We'd like to remind Forumites to please avoid political debate on the Forum... Read More »
📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
Computer Slow and Freezing
Comments
-
One was just a dead file
This one was the problem ~
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
Please run combofix now:idea:0 -
hi - only just got back to this, have been ill. So thanks for your help.
I'm struggling a bit - I don't know how to shut down my anti-virus, so combofix won't run. It's still showing as active
sorry if I sound really thick- you might have to talk very simply to me:o0 -
To disable the Resident Shield,
- Open AVG User Interface.
- Double-click on the Resident Shield.
- Un-tick the option Resident Shield active.
- Save the changes.
0 -
Well, as a complete tech novice....
Mine (Dell XPS running Vista) is also freezing. On start-up it asks for a disk check and I keep getting messages about a corrupt file in the C: disk. Just downloaded Hijack This - thanks - and got the following log. Grateful for any thoughts. If it helps, I downloaded a Microsoft update a while ago and when I tried to open Outlook 2007 that morning, the problems started. Did a System Restore to a date prior to the download but no change. Coincidence I suppose, but Outlook will still not open without freezing the computer.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:26:07, on 06/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18349)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Fingerprint Reader Suite\psqltray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Kontiki\KHost.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
C:\Users\Rhys Parker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FlexiBid\FlexiBidCalendarTool.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=4080616
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
O4 - Startup: FlexiBid Calendar Tool.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
--
End of file - 11245 bytes0 -
Be better if you started new thread to avoid confusion.0
-
One was just a dead file
This one was the problem ~
O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
Please run combofix now
Right I ran Combofix and this was the result
ComboFix 10-01-04.01 - Karen 07/01/2010 21:42:10.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.495.129 [GMT 0:00]
Running from: c:\documents and settings\Karen\My Documents\QWERTY.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Thumbs.db
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\system32\muzapp.exe
.
original MBR restored successfully !
.
((((((((((((((((((((((((( Files Created from 2009-12-07 to 2010-01-07 )))))))))))))))))))))))))))))))
.
2010-01-01 19:07 . 2010-01-01 19:07
d
w- c:\program files\TrendMicro
2009-12-28 19:05 . 2009-12-28 19:05
d
w- c:\program files\Lame MP3 Codec
2009-12-28 19:05 . 2005-05-03 09:33 299008 ----a-w- c:\windows\system32\LAME_MP3.dll
2009-12-28 19:04 . 2009-12-28 19:04 65024 ----a-w- c:\windows\IFinst26.exe
2009-12-28 19:04 . 2009-12-28 19:04
d
w- c:\program files\XviD
2009-12-26 18:18 . 2009-12-26 18:18
d
w- c:\documents and settings\HelpAssistant\WINDOWS
2009-12-26 18:18 . 2009-12-26 18:18
d
w- c:\documents and settings\HelpAssistant\UserData
2009-12-26 18:18 . 2009-12-26 18:18
d
w- c:\documents and settings\HelpAssistant\Tracing
2009-12-26 17:47 . 2009-12-26 17:47
d
w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-12-26 12:08 . 2009-12-26 12:08
d
w- c:\documents and settings\HelpAssistant\Contacts
2009-12-25 18:50 . 2009-12-25 18:50 58096 ---ha-w- c:\windows\system32\mlfcache.dat
2009-12-25 11:16 . 2009-12-25 11:39
d
w- c:\documents and settings\Karen\Application Data\Apple Computer
2009-12-25 11:15 . 2008-04-17 13:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-12-25 11:15 . 2009-05-18 14:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-12-25 11:14 . 2009-12-25 11:14
d
w- c:\program files\iPod
2009-12-25 11:14 . 2009-12-25 11:15
d
w- c:\program files\iTunes
2009-12-25 11:14 . 2009-12-25 11:15
d
w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-25 11:13 . 2009-12-25 11:13
d
w- c:\program files\Bonjour
2009-12-25 11:12 . 2009-12-25 11:13
d
w- c:\program files\QuickTime
2009-12-25 11:12 . 2009-12-25 11:14
d
w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-25 11:11 . 2009-12-25 11:11
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Apple
2009-12-25 11:11 . 2009-12-25 11:11
d
