virus

peter_the_piper

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 27/09/2010 21:16:26
System Uptime: 29/02/2012 17:32:06 (1 hours ago)
.
Motherboard: Dell Inc. | |
Processor: AMD Turion(tm) 64 Mobile Technology MK-36 | Socket M2/S1G1 | 1994/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 53 GiB total, 21.675 GiB free.
is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP165: 16/12/2011 08:55:01 - Software Distribution Service 3.0
RP166: 19/12/2011 09:55:12 - System Checkpoint
RP167: 20/12/2011 09:57:20 - System Checkpoint
RP168: 21/12/2011 09:59:18 - System Checkpoint
RP169: 05/01/2012 09:36:58 - System Checkpoint
RP170: 06/01/2012 09:39:51 - System Checkpoint
RP171: 09/01/2012 09:31:05 - System Checkpoint
RP172: 11/01/2012 08:09:54 - Software Distribution Service 3.0
RP173: 13/01/2012 09:45:47 - System Checkpoint
RP174: 15/01/2012 12:23:18 - System Checkpoint
RP175: 16/01/2012 06:38:18 - Software Distribution Service 3.0
RP176: 20/01/2012 10:27:17 - System Checkpoint
RP177: 23/01/2012 09:54:15 - System Checkpoint
RP178: 25/01/2012 09:45:36 - System Checkpoint
RP179: 29/01/2012 10:44:39 - System Checkpoint
RP180: 07/02/2012 20:40:49 - Installed Macrium Reflect Free Edition
RP181: 13/02/2012 09:31:58 - System Checkpoint
RP182: 15/02/2012 09:16:22 - Software Distribution Service 3.0
RP183: 15/02/2012 20:41:07 - Software Distribution Service 3.0
RP184: 21/02/2012 09:53:57 - System Checkpoint
RP185: 23/02/2012 09:37:20 - System Checkpoint
RP186: 28/02/2012 17:25:30 - System Checkpoint
RP187: 28/02/2012 21:21:48 - Restore Operation
RP188: 28/02/2012 21:54:37 - avast! Free Antivirus Setup
RP189: 29/02/2012 11:12:42 - avast! Free Antivirus Setup
RP190: 29/02/2012 12:55:41 - Revo Uninstaller Pro's restore point - Avira AntiVir Personal - Free Antivirus
RP191: 29/02/2012 15:02:12 - avast! Free Antivirus Setup
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 Plugin
aiofw
aioprnt
aioscnnr
ATI Catalyst Control Center
ATI Catalyst Install Manager
ATI Catalyst Registration
ATI Display Driver
avast! Free Antivirus
Belarc Advisor 8.1
Bonjour
Broadcom 440x 10/100 Integrated Controller
Brother HL-2030
Canon iP3600 series Printer Driver
Canon iP3600 series User Registration
Canon iP4200
Canon Setup Utility 2.0
Canon Utilities Easy-PhotoPrint
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Easy-PrintToolBox
Canon Utilities My Printer
Canon Utilities Solution Menu
Cashbook Lite
CCleaner
CD-LabelPrint
center
Clip Art 25,000 Vol 2
Compatibility Pack for the 2007 Office system
Conexant HDA D110 MDC V.92 Modem
Copy
Coupon Printer for Windows
CreativeProjects
CreativeProjectsTemplates
CueTour
Dell Resource CD
Dell Wireless WLAN Card
Destinations
Digital Camera Driver
Director
DivX Setup
DocProc
Easy-WebPrint
Edible Artist Version 9.2c Full
Eusing Free Registry Cleaner
FileHippo.com Update Checker
FotoSketcher 2.00
Foxit Reader
Google Earth
Google Earth Pro
Google Update Helper
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB976002-v5)
HP Diagnostic Assistant
HP Image Zone 4.0
HP Scanjet 3770
HP Software Update
HP Unload DLL Patch
HPDiagnosticAlert
hpg3770
HPSystemDiagnostics
InstantShare
InstantShareAlert
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 22
Junk Mail filter update
K-Lite Codec Pack 6.6.0 (Full)
KODAK AiO Home Centre
ksDIP
LG PC Suite II
LG USB Modem driver
Macrium Reflect Free Edition
Malwarebytes Anti-Malware version 1.60.1.1000
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Works
Mozilla Firefox 10.0.2 (x86 en-US)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NetObjects Fusion 5.0
OpenOffice.org 3.2
Overland
PC Tools Firewall Plus 6.0
PhotoArt Vol 1
PhotoArt Vol 2
PhotoArt Vol 3
PhotoGallery
PreReq
PrintScreen
QFolder
QuickProjects
Revo Uninstaller Pro 2.5.7
Scan
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows XP (KB923789)
Segoe UI
Serif PagePlus X2
Serif PagePlus X2 Resources
Serif PhotoPlus X2
Serif WebPlus 10
Serif WebPlus 10 Resources
SigmaTel Audio
SkinsHP1
SpywareBlaster 4.4
SweetIM for Messenger 3.6
SweetPacks Toolbar for Internet Explorer 4.4
The Lord of the Rings FREE Trial
Total Video Player 1.03
TrayApp
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB982664)
VC80CRTRedist - 8.0.50727.4053
WebFldrs XP
WebReg
Windows Driver Package - Ricoh Company Memorystick Host Controller (07/09/2005 1.00.01.12)
Windows Driver Package - Ricoh Company MMC Host Controller (07/14/2005 1.00.00.06)
Windows Driver Package - Ricoh Company xD-Picture Card/SmartMedia Host Controller (07/14/2005 1.00.02.04)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sync
Windows Live Upload Tool
Windows Live Writer
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
.
==== Event Viewer Messages From Past Week ========
.
29/02/2012 18:40:42, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{01ACB49B-3E84-4641-A886-EDC910A6D8A9} because another computer on the network has the same name. The server could not start.
29/02/2012 13:31:03, error: Service Control Manager [7034] - The Avira AntiVir Scheduler service terminated unexpectedly. It has done this 3 time(s).
29/02/2012 13:31:00, error: Service Control Manager [7031] - The Avira AntiVir Scheduler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
