Problem at Bootup - Attempted entry to unknown IP

Possum47 · May 28, 2010

G'day. I trust I have everything for you to solve this problem. I have included a snap of my Firewall Log so that the problem can be shown to you.

Malwarebytes' Anti-Malware PRO Version Log

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4150

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

28/05/2010 12:17:42 PM

mbam-log-2010-05-28 (12-17-42).txt

Scan type: Quick scan

Objects scanned: 150410

Time elapsed: 4 minute(s), 50 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS Log File

DDS (Ver_10-03-17.01) - NTFSx86

Run by Stephen D Beakey at 12:38:18.75 on Fri 28/05/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.3583.2774 [GMT 10:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning disabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}

FW: Privatefirewall *enabled* {AF0CFAAE-AAB5-450a-8C74-0DEEB429DF4F}

FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Privacyware\Privatefirewall 7.0\pfsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Stardock\SDMCP.exe

svchost.exe

C:\Program Files\BrigSoft\AtomicClockService\PCAtomicServ.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\imapi.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Privacyware\Privatefirewall 7.0\pfgui.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

svchost.exe

D:\Stardock\ObjectDock\ObjectDock.exe

C:\PROGRA~1\DeskMates\Manager.exe

C:\PROGRA~1\DeskMates\Sprite.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

D:\Wallpaper Master\Wallpaper.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\dvd43\dvd43_tray.exe

C:\Program Files\Opdicom\OpdiTracker\OptT3STA.exe

D:\Softany\Monitor Control\MonitorControl.exe

D:\Stardock\CursorFX\CursorFX.exe

D:\Oregon Scientific\Weather OS\Weather OS.exe

D:\Sharp World Clock\Sharp World Clock.exe

D:\Active Desktop Calendar\ADC.exe

D:\CyberLink\Power2Go\Power2Go\Power2GoExpress.exe

C:\Downloads\dds.com

============== Pseudo HJT Report ===============

uStart Page = about:blank

uSearch Bar =

uSearch Page =

uDefault_Search_URL = hxxp://www.google.com/ie

uWindow Title = Stephen D Beakey @ Possum

mSearch Page = hxxp://www.google.com

mStart Page = about:blank

mSearch Bar = hxxp://google.com.au

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant =

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - d:\avg\avgls\toolbar\IEToolbar.dll

uURLSearchHooks: H - No File

mWinlogon: UIHost=c:\windows\system32\logonuiX.exe

BHO: AutorunsDisabled - No File

BHO: Cdcovers Toolbar: {13e0b548-6fc9-47e9-9874-470915f46548} - c:\program files\cdcovers\tbCdc0.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: eBay Toolbar Helper: {22d8e815-4a5e-4dfb-845e-aab64207f5bd} - c:\program files\ebay\ebay toolbar2\eBayTB.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - d:\avg\avgls\avgssie.dll

BHO: BHO Class: {8b3868b4-eba8-48fa-a19b-e1dfb99066fa} - d:\flashcapture\fcbho.dll

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - d:\avg\avgls\toolbar\IEToolbar.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\siteadvisor\mcieplg.dll

BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\dap\dapieloader.dll

TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - d:\veoh networks\veoh\plugins\reg\VeohToolbar.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\siteadvisor\mcieplg.dll

TB: eBay Toolbar: {92085ad4-f48a-450d-bd93-b28cc7df67ce} - c:\program files\ebay\ebay toolbar2\eBayTB.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - d:\avg\avgls\toolbar\IEToolbar.dll

TB: Cdcovers Toolbar: {13e0b548-6fc9-47e9-9874-470915f46548} - c:\program files\cdcovers\tbCdc0.dll

TB: TerraTec Home Cinema: {ad6e6555-fb2c-47d4-8339-3e2965509877} - c:\progra~1\terratec\terratec home cinema\ThcDeskBand.dll

TB: Google Web Accelerator: {db87bfa2-a2e3-451e-8e5a-c89982d87cbf} - c:\program files\google\web accelerator\GoogleWebAccToolbar.dll

TB: {0388BA0C-C7F1-4E6A-BD7A-B59623F33363} - No File

TB: livetvbar Toolbar: {ad55c869-668e-457c-b270-0cfb2f61116f} - c:\program files\livetvbar\tbliv0.dll

