Jump to content

b.exe virus and mbam won't scan


Recommended Posts

hey i downloaded something today that when it finished it gave me the b.exe virus. i got it once before but i removed it with mbam, but mbam won't scan so i can't remove it and i just installed hjthis and it gives me an error message saying it can't access it and says i may not have permission to use it.

Link to post
Share on other sites

Hello and welcome to the forum!

My name is Extremeboy, and I will help you with your log.

Please continue with running a scan with RootRepeal, followed by DDS, a scanner tool.

Download and run RootRepeal CR

Please download RootRepeal from the following location and save it to your desktop.

  • Unzip the RootRepeal.zip file it to it's own folder. (If you did not use the "Direct Download" mirror to download RootRepeal).
  • Close/Disable all other programs especially your security programs (anti-spyware, anti-virus, and firewall) Refer to this page, if you are unsure how.
  • Physically disconnect your machine from the internet as your system will be unprotected.
  • Double-click on RootRepeal.exe to run it. If you are using Vista, please right-click and run as Administrator...
  • Click the reportTab.png tab at the bottom.
  • Now press the btnScan.png button.
  • A box will pop up, check the boxes beside All Seven options/scan area
    RR_checkbox.jpg
  • Now click OK.
  • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
  • The scan will take a little while to run, so let it go unhindered.
  • Once it is done, click the Save Report button. saveReport.png
  • Save it as RepealScan and save it to your desktop
  • Reconnect to the internet.
  • Post the contents of that log in your reply please.

Download and run DDS

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Download DDS by sUBs from one of the following links. Save it to your desktop.

    [*]Double click on the DDS icon, allow it to run.

    [*]A small box will open, with an explanation about the tool. No input is needed, the scan is running.

    [*]Notepad will open with the results soon.

    [*]Follow the instructions that pop up for posting the results and then click Ok.

    [*]The black and message box window shall then disappear.

    [*]Please save both log files on your desktop and post the DDS.txt and zip up and attach Attach.txt as instructed.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

Also, please provide a description of any remaining problems or symptoms you may still have please.

With Regards,

Extremeboy

Link to post
Share on other sites

hey i tried running rootrepeal but when it started scanning it scan for a couple of seconds or so then the program closed and i tried to open it again it gave me the same message i got from HJT and i also tried running DDS but it closed after a few seconds of being opened and it left find.exe running but it doesn't do anything.

Link to post
Share on other sites

Hello.

Please do the following....

Now, do the following...

Please download Inherit by sUBs and save it onto your desktop

  1. Drag and drop the RootRepeal.exe onto Inherit
  2. This shall restore permissions to the application
  3. You will then receive an Ok message from Inherit.
  4. Press Ok.

Now, try running RootRepeal again and see if it works.

With Regards,

Extremeboy

Link to post
Share on other sites

Hello again.

From now on, any of the tools that have trouble running and you get those related permission error messages, drag them ontop of Inherit.

Please run Win32Kdiag....

Download and Run Win32KDiag

Please download Win32Diag from one of the links below and save it to your desktop.

Link 1

Link 2

Link 3

  1. Double-click on Win32Diag.exe to run it. If you are using Windows Vista, please right-click and select Run As Administrator
  2. A black command prompt window shall appear.
  3. It will now begin to scan. This may take a while, please be paitent until the scan is complete.
  4. Once it's done, in the black screen it will say "Finished! Press any key to exit.... Press any key to exit.
  5. A log file called Win32KDiag.txt will be created on your desktop.
  6. Please copy and paste the contents of that log file here in your next reply please.

With Regards,

Extremeboy

Link to post
Share on other sites

k here it is:

Log file is located at: C:\Documents and Settings\David\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\$hf_mig$\KB915865\KB915865

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\addins\addins

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP16D.tmp\ZAP16D.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP221.tmp\ZAP221.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP325.tmp\ZAP325.tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\temp\temp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\assembly\tmp\tmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Config\Config

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d1\d1

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d2\d2

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d3\d3

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d4\d4

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d5\d5

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d6\d6

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d7\d7

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\CSC\d8\d8

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\00000001

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\00000002

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\00000003

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\00000004

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\00000005

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\00000006

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\chsime\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp98\imejp98

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\shared\res\res

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\12.0.4518

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\classes\classes

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\trustlib\trustlib

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Minidump\Minidump

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\msapps\msinfo\msinfo

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\security\logs\logs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1025\1025

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1028\1028

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1031\1031

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1037\1037

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1041\1041

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1042\1042

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\1054\1054

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\2052\2052

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\3076\3076

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\appmgmt\S-1-5-21-1417001333-725345543-1224657429-1004\S-1-5-21-1417001333-725345543-1224657429-1004

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Links\Links

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\GFWLive\GFWLive

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My Documents

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\dhcp\dhcp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\drivers\disdn\disdn

Mount point destination : \Device\__max++>\^

Cannot access: C:\WINDOWS\system32\eventlog.dll

[1] 2006-02-28 08:00:00 55808 C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll (Microsoft Corporation)

[1] 2008-04-13 20:11:53 56320 C:\WINDOWS\ServicePackFiles\i386\eventlog.dll (Microsoft Corporation)

[1] 2008-04-13 20:11:53 61952 C:\WINDOWS\system32\eventlog.dll ()

[2] 2008-04-13 20:11:53 56320 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation)

Found mount point : C:\WINDOWS\system32\export\export

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\IME\CINTLGNT\CINTLGNT

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\IME\PINTLGNT\PINTLGNT

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\IME\TINTLGNT\TINTLGNT

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\Lang\Lang

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\oobe\sample\sample

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\DriverFiles

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\i386

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\DriverFiles

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\DriverFiles

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\DriverFiles

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\DriverFiles

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\spool\drivers\IA64\IA64

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\spool\drivers\W32ALPHA\W32ALPHA

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\spool\drivers\WIN40\WIN40

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\spool\drivers\x64\x64

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wbem\mof\good\good

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\wins\wins

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\system32\xircom\xircom

Mount point destination : \Device\__max++>\^

Finished!

Link to post
Share on other sites

Hello.

Thanks for the log. We are going to proceed with Combofix.

Download and Run ComboFix

Note to readers of this post other than the starter of this thread:

ComboFix is a VERY POWERFUL tool which should NOT BE USED without guidance of an expert.

Download Combofix from any of the links below, and save it to your desktop.

Link 1

Link 2

Please refer to this page for full instructions on how to run ComboFix.

  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Double click ComboFix.exe to start the program. Agree to the prompts.
  • When ComboFix is finished, a log report (C:\ComboFix.txt) will open. Post back with it.

Leave your computer alone while ComboFix is running.

ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may call it to stall.