w- c:\program files\Apple Software Update
2009-12-25 11:11 . 2009-08-28 19:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-12-25 11:11 . 2009-08-28 19:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-12-25 11:09 . 2009-12-25 11:26
d
w- c:\documents and settings\All Users\Application Data\Apple
2009-12-25 11:09 . 2009-12-25 11:14
d
w- c:\program files\Common Files\Apple
2009-12-25 11:08 . 2009-12-26 10:20
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Apple Computer
2009-12-25 10:59 . 2001-08-17 22:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-12-25 10:59 . 2008-04-14 05:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-12-20 09:44 . 2009-12-20 09:44
d
w- c:\documents and settings\Karen\Local Settings\Application Data\HP
2009-12-18 18:59 . 2009-12-18 18:59
d
w- c:\documents and settings\Karen\Application Data\Samsung
2009-12-18 18:50 . 2006-05-03 22:53 174592 ----a-w- c:\windows\system32\framedyn.dll
2009-12-18 18:49 . 2009-12-18 18:49
d
w- c:\program files\DIFX
2009-12-18 18:41 . 2008-02-22 15:33 14976 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdwh.sys
2009-12-18 18:41 . 2008-02-22 15:33 114304 ----a-w- c:\windows\system32\drivers\sscdmdm.sys
2009-12-18 18:41 . 2008-02-22 15:33 87936 ----a-w- c:\windows\system32\drivers\sscdbus.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdcm.sys
2009-12-18 18:40 . 2009-12-18 18:41
d
w- c:\windows\system32\Samsung_USB_Drivers
2009-12-18 18:37 . 2009-12-18 18:56 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-12-18 18:36 . 2009-12-28 19:02
d
w- c:\program files\Samsung
2009-12-18 18:27 . 2009-12-18 18:27
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Identities
2009-12-14 17:12 . 2009-12-14 17:12
d
w- C:\$AVG
2009-12-14 17:11 . 2009-12-14 17:11 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-14 17:11 . 2009-12-14 17:11 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-14 17:11 . 2009-12-14 17:11 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-14 17:11 . 2009-12-14 17:11 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-14 17:11 . 2010-01-07 21:02
d
w- c:\windows\system32\drivers\Avg
2009-12-14 17:11 . 2009-12-23 14:55
d
w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-12-14 17:10 . 2009-12-14 17:10
d
w- c:\program files\AVG
2009-12-14 17:10 . 2009-12-14 17:10
d
w- c:\documents and settings\All Users\Application Data\avg9
2009-12-14 17:10 . 2009-12-15 07:01
d
w- c:\windows\SxsCaPendDel
2009-12-14 16:40 . 2009-12-14 16:40
d
w- c:\program files\MSXML 4.0
2009-12-14 13:15 . 2009-08-06 19:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-12-12 17:40 . 2009-12-12 17:40
d
w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-12 17:34 . 2009-12-12 17:34
d
w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-12-12 17:33 . 2009-12-12 17:33
d
w- c:\program files\SUPERAntiSpyware
2009-12-12 17:33 . 2009-12-12 17:33
d
w- c:\documents and settings\Karen\Application Data\SUPERAntiSpyware.com
2009-12-12 17:32 . 2009-12-12 17:32
d
w- c:\program files\Common Files\Wise Installation Wizard
2009-12-12 16:30 . 2009-12-12 16:30
d
w- c:\documents and settings\Karen\Application Data\Malwarebytes
2009-12-12 15:33 . 2009-12-12 15:33
d
w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-12-12 15:33 . 2009-12-03 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-12 15:33 . 2009-12-12 15:33
d
w- c:\program files\Malwarebytes' Anti-Malware
2009-12-12 15:33 . 2009-12-12 15:33
d
w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-12 15:33 . 2009-12-03 16:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-12 12:23 . 2009-12-12 12:23
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Symantec
2009-12-11 22:32 . 2009-12-14 16:29
d
w- c:\program files\Common Files\Symantec Shared
2009-12-11 22:22 . 2009-12-14 16:34
d
w- c:\documents and settings\All Users\Application Data\Norton
2009-12-11 22:20 . 2009-12-14 16:34
d
w- c:\program files\NortonInstaller
2009-12-11 22:20 . 2009-12-11 23:02
d
w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-12-11 21:12 . 2009-12-12 12:31
d
w- c:\documents and settings\Karen\Local Settings\Application Data\dgnygc
2009-12-11 20:22 . 2009-12-11 20:22
d
w- c:\documents and settings\Karen\Local Settings\Application Data\COMODO
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-07 20:56 . 2009-09-12 18:36
d
w- c:\documents and settings\Karen\Application Data\HPAppData
2009-12-28 19:02 . 2009-12-28 19:02
d
w- c:\program files\MarkAny
