1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active sneaky malware will not leave me alone

Discussion in 'Malware and Virus Removal Archive' started by warlock, 2010/09/26.

  1. 2010/09/26
    warlock

    warlock Inactive Thread Starter

    Joined:
    2010/09/26
    Messages:
    1
    Likes Received:
    0
    [Active] sneaky malware will not leave me alone

    i have tried everything on this forum post: http://forums.majorgeeks.com/showthread.php?t=35407 which helped a lot, the majority of my problems were fixed with it.

    and yet am still hearing a constant clicking noise at times (like if i clicked on an icon or link over and over, even when just hovering on the desktop) and i get a few of windows explorer errors that cause it to shut down and reopen itself (at least a couple times a day)

    i just wanna play my games! plz help :)


    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Administrator at 19:34:44.81 on Sun 09/26/2010
    Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_21
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2638 [GMT -4:00]

    AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

    ============== Running Processes ===============

    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    "C:\WINDOWS\System32\svchost.exe "
    "C:\WINDOWS\System32\svchost.exe "
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    C:\Documents and Settings\Administrator\Local Settings\Apps\2.0\7VJX1MDB.B1Z\51CM52AZ.PAA\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\CurseClient.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe
    C:\Documents and Settings\Administrator\My Documents\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uInternet Settings,ProxyOverride = <local>;*.local
    uInternet Settings,ProxyServer = http=127.0.0.1:6522
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe "
    mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe "
    mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
    mRun: [WinampAgent] "c:\program files\winamp\winampa.exe "
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
    StartupFolder: c:\documents and settings\administrator\start menu\programs\startup\CurseClientStartup.ccip
    StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\koeeiaj9.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
    FF - prefs.js: keyword.URL - hxxp://search.search-go.net/?sid=10101049100&s=
    FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
    FF - plugin: c:\documents and settings\administrator\application data\facebook\npfbplugin_1_0_0.dll
    FF - plugin: c:\documents and settings\administrator\application data\facebook\npfbplugin_1_0_1.dll
    FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\koeeiaj9.default\extensions\gametap@gametap.com\plugins\npGameTapWebUpdater.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
    FF - plugin: c:\windows\system32\c2mp\npdivx32.dll
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: browser.search.selectedEngine - Google
    FF - user.js: browser.search.order.1 - Google
    FF - user.js: keyword.URL - hxxp://search.search-go.net/?sid=10101049100&s=c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

    ============= SERVICES / DRIVERS ===============

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-9-17 11608]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-9-17 135336]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-9-17 267432]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-9-17 60936]
    R2 tcpip7x;tcpip7x;c:\windows\system32\drivers\tcpip7x.sys [2010-8-10 254848]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-3-1 39456]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-3-1 876288]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-25 135664]
    S3 ALSysIO;ALSysIO;\??\c:\docume~1\admini~1\locals~1\temp\alsysio.sys --> c:\docume~1\admini~1\locals~1\temp\ALSysIO.sys [?]
    S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\dragon age\bin_ship\daupdatersvc.service.exe [2010-1-16 25832]
    S3 pbfilter;pbfilter;\??\c:\program files\peerblock\pbfilter.sys --> c:\program files\peerblock\pbfilter.sys [?]