With Regards,

Extremeboy

Link to post
Share on other sites

k here is the log:

ComboFix 09-08-31.04 - David 09/01/2009 15:48.3.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2815.2190 [GMT -4:00]

Running from: c:\documents and settings\David\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\David\Local Settings\Application Data\{77493FD9-3AA7-45FD-B4CE-2E48131B6EBC}

c:\documents and settings\David\Local Settings\Application Data\{77493FD9-3AA7-45FD-B4CE-2E48131B6EBC}\chrome.manifest

c:\documents and settings\David\Local Settings\Application Data\{77493FD9-3AA7-45FD-B4CE-2E48131B6EBC}\chrome\content\_cfg.js

c:\documents and settings\David\Local Settings\Application Data\{77493FD9-3AA7-45FD-B4CE-2E48131B6EBC}\chrome\content\overlay.xul

c:\documents and settings\David\Local Settings\Application Data\{77493FD9-3AA7-45FD-B4CE-2E48131B6EBC}\install.rdf

c:\windows\Installer\24f3f.msi

c:\windows\system32\drivers\anfiezme.sys

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\eventlog.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

((((((((((((((((((((((((( Files Created from 2009-08-01 to 2009-09-01 )))))))))))))))))))))))))))))))

.

2009-08-31 22:50 . 2009-08-31 22:50 -------- d-----w- c:\program files\Trend Micro

2009-08-31 22:44 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-31 22:44 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-31 20:32 . 2009-08-31 22:16 -------- d-----w- c:\program files\SUPERAntiSpyware

2009-08-31 20:32 . 2009-08-31 20:32 -------- d-----w- c:\documents and settings\David\Application Data\SUPERAntiSpyware.com

2009-08-20 19:20 . 2009-07-01 14:25 61440 ----a-w- c:\windows\system32\uc_atlantica_launching.dll

2009-08-20 19:20 . 2009-06-23 17:21 64000 ----a-w- c:\windows\system32\uc_sfighters_launching.dll

2009-08-20 19:20 . 2009-03-31 21:43 53248 ----a-w- c:\windows\system32\uc_luminary_launching.dll

2009-08-20 19:20 . 2009-03-11 22:20 208384 ----a-w- c:\windows\system32\uc_rohan_launching.dll

2009-08-20 19:20 . 2009-01-29 15:53 87472 ----a-w- c:\windows\system32\ijjiChannelingPlugin.dll

2009-08-20 19:20 . 2009-08-20 19:20 -------- d-----w- c:\program files\ijji

2009-08-17 23:14 . 2009-08-17 01:31 480688 ----a-w- c:\documents and settings\David\Application Data\ijjigame\ijjistarter2.exe

2009-08-17 01:15 . 2009-08-25 00:32 220926964 ----a-w- c:\documents and settings\David\Application Data\ijjigame\U_GUNZ_setup.exe

2009-08-17 01:14 . 2009-08-17 01:14 -------- d-----w- C:\ijji

2009-08-17 01:14 . 2009-08-20 19:22 -------- d--h--w- c:\documents and settings\David\Application Data\ijjigame

2009-08-17 01:08 . 2009-06-03 21:48 779720 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\PurpleBean.exe

2009-08-17 01:08 . 2008-08-20 14:46 632280 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\PLauncher.exe

2009-08-17 01:08 . 2009-05-27 22:08 591320 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\ExLauncher.exe

2009-08-17 01:08 . 2008-09-04 20:34 112048 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\ijjiPrePLauncher.exe

2009-08-17 01:08 . 2008-08-28 16:50 480688 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\ijjistarter2FxB.exe

2009-08-17 01:08 . 2008-08-28 16:50 83376 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\ijjiPreStarter2FxB.exe

2009-08-17 01:08 . 2008-08-28 16:50 50608 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\ijjiNotify2FxB.exe

2009-08-17 01:08 . 2008-08-28 16:50 79280 ----a-w- c:\documents and settings\All Users\Application Data\ijjigame\ijjiPreNotify2FxB.exe

2009-08-17 01:08 . 2009-08-20 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\ijjigame

2009-08-17 01:07 . 2009-07-03 04:34 710064 ----a-w- c:\windows\system32\ijjiSetup.exe

2009-08-17 01:07 . 2009-07-03 04:34 58800 ----a-w- c:\windows\system32\ijjiProcessRestarter.exe

2009-08-17 01:07 . 2009-07-03 04:34 58800 ----a-w- c:\windows\system32\ijjiPlugin2.dll

2009-08-17 01:07 . 2009-01-28 18:47 157144 ----a-w- c:\windows\system32\PubPlugin.dll

2009-08-17 01:07 . 2009-08-17 01:07 -------- d-----w- c:\program files\NHN USA

2009-08-16 20:39 . 2009-08-16 20:39 -------- d-----w- c:\windows\BAA Villains screensaver Uninstaller

2009-08-16 20:39 . 2009-08-12 19:30 16577485 ----a-w- c:\windows\BAA Villains screensaver.scr

2009-08-16 20:34 . 2009-08-16 20:34 -------- d-----w- c:\windows\BAA Screensaver Uninstaller

2009-08-16 20:34 . 2009-07-30 13:38 5173960 ----a-w- c:\windows\BAA Screensaver.scr

2009-08-13 04:58 . 2009-06-23 13:23 331776 ----a-w- c:\windows\system32\TwcToolbarIe7.dll

2009-08-13 04:58 . 2008-07-22 17:24 98304 ----a-w- c:\windows\system32\TwcToolbarBho.dll

2009-08-13 04:58 . 2007-12-03 16:36 25600 ----a-w- c:\windows\system32\TwcToolInstDll.dll

2009-08-13 04:58 . 2006-10-30 19:51 89088 ----a-w- c:\windows\system32\atl71.dll

2009-08-13 04:58 . 2006-10-30 19:51 1060864 ----a-w- c:\windows\system32\mfc71.dll

2009-08-13 04:57 . 2009-08-13 04:58 -------- d-----w- c:\program files\The Weather Channel Toolbar

2009-08-13 04:57 . 2009-08-13 04:57 -------- d-----w- c:\documents and settings\David\Application Data\Search Settings

2009-08-13 04:57 . 2009-08-13 04:57 -------- d-----w- c:\documents and settings\David\Application Data\Dealio

2009-08-13 04:55 . 2009-08-13 04:55 -------- d-----w- c:\program files\The Weather Channel FW

2009-08-13 04:55 . 2009-08-13 04:57 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\The Weather Channel

2009-08-12 22:49 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll

2009-08-07 00:55 . 2009-08-11 02:06 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\The Witcher

2009-08-07 00:48 . 2009-08-07 00:51 279712 ----a-w- c:\windows\system32\drivers\atksgt.sys

2009-08-07 00:48 . 2009-08-07 00:48 25888 ----a-w- c:\windows\system32\drivers\lirsgt.sys

2009-08-05 19:38 . 2007-06-21 05:53 32768 ----a-w- c:\windows\system32\mf.dll

2009-08-05 13:47 . 2009-08-05 13:47 -------- d-----w- c:\documents and settings\David\My Games

2009-08-05 13:47 . 2009-08-05 13:47 -------- d-----w- c:\documents and settings\All Users\Microsoft

2009-08-04 15:14 . 2009-08-04 15:14 -------- d-----w- c:\documents and settings\David\Application Data\Uniblue

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-01 19:29 . 2009-01-07 00:14 -------- d-----w- c:\documents and settings\David\Application Data\uTorrent

2009-08-31 22:39 . 2009-01-17 03:36 -------- d-----w- c:\documents and settings\David\Application Data\Malwarebytes

2009-08-31 22:39 . 2009-01-17 03:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-08-31 21:21 . 2009-07-07 20:55 -------- d-----w- c:\documents and settings\David\Application Data\vlc