2009-12-28 19:02 . 2009-08-20 11:56
d--h--w- c:\program files\InstallShield Installation Information
2009-12-14 16:56 . 2009-08-20 17:21
d
w- c:\program files\Microsoft Silverlight
2009-12-12 16:39 . 2009-08-20 18:30 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-12-05 14:51 . 2009-12-05 14:43
d
w- c:\program files\Microsoft
2009-12-05 14:50 . 2009-08-20 15:46
d
w- c:\program files\Windows Live
2009-12-05 14:50 . 2009-12-05 14:50
d
w- c:\program files\Microsoft Sync Framework
2009-12-05 14:47 . 2009-12-05 14:47
d
w- c:\program files\Microsoft SQL Server Compact Edition
2009-12-03 13:23 . 2009-12-03 13:23
d
w- c:\program files\Coupon Printer
2009-12-03 13:23 . 2009-12-03 13:23 31 ---ha-w- c:\windows\UKCpInfo.sys
2009-10-29 07:46 . 2008-04-14 09:42 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2008-04-14 09:41 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2008-04-14 09:41 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2008-04-14 09:42 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2008-04-14 09:41 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2008-04-14 04:23 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2008-04-14 09:42 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2008-04-14 09:42 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2008-04-14 09:42 79872 ----a-w- c:\windows\system32\raschap.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 13:01 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-23 2001648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-07-01 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-07-01 118784]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"ReminderApp"="c:\program files\Nova Development\Scrapbook Factory Deluxe 4.0\ReminderApp.exe" [2007-06-08 161864]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-01 2033432]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 126976]
c:\documents and settings\Karen\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-8-23 385024]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-08-20 12:12 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3246:TCP"= 3246:TCP:Services
"2479:TCP"= 2479:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [14/12/2009 17:11 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [14/12/2009 17:11 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/11/2009 08:43 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/11/2009 08:43 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [14/12/2009 17:10 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [14/12/2009 17:10 285392]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/11/2009 08:43 7408]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12/12/2009 15:33 38224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
2010-01-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-07 21:55
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
- - - - - - - > 'winlogon.exe'(648)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(3328)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Other Running Processes
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\windows\SOUNDMAN.EXE
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2010-01-07 22:04:27 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-07 22:04
Pre-Run: 157,344,137,216 bytes free
Post-Run: 157,353,467,904 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - E7AAF18F6618376FFF64D5E336113E570 -
Open notepad and copy/paste the text in RED below
File::
c:\windows\IFinst26.exe
c:\windows\system32\mlfcache.dat
Save this as "CFScript" (FULL file will be 'CFScript.txt')
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
Combofix should never take more that 30 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
..................................................................
Then UPDATE malwarebytes and runa FULL scan (May need to update malwarebytes twice depending on the age):idea:0 -
ComboFix 10-01-04.01 - Karen 08/01/2010 18:12:51.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.495.246 [GMT 0:00]
Running from: c:\documents and settings\Karen\My Documents\QWERTY.exe
Command switches used :: c:\documents and settings\Karen\My Documents\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FILE ::
"c:\windows\IFinst26.exe"
"c:\windows\system32\mlfcache.dat"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\IFinst26.exe
c:\windows\system32\mlfcache.dat
.