EB: ICQToolBar: {855f3b16-6d32-4fe6-8a56-bbb695989046} - c:\program files\icq6toolbar\ICQToolBar.dll

mRun: [startupDelayer] "d:\startup delayer\Startup Launcher.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [Privatefirewall] c:\program files\privacyware\privatefirewall 7.0\pfgui.exe

mRun: [bootSkin Startup Jobs] "d:\stardock\wincustomize\bootskin\bootskin.exe" /StartupJobs

uPolicies-explorer: EditLevel = 0 (0x0)

uPolicies-explorer: NoCommonGroups = 0 (0x0)

uPolicies-explorer: ForceCopyAclwithFile = 1 (0x1)

uPolicies-explorer: NoFavoritesMenu = 1 (0x1)

uPolicies-explorer: NoSMMyDocs = 1 (0x1)

uPolicies-explorer: NoStartMenuMyMusic = 1 (0x1)

uPolicies-explorer: NoSMMyPictures = 1 (0x1)

uPolicies-explorer: NoActiveDesktop = 00000000

uPolicies-explorer: HideClock = 0 (0x0)

mPolicies-explorer: NoFavoritesMenu = 1 (0x1)

mPolicies-explorer: NoSMMyDocs = 1 (0x1)

mPolicies-explorer: NoStartMenuMyMusic = 1 (0x1)

mPolicies-explorer: NoSMMyPictures = 1 (0x1)

mPolicies-explorer: NoResolveTrack = 1 (0x1)

mPolicies-explorer: NoFileAssociate = 0 (0x0)

mPolicies-system: NoDispSettingsPage = 0 (0x0)

IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm

IE: &Download with &DAP - c:\program files\dap\dapextie.htm

IE: Download &all with DAP - c:\program files\dap\dapextie2.htm

IE: eBay Search - c:\program files\ebay\ebay toolbar2\eBayTb.dll/RCSearch.html

IE: Sothink SWF Catcher - c:\program files\common files\sourcetec\swf catcher\InternetExplorer.htm

IE: {E59EB121-F339-4851-A3BA-FE49C35617C2}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

LSP: c:\program files\avira\antivir desktop\avsda.dll

Trusted Zone: internet

Trusted Zone: mcafee.com

Trusted Zone: microsoft.com\update

DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\siteadvisor\McIEPlg.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - d:\avg\avgls\avgpp.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\siteadvisor\McIEPlg.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

Notify: MCPClient - c:\progra~1\common~1\stardock\mcpstub.dll

Notify: WBSrv - d:\stardock\window~1\wbsrv.dll

AppInit_DLLs: wbsys.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - d:\stardock\iconpackager\iprepair.dll

SSODL: EnhancedDialog - {6D972050-A934-44D7-AC67-7C9E0B264220} - d:\stardock\enhanceddialog\enhdlginit.dll

SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - c:\progra~1\common~1\stardock\mcpcore.dll

STS: Stardock Vista ControlPanel Extension: {ec654325-1273-c2a9-2b7c-45d29bce68fd} - Stardock Vista ControlPanel Extension

STS: StardockDreamController: {ec654325-1273-c2a9-2b7c-45d29bce68ff} - StardockDreamController

STS: ObjectDockShlExt Class: {1984d045-52cf-49cd-db77-08f378fea4db} - d:\stardock\objectdock\ODMenu.dll

SEH: AssociateThis: {a7040f42-7dc2-473c-b01d-105c130706c5} - Associate This Shell Extension

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

SEH: ExecuteHooker Class: {569dac0f-2791-46ab-8efc-a54b77c04c20} - d:\dvd programmes\dvd ghost\ExecuteHooker.dll

SEH: DVDIdleShell Class: {93994de8-8239-4655-b1d1-5f4e91300429} - d:\dvdpro~1\dvdreg~1\DVDShell.dll

LSA: Authentication Packages = msv1_0 relog_ap

mASetup: {9C450606-ED24-4958-92BA-B8940C99D441} - c:\program files\pixiepack codec pack\InstallerHelper.exe

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\stephe~1\applic~1\mozilla\firefox\profiles\aqtf7q1m.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:blank

FF - prefs.js: keyword.URL - hxxp://www.ask.com/web?o=13701&l=dis&q=

FF - plugin: c:\documents and settings\all users\application data\zylom\zylomgamesplayer\npzylomgamesplayer.dll

FF - plugin: c:\documents and settings\stephen d beakey\application data\mozilla\plugins\npPxPlay.dll

FF - plugin: c:\documents and settings\stephen d beakey\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: d:\adobe\reader 9.0\reader\browser\nppdf32.dll