2009-08-31 20:31 . 2009-01-03 04:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-08-25 18:57 . 2009-01-11 02:16 -------- d-----w- c:\documents and settings\David\Application Data\dvdcss

2009-08-25 18:18 . 2009-07-31 18:55 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2009-08-20 19:20 . 2009-01-02 22:49 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-08-05 21:31 . 2009-05-15 19:14 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-08-05 09:01 . 2006-02-28 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-31 15:04 . 2009-07-31 15:04 -------- d-----w- c:\program files\CCleaner

2009-07-20 22:40 . 2009-03-27 01:41 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment

2009-07-17 19:01 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-14 03:43 . 2006-02-28 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-13 20:47 . 2009-01-03 02:13 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-07-13 20:46 . 2009-07-13 20:46 -------- d-----w- c:\documents and settings\David\Application Data\URSoft

2009-07-13 15:27 . 2009-07-13 15:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Trymedia

2009-07-13 15:26 . 2009-07-13 15:26 98304 ----a-w- c:\windows\system32\CmdLineExt.dll

2009-07-10 11:01 . 2009-01-02 22:46 485920 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-07-09 22:01 . 2009-06-03 22:31 139016 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-07-09 22:01 . 2009-06-03 22:31 189488 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-07-08 03:51 . 2009-03-11 19:08 -------- d-----w- c:\program files\NCH Software

2009-07-03 17:09 . 2006-02-28 12:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-06-25 20:36 . 2009-06-28 00:56 1291640 ----a-w- c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\432r8e1b.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe

2009-06-25 20:36 . 2009-06-28 00:56 729088 ----a-w- c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\432r8e1b.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll

2009-06-25 08:25 . 2006-02-28 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll

2009-06-25 08:25 . 2006-02-28 12:00 56832 ----a-w- c:\windows\system32\secur32.dll

2009-06-25 08:25 . 2006-02-28 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll

2009-06-25 08:25 . 2006-02-28 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll

2009-06-25 08:25 . 2006-02-28 12:00 147456 ----a-w- c:\windows\system32\schannel.dll

2009-06-25 08:25 . 2006-02-28 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-24 11:18 . 2006-02-28 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2009-06-18 03:19 . 2009-06-18 03:19 152576 ----a-w- c:\documents and settings\David\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

2009-06-16 14:36 . 2006-02-28 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:36 . 2006-02-28 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-12 12:31 . 2006-02-28 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe

2009-06-12 12:31 . 2006-02-28 12:00 76288 ----a-w- c:\windows\system32\telnet.exe

2009-06-10 14:13 . 2006-02-28 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 13:19 . 2009-01-02 22:35 2066432 ----a-w- c:\windows\system32\mstscax.dll

2009-06-10 06:14 . 2006-02-28 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-06 14:04 . 2009-06-06 14:04 10134 ----a-r- c:\documents and settings\David\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

2009-06-06 01:19 . 2009-06-06 01:19 95952 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-06-03 22:31 . 2009-06-03 22:31 139152 ----a-w- c:\documents and settings\David\Application Data\PnkBstrK.sys

2009-06-03 22:31 . 2009-06-03 22:31 139152 ----a-w- c:\documents and settings\David\Application Data\PnkBstrK.sys

2009-06-03 22:31 . 2009-06-03 22:31 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-06-03 22:31 . 2009-06-03 22:31 794408 ----a-w- c:\windows\system32\pbsvc.exe

2009-03-11 22:20 . 2009-08-17 22:09 208384 ----a-w- c:\program files\mozilla firefox\plugins\uc_rohan_launching.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="f:\programs\steam\steam.exe" [2009-06-11 1217784]

"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-04-23 801904]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-06 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"D-Link Wireless G WDA-1320"="c:\program files\D-Link\Wireless G WDA-1320\AirGCFG.exe" [2007-08-29 1662976]

"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-28 13684736]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"UnlockerAssistant"="f:\programs\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-28 86016]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-11-14 16270848]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-03-28 1657376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=

"c:\\WINDOWS\\ALCFDRTM.EXE"=

"c:\\Program Files\\Java\\jre6\\bin\\jqs.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"f:\\Programs\\halo\\halo.exe"=

"f:\\utorrent.exe"=

"f:\\Programs\\steam\\Steam.exe"=

"f:\\Xfire\\xfire.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"f:\\Programs\\steam\\steamapps\\mibuclan\\team fortress 2\\hl2.exe"=

"f:\\Programs\\steam\\steamapps\\mibuclan\\zombie panic! source\\hl2.exe"=

"f:\\Programs\\steam\\steamapps\\mibuclan\\dystopia\\hl2.exe"=

"f:\\Programs\\steam\\steamapps\\mibuclan\\source sdk base\\hl2.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

"f:\\Programs\\Mass Effect\\Binaries\\MassEffect.exe"=

"f:\\Programs\\Mass Effect\\MassEffectLauncher.exe"=

"c:\\AeriaGames\\WolfTeam\\Wolfteam.bin"=

"f:\\Programs\\steam\\steamapps\\common\\batman arkham asylum - demo\\Binaries\\ShippingPC-BmGame.exe"=

"c:\\ijji\\ENGLISH\\u_gunz.exe"=

"f:\\Programs\\ROHAN\\rohanclient.exe"=

"f:\\Programs\\steam\\steamapps\\common\\killingfloor\\System\\KillingFloor.exe"=

"c:\\WINDOWS\\Downloaded Program Files\\PurpleBean.exe"=

"c:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=

"f:\\Programs\\steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

"f:\\Programs\\uTorrent\\uTorrent.exe"=

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1/2/2009 6:45 PM 13696]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/15/2009 3:14 PM 108289]

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [1/3/2009 10:57 PM 547744]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [1/3/2009 10:57 PM 57376]

S1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS --> c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]

S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\D-Link\Wireless G WDA-1320\JSWUtil\jswpsapi.exe [1/3/2009 10:57 PM 352338]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 pfsvgae;pfsvgae;\??\c:\docume~1\David\LOCALS~1\Temp\pfsvgae.sys --> c:\docume~1\David\LOCALS~1\Temp\pfsvgae.sys [?]

S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS --> c:\program files\SUPERAntiSpyware\SASENUM.SYS [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

.

- - - - ORPHANS REMOVED - - - -

BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)

Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)

WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)

HKCU-Run-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\SUPERAntiSpyware\SASSEH.DLL

Notify-!SASWinLogon - c:\program files\SUPERAntiSpyware\SASWINLO.dll

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

FF - ProfilePath - c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\432r8e1b.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=

FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll

FF - plugin: c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\432r8e1b.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll

FF - plugin: c:\documents and settings\David\Application Data\Mozilla\Firefox\Profiles\432r8e1b.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071301000019.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiCHPlugin.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll

FF - plugin: f:\programs\VLC\npvlc.dll

FF - HiddenExtension: XUL Cache: {DCA59570-1D69-42B4-8952-AB2E6A52492F} - c:\windows\system32\config\systemprofile\Local Settings\Application Data\{DCA59570-1D69-42B4-8952-AB2E6A52492F}\

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-01 15:56

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(1640)

c:\windows\system32\nvappfilter.dll

- - - - - - - > 'explorer.exe'(2720)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\rundll32.exe

c:\windows\ALCFDRTM.EXE

c:\program files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

c:\windows\system32\nvsvc32.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

.