((((((((((((((((((((((((( Files Created from 2009-12-08 to 2010-01-08 )))))))))))))))))))))))))))))))
.
2010-01-01 19:07 . 2010-01-01 19:07 388096 ----a-r- c:\documents and settings\Karen\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-01 19:07 . 2010-01-01 19:07
d
w- c:\program files\TrendMicro
2009-12-30 16:10 . 2009-12-30 16:10 52224 ----a-w- c:\documents and settings\Karen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2009-12-28 19:05 . 2009-12-28 19:05
d
w- c:\program files\Lame MP3 Codec
2009-12-28 19:05 . 2005-05-03 09:33 299008 ----a-w- c:\windows\system32\LAME_MP3.dll
2009-12-28 19:04 . 2009-12-28 19:04
d
w- c:\program files\XviD
2009-12-26 18:18 . 2009-12-26 18:18
d
w- c:\documents and settings\HelpAssistant\WINDOWS
2009-12-26 18:18 . 2009-12-26 18:18
d
w- c:\documents and settings\HelpAssistant\UserData
2009-12-26 18:18 . 2009-12-26 18:18
d
w- c:\documents and settings\HelpAssistant\Tracing
2009-12-26 17:47 . 2009-12-26 17:47
d
w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-12-26 12:08 . 2009-12-26 12:08
d
w- c:\documents and settings\HelpAssistant\Contacts
2009-12-25 11:16 . 2009-12-25 11:39
d
w- c:\documents and settings\Karen\Application Data\Apple Computer
2009-12-25 11:15 . 2008-04-17 13:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-12-25 11:15 . 2009-05-18 14:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-12-25 11:14 . 2009-12-25 11:14
d
w- c:\program files\iPod
2009-12-25 11:14 . 2009-12-25 11:15
d
w- c:\program files\iTunes
2009-12-25 11:14 . 2009-12-25 11:15
d
w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-25 11:13 . 2009-12-25 11:13
d
w- c:\program files\Bonjour
2009-12-25 11:12 . 2009-12-25 11:13
d
w- c:\program files\QuickTime
2009-12-25 11:12 . 2009-12-25 11:14
d
w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-25 11:11 . 2009-12-25 11:11
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Apple
2009-12-25 11:11 . 2009-12-25 11:11
d
w- c:\program files\Apple Software Update
2009-12-25 11:11 . 2009-08-28 19:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-12-25 11:11 . 2009-08-28 19:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-12-25 11:09 . 2009-12-25 11:26
d
w- c:\documents and settings\All Users\Application Data\Apple
2009-12-25 11:09 . 2009-12-25 11:14
d
w- c:\program files\Common Files\Apple
2009-12-25 11:08 . 2009-12-26 10:20
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Apple Computer
2009-12-25 10:59 . 2001-08-17 22:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-12-25 10:59 . 2008-04-14 05:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-12-23 14:58 . 2009-12-14 17:10 916248 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcfgx.dll
2009-12-20 09:44 . 2009-12-20 09:44
d
w- c:\documents and settings\Karen\Local Settings\Application Data\HP
2009-12-19 08:50 . 2009-12-19 08:50 294656 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avglngx.dll
2009-12-18 18:59 . 2009-12-18 18:59
d
w- c:\documents and settings\Karen\Application Data\Samsung
2009-12-18 18:50 . 2006-05-03 22:53 174592 ----a-w- c:\windows\system32\framedyn.dll
2009-12-18 18:49 . 2009-12-18 18:49
d
w- c:\program files\DIFX
2009-12-18 18:41 . 2008-02-22 15:33 14976 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdwh.sys
2009-12-18 18:41 . 2008-02-22 15:33 114304 ----a-w- c:\windows\system32\drivers\sscdmdm.sys
2009-12-18 18:41 . 2008-02-22 15:33 87936 ----a-w- c:\windows\system32\drivers\sscdbus.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys
2009-12-18 18:41 . 2008-02-22 15:33 12160 ----a-w- c:\windows\system32\drivers\sscdcm.sys
2009-12-18 18:40 . 2009-12-18 18:41
d
w- c:\windows\system32\Samsung_USB_Drivers
2009-12-18 18:37 . 2009-12-18 18:56 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-12-18 18:36 . 2009-12-28 19:02
d
w- c:\program files\Samsung
2009-12-18 18:27 . 2009-12-18 18:27
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Identities
