JPD

September 4, 2009

Many thanks again for all your help and advice, I will follow it carefully.

Please can I ask one more question before you close this thread? Can you tell me where I can safely check the IP addresses that Malwarebytes Anti-Malware gives in the infection alert windows? I would like to determine whether the possible infection is suspicious or serious!

September 4, 2009

Hi again!

I have updated Java as you suggested.

Here is the Kaspersky Scan log file:

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

Friday, September 4, 2009

Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Thursday, September 03, 2009 23:36:26

Records in database: 2743830

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

A:\

C:\

D:\

E:\

F:\

G:\

H:\

I:\

Scan statistics:

Objects scanned: 139989

Threats found: 1

Infected objects found: 0

Suspicious objects found: 6

Scan duration: 07:51:53

File name / Threat / Threats count

D:\My Documents\OutLook\- old - Penny Darragh.bak Suspicious: Trojan-Spy.HTML.Fraud.gen 2

D:\My Documents\OutLook\- old - Penny Darragh.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2

D:\My Documents\OutLook\Penny Darragh.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2

Selected area has been scanned.

Here is the DDS log file (with 2nd one attached):

DDS (Ver_09-07-30.01) - NTFSx86

Run by Penny Darragh at 9:31:19.89 on 04/09/2009

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1454 [GMT 1:00]

AV: avast! antivirus 4.8.1351 [VPS 090903-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Acronis\TrueImageWorkstation\TrueImageMonitor.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files\Acronis\TrueImageWorkstation\TimounterMonitor.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ezSP_Px.exe

C:\Program Files\Kontiki\KHost.exe

C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\Program Files\sony\giga pocket\USBsircs.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

svchost.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Kongsoft\Easy CD Ripper\ezcdrservice.exe

C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kontiki\KService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Sony\giga pocket\GPVSvr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

I:\--=Penny's Data=--\Downloads\RootRepeal\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/

uInternet Connection Wizard,ShellNext = hxxp://www.club-vaio.sony-europe.com/

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [kdx] c:\program files\kontiki\KHost.exe -all

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /installquiet

mRun: [AGRSMMSG] AGRSMMSG.exe

mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimageworkstation\TrueImageMonitor.exe

mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimageworkstation\TimounterMonitor.exe

mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"

mRun: [<NO NAME>]

mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe

mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe

mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe

mRun: [kdx] "c:\program files\kontiki\KHost.exe" -all

mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\gigapo~1.lnk - c:\program files\sony\giga pocket\USBsircs.exe

IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Download All Files by HiDownload - c:\program files\streamingstar\hidownload\HDGetAll.htm

IE: Download by HiDownload - c:\program files\streamingstar\hidownload\HDGet.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Translate with &Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Translate.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

Trusted Zone: sony-europe.com

Trusted Zone: sonystyle-europe.com

Trusted Zone: vaio-link.com

DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {076169AA-8C3D-4CFC-AC23-3ACA88FC21B5} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab

DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

LSA: Authentication Packages = msv1_0 relog_ap

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-8-26 28544]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-4-23 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-4-23 20560]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-4-23 138680]

R2 Easy CD Ripper Service;Easy CD Ripper Service;c:\program files\kongsoft\easy cd ripper\ezcdrservice.exe [2007-3-17 23552]

R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2008-10-28 156968]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-6-24 232720]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-6-24 19096]

R3 nmserial;PCI Serial Port;c:\windows\system32\drivers\NmSerial.sys [2008-4-4 70016]

R3 PhTVTune;Sony TV Tuner (4830) WDM TVTuner;c:\windows\system32\drivers\PhTVTune.sys [2002-11-4 27520]

S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-4-23 352920]

=============== Created Last 30 ================

2009-09-03 22:01 73,728 a------- c:\windows\system32\javacpl.cpl

2009-09-02 22:51 <DIR> --dsh--- c:\documents and settings\penny darragh\IECompatCache

2009-08-27 17:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\F-Secure

2009-08-27 15:49 <DIR> --d----- c:\program files\Trend Micro

2009-08-27 08:42 <DIR> --dsh--- c:\documents and settings\penny darragh\PrivacIE

2009-08-27 08:39 <DIR> --dsh--- c:\documents and settings\penny darragh\IETldCache

2009-08-27 08:29 100,352 -c------ c:\windows\system32\dllcache\iecompat.dll

2009-08-27 08:29 <DIR> --d----- c:\windows\ie8updates

2009-08-27 08:29 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll

2009-08-27 08:29 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll

2009-08-27 08:27 <DIR> -cd-h--- c:\windows\ie8

2009-08-26 22:12 28,544 a------- c:\windows\system32\drivers\pavboot.sys

2009-08-26 22:11 <DIR> --d----- c:\program files\Panda Security

2009-08-24 18:24 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat

2009-08-24 07:51 <DIR> --d----- c:\windows\system32\XPSViewer

2009-08-24 07:50 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-08-24 07:50 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-08-24 07:50 117,760 -------- c:\windows\system32\prntvpt.dll