**************************************************************************

.

Completion time: 2009-09-01 16:02 - machine was rebooted

ComboFix-quarantined-files.txt 2009-09-01 20:02

ComboFix2.txt 2009-03-02 22:37

ComboFix3.txt 2009-03-02 20:27

Pre-Run: 21,142,470,656 bytes free

Post-Run: 21,709,496,320 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

277 --- E O F --- 2009-08-27 02:18

Link to post
Share on other sites

Hello.

Please run a new scan with Win32KDiag.

Try running Malwarebytes now...

Download and run MalwareBytes Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.

alternate download link 1

  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware

    [*]Then click Finish.

    [*]MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

    [*]On the Scanner tab:

    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.

    [*]If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.

    [*]The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.

    [*]When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".

    [*]Click OK to close the message box and continue with the removal process.

    [*]Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.

    [*]Make sure that everything is checked, and click Remove Selected.

    [*]When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)

    [*]The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

    [*]Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

For complete or visual instructions on installing and running Malwarebytes Anti-Malware please read this link

With Regards,

Extremeboy

Link to post
Share on other sites

Log file is located at: C:\Documents and Settings\David\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Finished!

Malwarebytes' Anti-Malware 1.40

Database version: 2725

Windows 5.1.2600 Service Pack 3

9/1/2009 4:22:09 PM

mbam-log-2009-09-01 (16-22-09).txt

Scan type: Quick Scan

Objects scanned: 88417

Time elapsed: 6 minute(s), 14 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

Hello.

Those look good. Just some orphaned entries we can take care of at the end.

Update Java and run an online scan.

Update Java to Version 6 Update 16

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 16.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u16-windows-i586.exe to install the newest version.

-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.

-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.

-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

Run ESET Online Scan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    3. Check esetAcceptTerms.png
    4. Click the esetStart.png button.
    5. Accept any security warnings from your browser.
    6. Check esetScanArchives.png
    7. Push the Start button.
    8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    9. When the scan completes, push esetListThreats.png
    10. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    11. Push the esetBack.png button.
    12. Push esetFinish.png

      You can refer to this animation by neomage if needed.
      Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply. Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.
      Thanks.
      With Regards,
      Extremeboy
Link to post
Share on other sites

DDS (Ver_09-07-30.01) - NTFSx86

Run by David at 16:49:56.59 on Tue 09/01/2009

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2815.2300 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

F:\Programs\Unlocker\UnlockerAssistant.exe

C:\WINDOWS\system32\RUNDLL32.EXE

F:\programs\steam\steam.exe

C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\ALCFDRTM.EXE

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Documents and Settings\David\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll

BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll

TB: The Weather Channel Toolbar: {2e5e800e-6ac0-411e-940a-369530a35e43} - c:\windows\system32\TwcToolbarIe7.dll

uRun: [steam] "f:\programs\steam\steam.exe" -silent

uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"

uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [D-Link Wireless G WDA-1320] c:\program files\d-link\wireless g wda-1320\AirGCFG.exe

mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [unlockerAssistant] "f:\programs\unlocker\UnlockerAssistant.exe"

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

dRunOnce: [RunNarrator] Narrator.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233113176062

DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\david\applic~1\mozilla\firefox\profiles\432r8e1b.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=

FF - component: c:\program files\mozilla firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll

FF - plugin: c:\documents and settings\david\application data\mozilla\firefox\profiles\432r8e1b.default\extensions\battlefieldheroespatcher@ea.com\platform\winnt_x86-msvc\plugins\npBFHUpdater.dll

FF - plugin: c:\documents and settings\david\application data\mozilla\firefox\profiles\432r8e1b.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071301000019.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiCHPlugin.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll

FF - plugin: f:\programs\vlc\npvlc.dll

FF - HiddenExtension: XUL Cache: {DCA59570-1D69-42B4-8952-AB2E6A52492F} - c:\windows\system32\config\systemprofile\local settings\application data\{dca59570-1d69-42b4-8952-ab2e6a52492f}\

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-15 11608]

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2009-1-2 13696]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-15 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-15 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-15 55656]

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2009-1-3 547744]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2009-1-3 57376]

S1 SASDIFSV;SASDIFSV;\??\c:\program files\superantispyware\sasdifsv.sys --> c:\program files\superantispyware\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\d-link\wireless g wda-1320\jswutil\jswpsapi.exe [2009-1-3 352338]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 pfsvgae;pfsvgae;\??\c:\docume~1\david\locals~1\temp\pfsvgae.sys --> c:\docume~1\david\locals~1\temp\pfsvgae.sys [?]

S3 SASENUM;SASENUM;\??\c:\program files\superantispyware\sasenum.sys --> c:\program files\superantispyware\SASENUM.SYS [?]

=============== Created Last 30 ================

2009-09-01 16:49 73,728 a------- c:\windows\system32\javacpl.cpl

2009-09-01 16:01 <DIR> -cd----- c:\windows\system32\dllcache\cache

2009-09-01 15:47 <DIR> a-dshr-- C:\cmdcons

2009-09-01 15:46 229,376 a------- c:\windows\PEV.exe

2009-08-31 18:50 <DIR> --d----- c:\program files\Trend Micro

2009-08-31 18:44 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-31 18:44 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-08-31 16:32 <DIR> --d----- c:\program files\SUPERAntiSpyware

