21 <DIR> --d----- c:\program files\Windows Journal Viewer

    ==================== Find3M ====================

    2009-09-27 20:02 348,160 a------- c:\windows\system32\msvcr71.dll
    2009-08-28 11:18 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
    2009-08-28 11:18 11,952 a------- c:\windows\system32\avgrsstx.dll
    2009-08-06 19:23 274,288 a------- c:\windows\system32\mucltui.dll
    2009-08-06 19:23 215,920 a------- c:\windows\system32\muweb.dll
    2009-08-06 12:17 33,533 a------- c:\windows\system32\CoreVorbis-uninstall.exe
    2009-08-06 12:17 36,734 a------- c:\windows\system32\OggDSuninst.exe
    2009-08-06 12:16 1,682 a--sh--- c:\windows\system32\KGyGaAvL.sys
    2009-08-05 10:01 204,800 a------- c:\windows\system32\mswebdvd.dll
    2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll
    2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
    2009-07-17 20:01 58,880 a------- c:\windows\system32\atl.dll
    2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll

    ============= FINISH: 20:33:19.35 ===============
     
    Last edited: 2009/10/11
  2. 2009/10/11
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    Hi,

    Read this post as indicated at the top of this forum & follow the instructions.
     

  3. to hide this advert.

  4. 2009/10/11
    incubus

    incubus Inactive Thread Starter

    Joined:
    2009/10/11
    Messages:
    3
    Likes Received:
    0
  5. 2009/10/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    If you need more help, let us know...
     
  6. 2009/10/12
    incubus

    incubus Inactive Thread Starter

    Joined:
    2009/10/11
    Messages:
    3
    Likes Received:
    0
    I also did some research and found my ATI GFX card driver has a monitoring program named MOM.exe alot of people are saying this is the same name as some spyware or something.. so i got rid of that, my card doesn't support the 7.1 driver, does anyone know of a newer release without this mom.exe? i don't know if i should trust it.
     
  7. 2009/10/25
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi incubus
    That file is fine and needed.

    Virustotal

    File MOM.exe received on 2009.10.19 20:52:32 (UTC)
    Current status: finished
    Result: 0/41 (0.00%)
    Compact Compact
    Print results Print results
    Antivirus Version Last Update Result
    a-squared 4.5.0.41 2009.10.19 -
    AhnLab-V3 5.0.0.2 2009.10.19 -
    AntiVir 7.9.1.35 2009.10.19 -
    Antiy-AVL 2.0.3.7 2009.10.19 -
    Authentium 5.1.2.4 2009.10.19 -
    Avast 4.8.1351.0 2009.10.19 -
    AVG 8.5.0.420 2009.10.19 -
    BitDefender 7.2 2009.10.19 -
    CAT-QuickHeal 10.00 2009.10.18 -
    ClamAV 0.94.1 2009.10.19 -
    Comodo 2659 2009.10.19 -
    DrWeb 5.0.0.12182 2009.10.19 -
    eSafe 7.0.17.0 2009.10.19 -
    eTrust-Vet 35.1.7075 2009.10.19 -
    F-Prot 4.5.1.85 2009.10.19 -
    F-Secure 9.0.15300.0 2009.10.16 -
    Fortinet 3.120.0.0 2009.10.19 -
    GData 19 2009.10.19 -
    Ikarus T3.1.1.72.0 2009.10.19 -
    Jiangmin 11.0.800 2009.10.19 -
    K7AntiVirus 7.10.874 2009.10.19 -
    Kaspersky 7.0.0.125 2009.10.19 -
    McAfee 5776 2009.10.19 -
    McAfee+Artemis 5776 2009.10.19 -
    McAfee-GW-Edition 6.8.5 2009.10.19 -
    Microsoft 1.5101 2009.10.19 -
    NOD32 4523 2009.10.19 -
    Norman 6.03.02 2009.10.19 -
    nProtect 2009.1.8.0 2009.10.19 -
    Panda 10.0.2.2 2009.10.19 -
    PCTools 4.4.2.0 2009.10.19 -
    Prevx 3.0 2009.10.19 -
    Rising 21.52.04.00 2009.10.19 -
    Sophos 4.46.0 2009.10.19 -
    Sunbelt 3.2.1858.2 2009.10.19 -
    Symantec 1.4.4.12 2009.10.19 -
    TheHacker 6.5.0.2.047 2009.10.19 -
    TrendMicro 8.950.0.1094 2009.10.19 -
    VBA32 3.12.10.11 2009.10.19 -
    ViRobot 2009.10.19.1993 2009.10.19 -
    VirusBuster 4.6.5.0 2009.10.19 -
    Additional information
    File size: 49152 bytes
    MD5 : 6b87742f27b087af7fd4adc2db685de0
    SHA1 : 10c32b259971bf95be8a020a637cc2d2e1b9f40e
    SHA256: e45fea6710007e751625a0bbf9eab80612daffc538082d70eff0d9e3ffe2280c
    PEInfo: PE Structure information

    Geri
     
    Geri,
    #6

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.