2009-08-24 07:50 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll

2009-08-24 07:50 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll

2009-08-24 07:50 1,676,288 -------- c:\windows\system32\xpssvcs.dll

2009-08-24 07:50 575,488 -------- c:\windows\system32\xpsshhdr.dll

2009-08-24 07:40 <DIR> --d----- c:\program files\MSXML 4.0

2009-08-23 21:47 691,712 -c------ c:\windows\system32\dllcache\inetcomm.dll

2009-08-23 21:04 1,106,944 -c------ c:\windows\system32\dllcache\msxml3.dll

2009-08-23 21:01 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb

2009-08-23 21:01 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe

2009-08-23 21:01 2,560 -------- c:\windows\system32\xpsp4res.dll

2009-08-23 21:00 272,128 -c------ c:\windows\system32\dllcache\bthport.sys

2009-08-23 20:54 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll

2009-08-23 20:54 284,160 -c------ c:\windows\system32\dllcache\pdh.dll

2009-08-23 20:54 110,592 -c------ c:\windows\system32\dllcache\services.exe

2009-08-23 20:54 730,112 -c------ c:\windows\system32\dllcache\lsasrv.dll

2009-08-23 20:54 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll

2009-08-23 20:54 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll

2009-08-23 20:54 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll

2009-08-23 20:54 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll

2009-08-23 20:54 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe

2009-08-23 20:54 2,189,056 -c------ c:\windows\system32\dllcache\ntoskrnl.exe

2009-08-23 20:54 2,145,280 -c------ c:\windows\system32\dllcache\ntkrnlmp.exe

2009-08-23 20:54 2,023,936 -c------ c:\windows\system32\dllcache\ntkrpamp.exe

2009-08-23 20:50 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx

2009-08-23 20:41 203,136 -c------ c:\windows\system32\dllcache\rmcast.sys

2009-08-23 20:41 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys

2009-08-23 20:40 333,952 -c------ c:\windows\system32\dllcache\srv.sys

2009-08-23 20:40 331,776 -c------ c:\windows\system32\dllcache\msadce.dll

2009-08-23 20:39 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll

2009-08-23 19:35 337,408 -c------ c:\windows\system32\dllcache\netapi32.dll

2009-08-09 09:38 <DIR> --d----- c:\program files\OscilloMeter

2009-08-05 10:01 204,800 -c------ c:\windows\system32\dllcache\mswebdvd.dll

==================== Find3M ====================

2009-09-03 22:01 411,368 a------- c:\windows\system32\deploytk.dll

2009-08-05 10:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-08-03 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-03 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-07-29 05:37 119,808 a------- c:\windows\system32\t2embed.dll

2009-07-29 05:37 81,920 a------- c:\windows\system32\fontsub.dll

2009-07-17 20:01 58,880 a------- c:\windows\system32\atl.dll

2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll

2009-07-03 18:09 915,456 a------- c:\windows\system32\wininet.dll

2009-06-25 09:25 730,112 a------- c:\windows\system32\lsasrv.dll

2009-06-25 09:25 301,568 a------- c:\windows\system32\kerberos.dll

2009-06-25 09:25 147,456 a------- c:\windows\system32\schannel.dll

2009-06-25 09:25 136,192 a------- c:\windows\system32\msv1_0.dll

2009-06-25 09:25 56,832 a------- c:\windows\system32\secur32.dll

2009-06-25 09:25 54,272 a------- c:\windows\system32\wdigest.dll

2009-06-12 13:31 76,288 a------- c:\windows\system32\telnet.exe

2009-06-10 15:13 84,992 a------- c:\windows\system32\avifil32.dll

2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll

2009-06-10 07:14 132,096 a------- c:\windows\system32\wkssvc.dll

============= FINISH: 9:31:33.81 ===============

I have been getting no additional symptoms other than Malwarebytes detection alerts, however Malwarebytes Anti-Malware has been disabled for most of the tests, only being enabled during the posting of replies to this forum, so the alerts have been less frequent.

Many thanks for your ongoing help and support, I really appreciate it.

Attach.rar

September 3, 2009

Thank you again for your help and advice.

Here is the log file from GMER:

GMER 1.0.15.15077 [pxf1zp1m.exe] - http://www.gmer.net

Rootkit scan 2009-09-03 18:44:10

Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xB80656B8]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xB8065574]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xB8065A52]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xB806514C]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xB806564E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xB806508C]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xB80650F0]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xB806576E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xB806572E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xB80658AE]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 snapman.sys (Acronis Snapshot API/Acronis)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

September 3, 2009

Hi Thank you for your help!

RootRepeal downloaded OK but crashes during scan :

ROOTREPEAL CRASH REPORT

-------------------------

Windows Version: Windows XP SP3

Exception Code: 0xc0000094

Exception Address: 0x004eca19

DDS log file as follows:

DDS (Ver_09-07-30.01) - NTFSx86

Run by Penny Darragh at 8:13:40.37 on 03/09/2009

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1436 [GMT 1:00]

AV: avast! antivirus 4.8.1351 [VPS 090901-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Kongsoft\Easy CD Ripper\ezcdrservice.exe

C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kontiki\KService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Sony\giga pocket\GPVSvr.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Acronis\TrueImageWorkstation\TrueImageMonitor.exe

C:\Program Files\Acronis\TrueImageWorkstation\TimounterMonitor.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ezSP_Px.exe

C:\Program Files\Kontiki\KHost.exe

C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\sony\giga pocket\USBsircs.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Alwil Software\Avast4\setup\avast.setup