2009-08-31 16:32 <DIR> --d----- c:\docume~1\david\applic~1\SUPERAntiSpyware.com

2009-08-20 15:20 208,384 a------- c:\windows\system32\uc_rohan_launching.dll

2009-08-20 15:20 64,000 a------- c:\windows\system32\uc_sfighters_launching.dll

2009-08-20 15:20 61,440 a------- c:\windows\system32\uc_atlantica_launching.dll

2009-08-20 15:20 53,248 a------- c:\windows\system32\uc_luminary_launching.dll

2009-08-20 15:20 87,472 a------- c:\windows\system32\ijjiChannelingPlugin.dll

2009-08-20 15:20 <DIR> --d----- c:\program files\ijji

2009-08-16 21:33 31 a------- c:\windows\GunzLauncher.INI

2009-08-16 21:14 <DIR> --d----- C:\ijji

2009-08-16 21:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ijjigame

2009-08-16 21:07 710,064 a------- c:\windows\system32\ijjiSetup.exe

2009-08-16 21:07 157,144 a------- c:\windows\system32\PubPlugin.dll

2009-08-16 21:07 58,800 a------- c:\windows\system32\ijjiProcessRestarter.exe

2009-08-16 21:07 58,800 a------- c:\windows\system32\ijjiPlugin2.dll

2009-08-16 21:07 <DIR> --d----- c:\program files\NHN USA

2009-08-16 16:39 204,608 a------- c:\windows\BAA Villains screensaver.ico

2009-08-16 16:39 16,577,485 a------- c:\windows\BAA Villains screensaver.scr

2009-08-16 16:39 <DIR> --d----- c:\windows\BAA Villains screensaver Uninstaller

2009-08-16 16:34 204,608 a------- c:\windows\BAA Screensaver.ico

2009-08-16 16:34 5,173,960 a------- c:\windows\BAA Screensaver.scr

2009-08-16 16:34 <DIR> --d----- c:\windows\BAA Screensaver Uninstaller

2009-08-13 00:58 1,060,864 a------- c:\windows\system32\mfc71.dll

2009-08-13 00:58 331,776 a------- c:\windows\system32\TwcToolbarIe7.dll

2009-08-13 00:58 98,304 a------- c:\windows\system32\TwcToolbarBho.dll

2009-08-13 00:58 89,088 a------- c:\windows\system32\atl71.dll

2009-08-13 00:58 25,600 a------- c:\windows\system32\TwcToolInstDll.dll

2009-08-13 00:57 <DIR> --d----- c:\program files\The Weather Channel Toolbar

2009-08-13 00:57 <DIR> --d----- c:\docume~1\david\applic~1\Search Settings

2009-08-13 00:57 <DIR> --d----- c:\docume~1\david\applic~1\Dealio

2009-08-13 00:55 <DIR> --d----- c:\program files\The Weather Channel FW

2009-08-12 18:49 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx

2009-08-12 18:49 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll

2009-08-06 20:48 279,712 a------- c:\windows\system32\drivers\atksgt.sys

2009-08-06 20:48 25,888 a------- c:\windows\system32\drivers\lirsgt.sys

2009-08-05 15:38 32,768 a------- c:\windows\system32\mf.dll

2009-08-05 09:47 <DIR> --d----- c:\documents and settings\david\My Games

2009-08-05 09:47 <DIR> --d----- c:\documents and settings\all users\Microsoft

2009-08-04 11:14 <DIR> --d----- c:\docume~1\david\applic~1\Uniblue

==================== Find3M ====================

2009-09-01 16:49 411,368 a------- c:\windows\system32\deploytk.dll

2009-08-25 14:18 43,520 a------- c:\windows\system32\CmdLineExt03.dll

2009-08-05 17:31 55,656 a------- c:\windows\system32\drivers\avgntflt.sys

2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll

2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll

2009-07-13 11:26 98,304 a------- c:\windows\system32\CmdLineExt.dll

2009-07-10 07:01 485,920 a------- c:\windows\system32\NVUNINST.EXE

2009-07-09 18:01 139,016 a------- c:\windows\system32\drivers\PnkBstrK.sys

2009-07-09 18:01 189,488 a------- c:\windows\system32\PnkBstrB.exe

2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll

2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll

2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll

2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll

2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll

2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll

2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll

2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll

2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll

2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe

2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe

2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll

2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll

2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll

2009-06-03 18:31 139,152 a------- c:\docume~1\david\applic~1\PnkBstrK.sys

2009-06-03 18:31 75,064 a------- c:\windows\system32\PnkBstrA.exe

2009-06-03 18:31 794,408 a------- c:\windows\system32\pbsvc.exe

============= FINISH: 16:50:23.53 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 1/26/2009 11:02:35 AM

System Uptime: 9/1/2009 4:44:51 PM (0 hours ago)

Motherboard: Biostar | | TF 570 SLI

Processor: AMD Athlon 64 X2 Dual Core Processor 5600+ | Socket M2 | 2814/201mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 37 GiB total, 20.181 GiB free.

D: is CDROM ()

F: is FIXED (FAT32) - 298 GiB total, 63.78 GiB free.

G: is Removable

H: is Removable

I: is Removable

J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP201: 9/1/2009 3:47:48 PM - Restore Operation

RP202: 9/1/2009 4:40:55 PM - Removed Java 6 Update 7

RP203: 9/1/2009 4:41:40 PM - Removed Java 6 Update 3

RP204: 9/1/2009 4:42:30 PM - Removed Java 6 Update 12

RP205: 9/1/2009 4:48:55 PM - Installed Java 6 Update 16

==== Installed Programs ======================

Link to post
Share on other sites

Hello.

Try the ESET scan again. If it still doesn't work try one of the alternative online scanners below.

ONLY RUN ONE OF THEM.

Run F-Secure Online Scan

Please run F-Secure Online Scanner. This scan is for Internet Explorer and Mozilla Firefox 3.0 and higher only.

  • It is suggested that you disable security programs and close any other windows during the scan. While your security is disabled, please refrain from surfing on other sites. Refer to this page if you are unsure how.
  • Go to F-Secure Online Scanner page/
  • Accept the License Agreement and select Install.
  • Once the ActiveX installs, click Full System Scan
  • Once the download completes, the scan will begin automatically. The scan will take some time to finish, so please be patient.
  • When the scan completes, click the Automatic cleaning (recommended) button.
  • Click the Show Report button and copy the entire report in your next reply.
  • Be sure to re-enable any security programs afterwards.

---

Run Scan with Kaspersky

Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.)

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Open the Kaspersky WebScanner
    page.
  • Click on the kaspersky_scan_now.gif button on the main page.
  • The program will launch and fill in the Information section on the left.
  • Read the "Requirements and Limitations" then press the Kasaccept.png button.
  • The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish.
  • Once the files have been downloaded, click on the KasperskySettings.png ...button.
    In the scan settings make sure the following are selected:
    • Detect malicious programs of the following categories:
      Viruses, Worms, Trojan Horses, Rootkits
      Spyware, Adware, Dialers and other potentially dangerous programs
    • Scan compound files (doesn't apply to the File scan area):
      Archives
      Mail databases
      By default the above items should already be checked.
    • Click the Kassave.png button, if you made any changes.

    [*]Now under the Scan section on the left:

    Select My Computer

    [*]The program will now start and scan your system. This will run for a while, be patient and let it finish.

    [*]Once the scan is complete, click on View scan report

    [*]Now, click on the Save Report as button.

    [*]Save the file to your desktop.

    [*]Copy and paste that information in your next post.

You can refer to this animation by sundavis if needed.

Take a new DDS run afterward and post back with both the DDS and Attach logs in your next reply.

Also, let me know how your computer is running and if you have any more problems, issues or symptoms left.

Thanks.

With Regards,

Extremeboy

Link to post
Share on other sites

k here is the F-Secure online scan and my pc seems to run just fine.