    =============== Created Last 30 ================

    2010-09-25 13:59:00 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-09-25 13:59:00 423656 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-25 13:54:29 0 d-----w- c:\program files\Winamp Detect
    2010-09-25 13:31:33 181773 ----a-w- C:\MGlogs.zip
    2010-09-25 13:31:32 0 d-----w- C:\MGtools
    2010-09-25 05:19:07 0 d-sha-r- C:\cmdcons
    2010-09-25 05:16:04 98816 ----a-w- c:\windows\sed.exe
    2010-09-25 05:16:04 77312 ----a-w- c:\windows\MBR.exe
    2010-09-25 05:16:04 256512 ----a-w- c:\windows\PEV.exe
    2010-09-25 05:16:04 161792 ----a-w- c:\windows\SWREG.exe
    2010-09-25 05:04:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-09-25 05:04:54 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-09-25 05:04:53 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-09-24 20:05:30 0 d-----w- c:\program files\CCleaner
    2010-09-24 19:05:03 0 d-----w- c:\windows\system32\appmgmt
    2010-09-24 18:47:18 0 d-----w- c:\docume~1\alluse~1\applic~1\OrbNetworks
    2010-09-18 00:52:26 0 d-----w- c:\docume~1\admini~1\applic~1\Anarchy
    2010-09-18 00:50:51 0 d-----w- c:\program files\Redrum - Time Lies
    2010-09-18 00:48:13 0 d-----w- c:\program files\bfgclient
    2010-09-18 00:47:40 0 d-----w- c:\docume~1\alluse~1\applic~1\BigFishGamesCache
    2010-09-18 00:03:39 0 d-----w- c:\windows\system32\NtmsData
    2010-09-18 00:02:21 0 d-----w- c:\docume~1\admini~1\applic~1\Avira
    2010-09-17 23:59:55 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-09-17 23:59:54 0 d-----w- c:\program files\Avira
    2010-09-17 23:59:54 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
    2010-09-17 23:19:02 38848 ----a-w- c:\windows\avastSS.scr
    2010-09-17 23:18:59 0 d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software
    2010-09-16 00:48:20 0 d-----w- C:\World of Warcraft Public Test
    2010-09-16 00:42:54 0 d-----w- c:\program files\PTR Installer 4.0.0.12824 enUS
    2010-09-04 00:12:31 0 d-s---w- c:\documents and settings\administrator\UserData
    2010-09-03 22:24:39 0 d-----w- c:\program files\Bethesda Softworks
    2010-09-03 22:21:54 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
    2010-09-02 12:41:25 0 d-----w- c:\program files\iPod
    2010-09-02 12:37:49 0 d-----w- c:\program files\Bonjour
    2010-08-31 03:04:17 0 d-----w- c:\documents and settings\administrator\New Folder

    ==================== Find3M ====================

    2010-09-26 23:34:47 782848 ----a-w- c:\windows\system32\drivers\zwcqvz.sys
    2010-09-08 15:24:16 254848 ----a-w- c:\windows\system32\drivers\tcpip7x.sys
    2010-07-27 22:44:10 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-07-27 22:44:10 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-07-27 22:44:10 107808 ----a-w- c:\windows\system32\dns-sd.exe

    ============= FINISH: 19:34:56.92 ===============

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 3/1/2009 2:21:08 AM
    System Uptime: 9/26/2010 4:43:53 PM (3 hours ago)

    Motherboard: ASUSTeK Computer INC. | | M3N78-VM
    Processor: AMD Athlon(tm) 7750 Dual-Core Processor | AM2 | 2699/200mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 932 GiB total, 540.466 GiB free.
    D: is CDROM (UDF)
    F: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP1: 9/17/2010 6:59:14 PM - System Checkpoint
    RP2: 9/17/2010 7:18:59 PM - avast! Free Antivirus Setup
    RP3: 9/17/2010 7:22:19 PM - avast! Free Antivirus Setup
    RP4: 9/17/2010 7:44:07 PM - avast! Free Antivirus Setup
    RP5: 9/18/2010 10:45:15 PM - System Checkpoint
    RP6: 9/20/2010 12:12:56 AM - System Checkpoint
    RP7: 9/21/2010 4:07:12 AM - System Checkpoint
    RP8: 9/22/2010 4:35:23 AM - System Checkpoint
    RP9: 9/23/2010 6:17:07 AM - System Checkpoint
    RP10: 9/24/2010 9:16:07 AM - System Checkpoint
    RP11: 9/24/2010 3:05:48 PM - Removed Adobe Media Player
    RP12: 9/24/2010 3:06:02 PM - Removed Adobe Community Help
    RP13: 9/24/2010 3:19:13 PM - Removed Neverwinter Nights Platinum Edition
    RP14: 9/24/2010 3:47:14 PM - Removed Skypeâ„¢ 4.2
    RP15: 9/24/2010 3:48:38 PM - Removed Star Wars(R) Knights of the Old Republic(R) II: The Sith
    RP16: 9/24/2010 3:53:37 PM - Configured Viva Piñata
    RP17: 9/25/2010 9:58:46 AM - Installed Java(TM) 6 Update 21
    RP18: 9/26/2010 10:40:56 AM - System Checkpoint