2009-12-15 15:23 . 2009-12-14 17:10 877848 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2009-12-15 15:23 . 2009-12-14 17:10 1657112 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2009-12-15 15:23 . 2009-12-14 17:10 798488 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2009-12-14 18:13 . 2009-10-16 12:12 1119488 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-12-14 17:12 . 2009-12-14 17:12
d
w- C:\$AVG
2009-12-14 17:11 . 2009-12-14 17:11 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-14 17:11 . 2009-12-14 17:11 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-14 17:11 . 2009-12-14 17:11 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-14 17:11 . 2009-12-14 17:11 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-14 17:11 . 2010-01-08 14:47
d
w- c:\windows\system32\drivers\Avg
2009-12-14 17:11 . 2009-12-23 14:55
d
w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-12-14 17:10 . 2009-12-14 17:10
d
w- c:\program files\AVG
2009-12-14 17:10 . 2009-12-14 17:10
d
w- c:\documents and settings\All Users\Application Data\avg9
2009-12-14 17:10 . 2009-12-15 07:01
d
w- c:\windows\SxsCaPendDel
2009-12-14 16:40 . 2009-12-14 16:40
d
w- c:\program files\MSXML 4.0
2009-12-14 13:15 . 2009-08-06 19:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-12-12 17:40 . 2009-12-12 17:40
d
w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-12 17:36 . 2009-12-12 17:36 117760 ----a-w- c:\documents and settings\Karen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-12 17:34 . 2009-12-12 17:34
d
w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-12-12 17:33 . 2009-12-12 17:33
d
w- c:\program files\SUPERAntiSpyware
2009-12-12 17:33 . 2009-12-12 17:33
d
w- c:\documents and settings\Karen\Application Data\SUPERAntiSpyware.com
2009-12-12 17:32 . 2009-12-12 17:32
d
w- c:\program files\Common Files\Wise Installation Wizard
2009-12-12 16:30 . 2009-12-12 16:30
d
w- c:\documents and settings\Karen\Application Data\Malwarebytes
2009-12-12 15:33 . 2009-12-12 15:33
d
w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-12-12 15:33 . 2009-12-03 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-12 15:33 . 2009-12-12 15:33
d
w- c:\program files\Malwarebytes' Anti-Malware
2009-12-12 15:33 . 2009-12-12 15:33
d
w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-12 15:33 . 2009-12-03 16:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-12 12:23 . 2009-12-12 12:23
d
w- c:\documents and settings\Karen\Local Settings\Application Data\Symantec
2009-12-11 22:32 . 2009-12-14 16:29
d
w- c:\program files\Common Files\Symantec Shared
2009-12-11 22:22 . 2009-12-14 16:34
d
w- c:\documents and settings\All Users\Application Data\Norton
2009-12-11 22:20 . 2009-12-14 16:34
d
w- c:\program files\NortonInstaller
2009-12-11 22:20 . 2009-12-11 23:02
d
w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-12-11 21:12 . 2009-12-12 12:31
d
w- c:\documents and settings\Karen\Local Settings\Application Data\dgnygc
2009-12-11 20:22 . 2009-12-11 20:22
d
w- c:\documents and settings\Karen\Local Settings\Application Data\COMODO
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-08 18:06 . 2009-09-12 18:36
d
w- c:\documents and settings\Karen\Application Data\HPAppData
2009-12-28 19:02 . 2009-12-28 19:02
d
w- c:\program files\MarkAny
2009-12-28 19:02 . 2009-08-20 11:56
d--h--w- c:\program files\InstallShield Installation Information
2009-12-23 14:57 . 2009-12-15 15:29 4043544 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe
2009-12-23 14:54 . 2009-12-15 15:29 3966744 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2009-12-14 16:56 . 2009-08-20 17:21
d
w- c:\program files\Microsoft Silverlight
2009-12-12 16:39 . 2009-08-20 18:30 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-12-05 14:51 . 2009-12-05 14:43
d
w- c:\program files\Microsoft
2009-12-05 14:50 . 2009-08-20 15:46
d
w- c:\program files\Windows Live
2009-12-05 14:50 . 2009-12-05 14:50
d
w- c:\program files\Microsoft Sync Framework
2009-12-05 14:47 . 2009-12-05 14:47
d
w- c:\program files\Microsoft SQL Server Compact Edition
2009-12-03 13:23 . 2009-12-03 13:23
d
w- c:\program files\Coupon Printer
2009-12-03 13:23 . 2009-12-03 13:23 31 ---ha-w- c:\windows\UKCpInfo.sys
2009-11-12 17:07 . 2009-11-12 17:07 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-29 07:46 . 2008-04-14 09:42 832512