Scanning Report

Wednesday, September 2, 2009 16:48:23 - 17:26:54

Computer name: HOME

Scanning type: Scan system for malware, spyware and rootkits

Target: C:\ F:\

3 malware found

TrackingCookie.Questionmarket (spyware)

* System (Disinfected)

TrackingCookie.Atdmt (spyware)

* System (Disinfected)

TrackingCookie.Doubleclick (spyware)

* System (Disinfected)

Statistics

Scanned:

* Files: 36743

* System: 3283

* Not scanned: 8

Actions:

* Disinfected: 3

* Renamed: 0

* Deleted: 0

* Not cleaned: 0

* Submitted: 0

Files not scanned:

* C:\PAGEFILE.SYS

* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT

* C:\WINDOWS\SYSTEM32\CONFIG\SAM

* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY

* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE

* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

* C:\SYSTEM VOLUME INFORMATION\MOUNTPOINTMANAGERREMOTEDATABASE

* C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE

Link to post
Share on other sites

DDS (Ver_09-07-30.01) - NTFSx86

Run by David at 20:11:10.57 on Wed 09/02/2009

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2815.2137 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

F:\Programs\Unlocker\UnlockerAssistant.exe

C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

F:\Programs\steam\Steam.exe

F:\Programs\VLC\vlc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\David\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll

BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll

TB: The Weather Channel Toolbar: {2e5e800e-6ac0-411e-940a-369530a35e43} - c:\windows\system32\TwcToolbarIe7.dll

uRun: [steam] "f:\programs\steam\steam.exe" -silent

uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"

uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [D-Link Wireless G WDA-1320] c:\program files\d-link\wireless g wda-1320\AirGCFG.exe

mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [unlockerAssistant] "f:\programs\unlocker\UnlockerAssistant.exe"

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

dRunOnce: [RunNarrator] Narrator.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233113176062

DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\david\applic~1\mozilla\firefox\profiles\432r8e1b.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=

FF - component: c:\program files\mozilla firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll

FF - plugin: c:\documents and settings\david\application data\mozilla\firefox\profiles\432r8e1b.default\extensions\battlefieldheroespatcher@ea.com\platform\winnt_x86-msvc\plugins\npBFHUpdater.dll

FF - plugin: c:\documents and settings\david\application data\mozilla\firefox\profiles\432r8e1b.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071301000019.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiCHPlugin.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll

FF - plugin: f:\programs\vlc\npvlc.dll

FF - HiddenExtension: XUL Cache: {DCA59570-1D69-42B4-8952-AB2E6A52492F} - c:\windows\system32\config\systemprofile\local settings\application data\{dca59570-1d69-42b4-8952-ab2e6a52492f}\

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-15 11608]

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2009-1-2 13696]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-15 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-15 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-15 55656]

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2009-1-3 547744]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2009-1-3 57376]

S1 SASDIFSV;SASDIFSV;\??\c:\program files\superantispyware\sasdifsv.sys --> c:\program files\superantispyware\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\d-link\wireless g wda-1320\jswutil\jswpsapi.exe [2009-1-3 352338]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 pfsvgae;pfsvgae;\??\c:\docume~1\david\locals~1\temp\pfsvgae.sys --> c:\docume~1\david\locals~1\temp\pfsvgae.sys [?]

S3 SASENUM;SASENUM;\??\c:\program files\superantispyware\sasenum.sys --> c:\program files\superantispyware\SASENUM.SYS [?]

=============== Created Last 30 ================

2009-09-02 16:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\F-Secure

2009-09-02 16:25 <DIR> --d----- c:\program files\ESET

2009-09-01 21:58 <DIR> --d----- c:\program files\common files\HP

2009-09-01 21:58 <DIR> --d----- c:\program files\common files\Hewlett-Packard

2009-09-01 21:57 118,272 a------- c:\windows\system32\hpz3l5mu.dll

2009-09-01 21:56 <DIR> --d----- c:\program files\HP

2009-09-01 21:55 163,142 a------- c:\windows\hpoins28.dat

2009-09-01 21:55 796 -------- c:\windows\hpomdl28.dat

2009-09-01 16:49 73,728 a------- c:\windows\system32\javacpl.cpl

2009-09-01 16:01 <DIR> -cd----- c:\windows\system32\dllcache\cache

2009-09-01 15:47 <DIR> a-dshr-- C:\cmdcons

2009-09-01 15:46 229,376 a------- c:\windows\PEV.exe

2009-08-31 18:50 <DIR> --d----- c:\program files\Trend Micro

2009-08-31 18:44 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-31 18:44 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-08-31 16:32 <DIR> --d----- c:\program files\SUPERAntiSpyware

2009-08-31 16:32 <DIR> --d----- c:\docume~1\david\applic~1\SUPERAntiSpyware.com

2009-08-20 15:20 208,384 a------- c:\windows\system32\uc_rohan_launching.dll

2009-08-20 15:20 64,000 a------- c:\windows\system32\uc_sfighters_launching.dll

2009-08-20 15:20 61,440 a------- c:\windows\system32\uc_atlantica_launching.dll

2009-08-20 15:20 53,248 a------- c:\windows\system32\uc_luminary_launching.dll

2009-08-20 15:20 87,472 a------- c:\windows\system32\ijjiChannelingPlugin.dll

2009-08-20 15:20 <DIR> --d----- c:\program files\ijji

2009-08-16 21:33 31 a------- c:\windows\GunzLauncher.INI

2009-08-16 21:14 <DIR> --d----- C:\ijji

2009-08-16 21:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ijjigame

2009-08-16 21:07 710,064 a------- c:\windows\system32\ijjiSetup.exe

2009-08-16 21:07 157,144 a------- c:\windows\system32\PubPlugin.dll

2009-08-16 21:07 58,800 a------- c:\windows\system32\ijjiProcessRestarter.exe

2009-08-16 21:07 58,800 a------- c:\windows\system32\ijjiPlugin2.dll

2009-08-16 21:07 <DIR> --d----- c:\program files\NHN USA

2009-08-16 16:39 204,608 a------- c:\windows\BAA Villains screensaver.ico

2009-08-16 16:39 16,577,485 a------- c:\windows\BAA Villains screensaver.scr

2009-08-16 16:39 <DIR> --d----- c:\windows\BAA Villains screensaver Uninstaller

2009-08-16 16:34 204,608 a------- c:\windows\BAA Screensaver.ico

2009-08-16 16:34 5,173,960 a------- c:\windows\BAA Screensaver.scr

2009-08-16 16:34 <DIR> --d----- c:\windows\BAA Screensaver Uninstaller

2009-08-13 00:58 1,060,864 a------- c:\windows\system32\mfc71.dll

2009-08-13 00:58 331,776 a------- c:\windows\system32\TwcToolbarIe7.dll

2009-08-13 00:58 98,304 a------- c:\windows\system32\TwcToolbarBho.dll

2009-08-13 00:58 89,088 a------- c:\windows\system32\atl71.dll

2009-08-13 00:58 25,600 a------- c:\windows\system32\TwcToolInstDll.dll

2009-08-13 00:57 <DIR> --d----- c:\program files\The Weather Channel Toolbar

2009-08-13 00:57 <DIR> --d----- c:\docume~1\david\applic~1\Search Settings

2009-08-13 00:57 <DIR> --d----- c:\docume~1\david\applic~1\Dealio

2009-08-13 00:55 <DIR> --d----- c:\program files\The Weather Channel FW

2009-08-12 18:49 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx

2009-08-12 18:49 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll

2009-08-06 20:48 279,712 a------- c:\windows\system32\drivers\atksgt.sys

2009-08-06 20:48 25,888 a------- c:\windows\system32\drivers\lirsgt.sys

2009-08-05 15:38 32,768 a------- c:\windows\system32\mf.dll

2009-08-05 09:47 <DIR> --d----- c:\documents and settings\david\My Games

2009-08-05 09:47 <DIR> --d----- c:\documents and settings\all users\Microsoft

2009-08-04 11:14 <DIR> --d----- c:\docume~1\david\applic~1\Uniblue

==================== Find3M ====================

2009-09-01 16:49 411,368 a------- c:\windows\system32\deploytk.dll

2009-08-25 14:18 43,520 a------- c:\windows\system32\CmdLineExt03.dll

2009-08-05 17:31 55,656 a------- c:\windows\system32\drivers\avgntflt.sys

2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll

2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll

2009-07-13 11:26 98,304 a------- c:\windows\system32\CmdLineExt.dll

2009-07-10 07:01 485,920 a------- c:\windows\system32\NVUNINST.EXE

2009-07-09 18:01 139,016 a------- c:\windows\system32\drivers\PnkBstrK.sys

2009-07-09 18:01 189,488 a------- c:\windows\system32\PnkBstrB.exe

2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll

2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll

2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll

2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll

2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll

2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll

2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll

2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll

2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll

2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe

2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe

2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll

2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll

2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll

2009-06-03 18:31 139,152 a------- c:\docume~1\david\applic~1\PnkBstrK.sys

============= FINISH: 20:11:26.37 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 1/26/2009 11:02:35 AM