29/02/2012 13:30:56, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
29/02/2012 13:30:54, error: Service Control Manager [7031] - The Avira AntiVir Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
29/02/2012 13:30:45, error: Service Control Manager [7024] - The Avira AntiVir Guard service terminated with service-specific error 303 (0x12F).
29/02/2012 13:30:45, error: Service Control Manager [7022] - The Avira AntiVir Scheduler service hung on starting.
29/02/2012 12:17:12, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
29/02/2012 12:17:12, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
29/02/2012 10:49:12, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
29/02/2012 09:41:30, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Search service to connect.
29/02/2012 09:41:30, error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
28/02/2012 20:32:05, error: Service Control Manager [7034] - The Kodak AiO Network Discovery Service service terminated unexpectedly. It has done this 1 time(s).
28/02/2012 20:31:40, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
28/02/2012 20:30:19, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
28/02/2012 19:59:41, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio
28/02/2012 18:50:36, error: Service Control Manager [7001] - The Avira Web Protection service depends on the Avira AntiVir Guard service which failed to start because of the following error: The system cannot find the path specified.
28/02/2012 15:14:17, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio avipbb ssmdrv
28/02/2012 15:14:17, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
28/02/2012 15:14:06, error: Service Control Manager [7000] - The Avira AntiVir Scheduler service failed to start due to the following error: The system cannot find the path specified.
28/02/2012 15:14:06, error: Service Control Manager [7000] - The Avira AntiVir Guard service failed to start due to the following error: The system cannot find the path specified.
28/02/2012 15:14:06, error: Service Control Manager [7000] - The avgntflt service failed to start due to the following error: The system cannot find the file specified.
28/02/2012 13:54:11, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
28/02/2012 13:51:41, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
28/02/2012 11:10:55, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
28/02/2012 10:24:42, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdPPM BANTExt Fips
28/02/2012 10:20:51, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
28/02/2012 10:03:56, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdPPM avgio avipbb BANTExt Fips ssmdrv
28/02/2012 08:29:16, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
28/02/2012 08:28:43, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdPPM avgio avipbb BANTExt Fips IPSec MRxSmb NetBIOS NetBT pctgntdi RasAcd Rdbss ssmdrv Tcpip
28/02/2012 08:28:43, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
28/02/2012 08:28:43, error: Service Control Manager [7001] - The Kodak AiO Network Discovery Service service depends on the Bonjour Service service which failed to start because of the following error: The dependency service or group failed to start.
28/02/2012 08:28:43, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/02/2012 08:28:43, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/02/2012 08:28:43, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
28/02/2012 08:28:43, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/02/2012 08:28:20, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
28/02/2012 08:28:10, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
27/02/2012 20:02:15, error: Dhcp [1002] - The IP address lease 192.168.1.74 for the Network Card with network address 00197D487D05 has been denied by the DHCP server 10.14.85.57 (The DHCP Server sent a DHCPNACK message).
27/02/2012 16:02:39, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
23/02/2012 18:51:10, error: NetBT [4307] - Initialization failed because the transport refused to open initial Addresses.
23/02/2012 11:41:54, error: Dhcp [1002] - The IP address lease 10.1.64.82 for the Network Card with network address 00197D487D05 has been denied by the DHCP server 10.40.9.161 (The DHCP Server sent a DHCPNACK message).
23/02/2012 11:41:30, error: Dhcp [1002] - The IP address lease 192.168.1.74 for the Network Card with network address 00197D487D05 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
23/02/2012 08:13:22, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
23/02/2012 08:12:53, error: Dhcp [1002] - The IP address lease 192.168.1.74 for the Network Card with network address 00197D487D05 has been denied by the DHCP server 10.40.9.161 (The DHCP Server sent a DHCPNACK message).
22/02/2012 23:02:08, error: Dhcp [1002] - The IP address lease 10.40.9.162 for the Network Card with network address 00197D487D05 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
22/02/2012 22:58:07, error: Dhcp [1002] - The IP address lease 10.54.227.114 for the Network Card with network address 00197D487D05 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================

waddler_8

Uninstall these:

Java Auto Updater
Java(TM) 6 Update 20
Java(TM) 6 Update 22

Download the latest Java from here:

http://java.com/en/download/manual.jsp
Windows Offline
filesize: 16.1 MB

Close Browser > Run the installer.

http://blogs.technet.com/b/security/archive/2011/11/28/millions-of-java-exploit-attempts-the-importance-of-keeping-all-software-up-to-date.aspx

What problems are you still experiencing - if any?

peter_the_piper

Thanks for everything. Java 6 gone, new java installed, could not find updater to uninstall.
Comp running well but although I have used Revo to uninstall avira ts still there but not in the foreground and there are error messages when starting up about avira. I have seen a microsoft update shield at the bottom I assume its ok to click on.
Tried to delete files on Avira through hijack this but they just come back.
Is it safe to run unhide again as some files are still invisible?

waddler_8

Don't update just yet.

uStart Page = hxxp://home.!!!!!!!!!!!!/?barid={E7B946B6-6A5F-4A45-90E3-7BC9BB77AF8F}

FF - prefs.js: keyword.URL - hxxp://search.!!!!!!!!!!!!/search.asp?src=2&q=

I don't like the look of them - What's your IE homepage set as?

Change it to google or something.

http://www.google.co.uk/

http://windows.microsoft.com/en-us/windows7/Change-your-Internet-Explorer-home-page

Go to start > run and copy/paste into the run command box:

firefox.exe about:config

click ok

When firefox opens, in the filter box copy/paste

keyword.URL

right click the entry and choose reset

I can then get rid of the avira leftovers for you.

peter_the_piper

This being the wifes lappy, it was set to sweet something or other, the emoticons site. Now the bbc. Firefox modified as suggested.

waddler_8

Thought as much - sweetim - horrible software.

Download OTM by Old Timer and save it to your Desktop.

http://oldtimer.geekstogo.com/OTM.exe

• Double click OTM.exe to run it.
• Copy the following code inside the codebox below. Do not include the word Code:

  :Services
  AntiVirSchedulerService
  AntiVirService
  avgio
  avgntflt
  
  :Files
  c:\windows\system32\drivers\avgntflt.sys
  c:\program files\Avira
  
  :Commands
  [CreateRestorePoint]
  [Reboot]
  

• Return to OTM, right click in the Paste instructions for Items to be Moved window (under the yellow bar) and choose Paste.
• Push the large MoveIt! button.
• Click OK & post the log if no reboot is required.
• OTM may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Copy/paste the contents of that report back here in your next reply.

peter_the_piper

========== SERVICES/DRIVERS ==========
Service AntiVirSchedulerService stopped successfully!
Service AntiVirSchedulerService deleted successfully!
Service AntiVirService stopped successfully!
Service AntiVirService deleted successfully!
Service avgio stopped successfully!
Service avgio deleted successfully!
Error: Unable to stop service avgntflt!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avgntflt deleted successfully.
========== FILES ==========
File move failed. c:\windows\system32\drivers\avgntflt.sys scheduled to be moved on reboot.
Folder move failed. c:\program files\Avira\AntiVir Desktop\FAILSAFE scheduled to be moved on reboot.
Folder move failed. c:\program files\Avira\AntiVir Desktop\EVENTDB scheduled to be moved on reboot.
Folder move failed. c:\program files\Avira\AntiVir Desktop\CONFIG scheduled to be moved on reboot.
Folder move failed. c:\program files\Avira\AntiVir Desktop\APPDATA\LOGFILES scheduled to be moved on reboot.
Folder move failed. c:\program files\Avira\AntiVir Desktop\APPDATA scheduled to be moved on reboot.
Folder move failed. c:\program files\Avira\AntiVir Desktop scheduled to be moved on reboot.
Folder move failed. c:\program files\Avira scheduled to be moved on reboot.
========== COMMANDS ==========
Restore point Set: OTM Restore Point (0)

OTM by OldTimer - Version 3.1.19.0 log created on 02292012_201905

Files moved on Reboot...
c:\windows\system32\drivers\avgntflt.sys moved successfully.
c:\program files\Avira\AntiVir Desktop\FAILSAFE folder moved successfully.
c:\program files\Avira\AntiVir Desktop\EVENTDB folder moved successfully.
c:\program files\Avira\AntiVir Desktop\CONFIG folder moved successfully.
c:\program files\Avira\AntiVir Desktop\APPDATA\LOGFILES folder moved successfully.
c:\program files\Avira\AntiVir Desktop\APPDATA folder moved successfully.
c:\program files\Avira\AntiVir Desktop folder moved successfully.
c:\program files\Avira folder moved successfully.

Registry entries deleted on Reboot...

waddler_8

How are things running now - we'll need to clear the restore points and set a new one next. We can do that with OTM.

Go to start>run and copy/paste into the run command box:

"%allusersprofile%\Application Data"

Click OK

Is there an Avira folder there?

peter_the_piper

Yes, persistent isn't it.
Running very well it would seem (so far)

waddler_8

All hidden files restored?