w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2008-04-14 09:41 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2008-04-14 09:41 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-21 05:38 . 2008-04-14 09:42 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2008-04-14 09:41 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2008-04-14 04:23 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2008-04-14 09:42 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2008-04-14 09:42 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2008-04-14 09:42 79872 ----a-w- c:\windows\system32\raschap.dll
.
((((((((((((((((((((((((((((( [EMAIL="SnapShot@2010-01-07_21.52.27"]SnapShot@2010-01-07_21.52.27[/EMAIL] )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-08 17:59 . 2010-01-08 17:59 16384 c:\windows\Temp\Perflib_Perfdata_260.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 13:01 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-23 2001648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-07-01 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-07-01 118784]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 577536]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"ReminderApp"="c:\program files\Nova Development\Scrapbook Factory Deluxe 4.0\ReminderApp.exe" [2007-06-08 161864]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-01 2033432]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"SMSTray"="c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-02-23 126976]
c:\documents and settings\Karen\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-8-23 385024]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-08-20 12:12 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"3246:TCP"= 3246:TCP:Services
"2479:TCP"= 2479:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [14/12/2009 17:11 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [14/12/2009 17:11 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/11/2009 08:43 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/11/2009 08:43 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [14/12/2009 17:10 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [14/12/2009 17:10 285392]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/11/2009 08:43 7408]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12/12/2009 15:33 38224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
2010-01-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -
AddRemove-Lame MP3 Codec (for the ACM) - c:\windows\IFinst26.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-08 18:21
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
DLLs Loaded Under Running Processes
- - - - - - - > 'winlogon.exe'(644)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-01-08 18:25:29
ComboFix-quarantined-files.txt 2010-01-08 18:25
ComboFix2.txt 2010-01-07 22:04
Pre-Run: 157,337,460,736 bytes free
Post-Run: 157,318,803,456 bytes free
- - End Of File - - D4808E86772B2E4D5A2527DEDCCD85750 -
Malwarebytes' Anti-Malware 1.42
Database version: 3349
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
08/01/2010 21:06:44
mbam-log-2010-01-08 (21-06-44).txt
Scan type: Full Scan (C:\|)
Objects scanned: 239602
Time elapsed: 2 hour(s), 34 minute(s), 36 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)0 -
You never UPDATED malwarebytes (Youll probably need to update twice, once to update malwarebytes and again to get the database up to date)
Malwarebytes' Anti-Malware 1.42
Database version: 3349
malwarebytes is currenty on version 1.44 and the database version 3521. Yours is 4 months behind or more:idea:0
This discussion has been closed.
Confirm your email address to Create Threads and Reply
Categories
- All Categories
- 350.6K Banking & Borrowing
- 253K Reduce Debt & Boost Income
- 453.4K Spending & Discounts
- 243.6K Work, Benefits & Business
- 598.3K Mortgages, Homes & Bills
- 176.7K Life & Family
- 256.7K Travel & Transport
- 1.5M Hobbies & Leisure
- 16.1K Discuss & Feedback
- 37.6K Read-Only Boards