System Uptime: 9/2/2009 4:07:30 PM (4 hours ago)

Motherboard: Biostar | | TF 570 SLI

Processor: AMD Athlon 64 X2 Dual Core Processor 5600+ | Socket M2 | 2814/201mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 37 GiB total, 15.074 GiB free.

D: is CDROM ()

F: is FIXED (FAT32) - 298 GiB total, 63.533 GiB free.

G: is Removable

H: is Removable

I: is Removable

J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP201: 9/1/2009 3:47:48 PM - Restore Operation

RP202: 9/1/2009 4:40:55 PM - Removed Java 6 Update 7

RP203: 9/1/2009 4:41:40 PM - Removed Java 6 Update 3

RP204: 9/1/2009 4:42:30 PM - Removed Java 6 Update 12

RP205: 9/1/2009 4:48:55 PM - Installed Java 6 Update 16

RP206: 9/2/2009 7:50:19 PM - System Checkpoint

==== Installed Programs ======================

Link to post
Share on other sites

Hello.

That's good to hear.

Just a couple of things left and we're pretty much done. :)

--

Peer-to-Peer Programs Warning

Your log shows that you are using so called peer-to-peer or file-sharing programs (in your case UTorrent). These programs allow to share files between users as the name(s) suggest. In today's world cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organizations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves.

Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office."

It is your decision whether or not you wish to keep your program(s) but I suggest you remove it via add/remove. However, please refrain from using them until your computer has been declared clean.

Download and Run OTM

  1. Please download OTM by OldTimer and save it to your desktop.
  2. Double click the OTMdesktopicon.png icon on your desktop If you are running on Vista, right click on the file and choose Run As Administrator.
  3. Paste the following code under the pasteline.png area. Do not include the word "Code".
    :services
    pfsvgae
    npggsvc
    :files
    c:\docume~1\david\locals~1\temp\pfsvgae.sys
    c:\windows\system32\gamemon.des
    :commands
    [EmptyTemp]
    [Reboot]


  4. Click the large btnmoveit.png button.
  5. If OTM requires are reboot, please allow it to do so.
  6. Copy/Paste the contents under the results.png line here in your next reply.

Note: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Take a new DDS run afterward and post back with ONLY the DDS in your next reply.

Thanks.

With Regards,

Extremeboy

Link to post
Share on other sites

All processes killed

========== SERVICES/DRIVERS ==========

Service\Driver pfsvgae deleted successfully.

Service\Driver npggsvc deleted successfully.

========== FILES ==========

File/Folder c:\docume~1\david\locals~1\temp\pfsvgae.sys not found.

c:\windows\system32\GameMon.des moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: David

->Temp folder emptied: 1068542141 bytes

->Temporary Internet Files folder emptied: 12310927 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 120377001 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes

C:\WINDOWS\64F6748976BB4CDDA236F954BE774B35.TMP folder deleted successfully.

C:\WINDOWS\NV15001976.TMP folder deleted successfully.

C:\WINDOWS\NV15761228.TMP folder deleted successfully.

C:\WINDOWS\NV16361612.TMP folder deleted successfully.

C:\WINDOWS\NV30843088.TMP folder deleted successfully.

C:\WINDOWS\NV3676408.TMP folder deleted successfully.

C:\WINDOWS\NV8841536.TMP folder deleted successfully.

%systemroot% .tmp files removed: 21463891 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

Windows Temp folder emptied: 236083 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 1166.31 mb

OTM by OldTimer - Version 3.0.0.6 log created on 09032009_172908

Files moved on Reboot...

Registry entries deleted on Reboot...

DDS (Ver_09-07-30.01) - NTFSx86

Run by David at 17:34:49.95 on Thu 09/03/2009

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2815.2157 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\WINDOWS\notepad.exe

C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

F:\Programs\Unlocker\UnlockerAssistant.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

F:\programs\steam\steam.exe

C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\ALCFDRTM.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\David\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll

BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll

TB: The Weather Channel Toolbar: {2e5e800e-6ac0-411e-940a-369530a35e43} - c:\windows\system32\TwcToolbarIe7.dll

uRun: [steam] "f:\programs\steam\steam.exe" -silent

uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"

uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [D-Link Wireless G WDA-1320] c:\program files\d-link\wireless g wda-1320\AirGCFG.exe

mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [unlockerAssistant] "f:\programs\unlocker\UnlockerAssistant.exe"

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

dRunOnce: [RunNarrator] Narrator.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1233113176062

DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\david\applic~1\mozilla\firefox\profiles\432r8e1b.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=

FF - component: c:\program files\mozilla firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll

FF - plugin: c:\documents and settings\david\application data\mozilla\firefox\profiles\432r8e1b.default\extensions\battlefieldheroespatcher@ea.com\platform\winnt_x86-msvc\plugins\npBFHUpdater.dll

FF - plugin: c:\documents and settings\david\application data\mozilla\firefox\profiles\432r8e1b.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071301000019.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiCHPlugin.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll

FF - plugin: f:\programs\vlc\npvlc.dll

FF - HiddenExtension: XUL Cache: {DCA59570-1D69-42B4-8952-AB2E6A52492F} - c:\windows\system32\config\systemprofile\local settings\application data\{dca59570-1d69-42b4-8952-ab2e6a52492f}\

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-15 11608]

R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2009-1-2 13696]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-15 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-15 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-15 55656]

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2009-1-3 547744]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2009-1-3 57376]

S1 SASDIFSV;SASDIFSV;\??\c:\program files\superantispyware\sasdifsv.sys --> c:\program files\superantispyware\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\d-link\wireless g wda-1320\jswutil\jswpsapi.exe [2009-1-3 352338]

S3 SASENUM;SASENUM;\??\c:\program files\superantispyware\sasenum.sys --> c:\program files\superantispyware\SASENUM.SYS [?]