    ==== Installed Programs ======================


    µTorrent
    2600
    2600_Help
    2600Trb
    Acrobat.com
    Adobe AIR
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Fireworks CS5
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Reader 9.1.3
    Adobe Shockwave Player 11.5
    Adobe Stock Photos 1.0
    AiO_Scan
    AiOSoftware
    AMD Processor Driver
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Audiosurf
    Avira AntiVir Personal - Free Antivirus
    Big Fish Games: Game Manager
    BioShock
    BioShock 2
    Bonjour
    Borderlands
    Braid
    BufferChm
    CCleaner
    Copy
    Core Temp version 0.99.7
    CP_AtenaShokunin1Config
    cp_dwShrek2Albums1
    cp_dwShrek2Cards1
    CreativeProjects
    CreativeProjectsTemplates
    CueTour
    Curse Client
    Dead Space
    Destinations
    Director
    DocProc
    DocumentViewer
    Dragon Age: Origins
    Facebook Plug-In
    Fallout 3
    Fax
    Google Earth
    Google Update Helper
    Half-Life 2
    Half-Life 2: Episode One
    Half-Life 2: Episode Two
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Windows XP (KB954550-v5)
    HP Image Zone 4.7
    HP Product Assistant
    HP PSC & OfficeJet 4.7
    HP Software Update
    HPSystemDiagnostics
    Indigo Prophecy
    InstantShare
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 21
    Last.fm 1.5.4.24567
    Left 4 Dead
    Left 4 Dead 2 Demo
    Logitech Webcam Software
    Logitech Webcam Software Driver Package
    Malwarebytes' Anti-Malware
    Mass Effect
    Mass Effect 2
    Media Player Codec Pack 3.9.0
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Games for Windows - LIVE
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 12
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft WSE 3.0 Runtime
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Morrowind: Game of the Year
    Mozilla Firefox (3.6)
    MSVCRT
    NVIDIA Drivers
    NVIDIA nView Desktop Manager
    NVIDIA PhysX
    Osmos
    PanoStandAlone
    PhotoGallery
    Plants vs. Zombies
    Platform
    Portal
    ProductContext
    Psychonauts
    QFolder
    QuickTime
    Readme
    Real Alternative 1.9.0
    Redrum: Time Lies
    Scan
    ScannerCopy
    Segoe UI
    SkinsHP1
    Skype Toolbars
    Spelling Dictionaries Support For Adobe Reader 9
    Star Wars: Knights of The Old Republic
    StarCraft II
    Steam
    SUPERAntiSpyware
    System Requirements Lab
    Team Fortress 2
    The Secret of Monkey Island: Special Edition
    The Simsâ„¢ 3
    Torchlight
    TrayApp
    Tropico 3: Steam Special Edition
    Unload
    Ventrilo Client
    VIA Platform Device Manager
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    Viva Piñata
    VLC media player 1.1.2
    Warcraft III
    WebFldrs XP
    WebReg
    Winamp
    Winamp Detector Plug-in
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format Runtime
    WinRAR archiver
    WinZip Self-Extractor
    World of Goo
    World of Warcraft
    World of Warcraft Public Test

    ==== Event Viewer Messages From Past Week ========

    9/25/2010 8:58:10 AM, error: System Error [1003] - Error code 100000d1, parameter1 00000008, parameter2 00000002, parameter3 00000000, parameter4 b7d57c10.
    9/25/2010 1:41:00 AM, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The specified module could not be found.
    9/25/2010 1:14:32 AM, error: Service Control Manager [7034] - The Process Monitor service terminated unexpectedly. It has done this 1 time(s).
    9/24/2010 4:35:47 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
    9/24/2010 3:22:26 PM, error: Service Control Manager [7000] - The X4HSX32 service failed to start due to the following error: The system cannot find the path specified.
    9/24/2010 3:21:07 PM, error: Print [19] - Sharing printer failed + 1722, Printer HP Photosmart 2600 series share name HPPhotos.
    9/24/2010 2:38:49 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 002215B97C5B. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
    9/21/2010 7:44:53 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service MDM with arguments " " in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}
    9/21/2010 4:23:51 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    9/21/2010 4:23:51 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
    9/20/2010 10:29:13 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service iPod Service with arguments " " in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}

    ==== End Of File ===========================
     
  2. 2010/09/26
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc…) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

    References for the risk of these programs are here, and here.

    I would strongly recommend that you uninstall them, and read the links above for educational value!

    Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.

    A Malware expert will have a look at your log in due course.
     

  3. to hide this advert.

  4. 2010/09/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard :)

    STEP 1. Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform Quick Scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt


    STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    Do NOT use the computer while GMER is running!
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    IMPORTANT! If for some reason GMER refuses to run, try again.
    If it still fails, try to UN-check "Devices" in right pane.
    If still no joy, try to run it from Safe Mode.


    STEP 3. Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.



    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.