=============== Created Last 30 ================

2009-09-03 17:29 <DIR> --d----- C:\_OTM

2009-09-03 07:37 <DIR> --dsh--- c:\windows\ftpcache

2009-09-03 07:34 289 a------- c:\windows\game.ini

2009-09-02 20:57 <DIR> --d----- c:\windows\Performance

2009-09-02 20:56 <DIR> --d----- c:\program files\Microsoft Windows 7 Upgrade Advisor

2009-09-02 16:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\F-Secure

2009-09-01 21:58 <DIR> --d----- c:\program files\common files\HP

2009-09-01 21:58 <DIR> --d----- c:\program files\common files\Hewlett-Packard

2009-09-01 21:57 118,272 a------- c:\windows\system32\hpz3l5mu.dll

2009-09-01 21:56 <DIR> --d----- c:\program files\HP

2009-09-01 21:55 163,142 a------- c:\windows\hpoins28.dat

2009-09-01 21:55 796 -------- c:\windows\hpomdl28.dat

2009-09-01 16:49 73,728 a------- c:\windows\system32\javacpl.cpl

2009-09-01 16:01 <DIR> -cd----- c:\windows\system32\dllcache\cache

2009-09-01 15:47 <DIR> a-dshr-- C:\cmdcons

2009-09-01 15:46 229,376 a------- c:\windows\PEV.exe

2009-08-31 18:50 <DIR> --d----- c:\program files\Trend Micro

2009-08-31 18:44 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-31 18:44 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-08-31 16:32 <DIR> --d----- c:\program files\SUPERAntiSpyware

2009-08-31 16:32 <DIR> --d----- c:\docume~1\david\applic~1\SUPERAntiSpyware.com

2009-08-20 15:20 208,384 a------- c:\windows\system32\uc_rohan_launching.dll

2009-08-20 15:20 64,000 a------- c:\windows\system32\uc_sfighters_launching.dll

2009-08-20 15:20 61,440 a------- c:\windows\system32\uc_atlantica_launching.dll

2009-08-20 15:20 53,248 a------- c:\windows\system32\uc_luminary_launching.dll

2009-08-20 15:20 87,472 a------- c:\windows\system32\ijjiChannelingPlugin.dll

2009-08-20 15:20 <DIR> --d----- c:\program files\ijji

2009-08-16 21:33 31 a------- c:\windows\GunzLauncher.INI

2009-08-16 21:14 <DIR> --d----- C:\ijji

2009-08-16 21:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ijjigame

2009-08-16 21:07 710,064 a------- c:\windows\system32\ijjiSetup.exe

2009-08-16 21:07 157,144 a------- c:\windows\system32\PubPlugin.dll

2009-08-16 21:07 58,800 a------- c:\windows\system32\ijjiProcessRestarter.exe

2009-08-16 21:07 58,800 a------- c:\windows\system32\ijjiPlugin2.dll

2009-08-16 21:07 <DIR> --d----- c:\program files\NHN USA

2009-08-16 16:39 204,608 a------- c:\windows\BAA Villains screensaver.ico

2009-08-16 16:39 16,577,485 a------- c:\windows\BAA Villains screensaver.scr

2009-08-16 16:39 <DIR> --d----- c:\windows\BAA Villains screensaver Uninstaller

2009-08-16 16:34 204,608 a------- c:\windows\BAA Screensaver.ico

2009-08-16 16:34 5,173,960 a------- c:\windows\BAA Screensaver.scr

2009-08-16 16:34 <DIR> --d----- c:\windows\BAA Screensaver Uninstaller

2009-08-13 00:58 1,060,864 a------- c:\windows\system32\mfc71.dll

2009-08-13 00:58 331,776 a------- c:\windows\system32\TwcToolbarIe7.dll

2009-08-13 00:58 98,304 a------- c:\windows\system32\TwcToolbarBho.dll

2009-08-13 00:58 89,088 a------- c:\windows\system32\atl71.dll

2009-08-13 00:58 25,600 a------- c:\windows\system32\TwcToolInstDll.dll

2009-08-13 00:57 <DIR> --d----- c:\program files\The Weather Channel Toolbar

2009-08-13 00:57 <DIR> --d----- c:\docume~1\david\applic~1\Search Settings

2009-08-13 00:57 <DIR> --d----- c:\docume~1\david\applic~1\Dealio

2009-08-13 00:55 <DIR> --d----- c:\program files\The Weather Channel FW

2009-08-12 18:49 128,512 -c------ c:\windows\system32\dllcache\dhtmled.ocx

2009-08-12 18:49 1,315,328 -c------ c:\windows\system32\dllcache\msoe.dll

2009-08-06 20:48 279,712 a------- c:\windows\system32\drivers\atksgt.sys

2009-08-06 20:48 25,888 a------- c:\windows\system32\drivers\lirsgt.sys

2009-08-05 15:38 32,768 a------- c:\windows\system32\mf.dll

2009-08-05 09:47 <DIR> --d----- c:\documents and settings\david\My Games

2009-08-05 09:47 <DIR> --d----- c:\documents and settings\all users\Microsoft

==================== Find3M ====================

2009-09-01 16:49 411,368 a------- c:\windows\system32\deploytk.dll

2009-08-25 14:18 43,520 a------- c:\windows\system32\CmdLineExt03.dll

2009-08-05 17:31 55,656 a------- c:\windows\system32\drivers\avgntflt.sys

2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll

2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll

2009-07-13 11:26 98,304 a------- c:\windows\system32\CmdLineExt.dll

2009-07-10 07:01 485,920 a------- c:\windows\system32\NVUNINST.EXE

2009-07-09 18:01 139,016 a------- c:\windows\system32\drivers\PnkBstrK.sys

2009-07-09 18:01 189,488 a------- c:\windows\system32\PnkBstrB.exe

2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll

2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll

2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll

2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll

2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll

2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll

2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll

2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll

2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll

2009-06-12 08:31 80,896 a------- c:\windows\system32\tlntsess.exe

2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe

2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll

2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll

2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll

2009-06-03 18:31 139,152 a------- c:\docume~1\david\applic~1\PnkBstrK.sys

============= FINISH: 17:35:14.10 ===============

Link to post
Share on other sites

Hello.

That looks good.

We can cleanup now. :)

Please follow/read the steps below to remove the tools we used and for some more information. :)

Uninstall ComboFix

Remove Combofix now that we're done with it.

  • Click on your Start Menu, then Run....
  • Now type combofix /u in the runbox and click OK. Notice the space between the "x" and "/".
    CF_Cleanup.png
  • You will then recieve a message letting you know that Combofix was uninstalled Successfully.

This will remove files/folders assoicated with combofix and uninstall it.

Download and Run OTC

We will now remove the tools we used during this fix using OTC.

  • Download OTC by OldTimer and save it to your desktop.
  • Double click OTC_Icon.jpg icon to start the program. If you are using Vista, please right-click and choose run as administrator
  • Then Click the big CleanUp.jpg button.
  • You will get a prompt saying "Being Cleanup Process". Please select Yes.
  • Restart your computer when prompted.

System A bit Slow? Try StartupLight

You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve preformance.

If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.

Congratulations! You now appear clean! :)

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

[*]Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a sm

Link to post
Share on other sites

You're welcome :(

Since the problem appears to be resolved, this topic is now Closed. Glad we could help ;)

If you need this topic reopened, pleaseSend Me a Message. In your message please include the address of this thread in your request.

This applies only to the original topic starter

Everyone else please start a new topic in the Hijackthis-Malware Removal Forum

With Regards,

Extremeboy

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.