FF - plugin: d:\browsers\mozilla firefox\plugins\npwachk.dll

FF - plugin: d:\browsers\opera\program\plugins\npdsplay.dll

FF - plugin: d:\browsers\opera\program\plugins\nppl3260.dll

FF - plugin: d:\browsers\opera\program\plugins\npqtplugin.dll

FF - plugin: d:\browsers\opera\program\plugins\npqtplugin2.dll

FF - plugin: d:\browsers\opera\program\plugins\npqtplugin3.dll

FF - plugin: d:\browsers\opera\program\plugins\npqtplugin4.dll

FF - plugin: d:\browsers\opera\program\plugins\npqtplugin5.dll

FF - plugin: d:\browsers\opera\program\plugins\npqtplugin6.dll

FF - plugin: d:\browsers\opera\program\plugins\npqtplugin7.dll

FF - plugin: d:\browsers\opera\program\plugins\nprpjplug.dll

FF - plugin: d:\browsers\opera\program\plugins\NPSWF32.dll

FF - plugin: d:\browsers\opera\program\plugins\npwmsdrm.dll

FF - plugin: d:\picasa35\npPicasa2.dll

FF - plugin: d:\picasa35\npPicasa3.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - d:\browsers\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - d:\browsers\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: browser.blink_allowed - true

FF - user.js: network.prefetch-next - true

FF - user.js: layout.spellcheckDefault - 1

FF - user.js: browser.urlbar.autoFill - false

FF - user.js: browser.search.openintab - false

FF - user.js: browser.tabs.closeButtons - 1

FF - user.js: browser.tabs.opentabfor.middleclick - true

FF - user.js: browser.tabs.tabMinWidth - 100

d:\browsers\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

d:\browsers\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

d:\browsers\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

d:\browsers\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

d:\browsers\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

d:\browsers\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

d:\browsers\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

d:\browsers\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

d:\browsers\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

d:\browsers\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

d:\browsers\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

d:\browsers\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

d:\browsers\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

d:\browsers\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

d:\browsers\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2009-10-11 21488]

R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2009-10-11 15856]

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-2-26 11608]

R1 AvgLdx86;AVG LinkScanner

Attach.zip

Elise · May 28, 2010

Hello ,

And :welcome: My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)

Possum47 · May 29, 2010

Elise, Thank you for the reply. PLEASE, be advised that this thread could extend over two or more replies as it has been indicated that the reply is too long. Sorry about that. Hereunder, in this first reply, are the new logs for DDS and GMER that you have requested, together with an explanation of the problem and steps taken :

The problem I am experiencing is that at every boot svchost.exe is invoked in an attempt to connect to IP Address 239.255.255.250 Port 1900. I have entered this address into Firefox and it leads to Ask.com (a Search Engine I have never used) with one item displayed - http://www.leechermods.com/2007_01_archive.htm ( a site I have never visited). My Firewall programme is presently blocking access to this site, however I would like to prevent this activity.

I have searched my Registry with the parameters : 239.255 - leecher - ask.com and anything else I could think of, with the only result coming from Ask.com which is the preferred search engine for Download Accelerator Plus, a programme which I do not use as files downloaded by it are corrupt or have an 'unexpected end to the archive'.

I have scanned my drives with Malwarebyter Anti-Malware Pro, Avira Anti-virus Premium (with Services, processes, and executables disabled by one when scanning with the other) and ESET Online Scanner. All came back with negative results. I have used SuperAntiSPYWARE to scan for malware threat with two false positives being recorded. However, as a consequence I quarantined each entry and will re-establish them if and when this problem is solved.

I did observe that after using GMER this time around that my system refused to shutdown forcing a cold boot. When I checked my Firewall Log after the boot I found that the entries to the above IP Address were missing, but came back after another re-boot.

Attach.zip and Snap1 are attached to this reply

DDS Log (29.05.10)

DDS (Ver_10-03-17.01) - NTFSx86

Run by Stephen D Beakey at 10:34:09.10 on Sat 29/05/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.3583.2756 [GMT 10:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

AV: PC Tools AntiVirus 6.1.0.25 *On-access scanning disabled* (Updated) {832E7172-E406-4bb2-8B19-6D29F2C93A98}

FW: Privatefirewall *enabled* {AF0CFAAE-AAB5-450a-8C74-0DEEB429DF4F}

FW: Sunbelt Personal Firewall *disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Privacyware\Privatefirewall 7.0\pfsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\Program Files\Common Files\Stardock\SDMCP.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\BrigSoft\AtomicClockService\PCAtomicServ.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\System32\imapi.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Privacyware\Privatefirewall 7.0\pfgui.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

C:\WINDOWS\system32\wuauclt.exe

svchost.exe

D:\Stardock\ObjectDock\ObjectDock.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

D:\Wallpaper Master\Wallpaper.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\dvd43\dvd43_tray.exe

C:\Program Files\Opdicom\OpdiTracker\OptT3STA.exe

D:\Softany\Monitor Control\MonitorControl.exe

D:\Stardock\CursorFX\CursorFX.exe

D:\Oregon Scientific\Weather OS\Weather OS.exe

D:\Sharp World Clock\Sharp World Clock.exe

D:\Stardock\Wincustomize\Bootskin\bootskin.exe

D:\Active Desktop Calendar\ADC.exe

D:\CyberLink\Power2Go\Power2Go\Power2GoExpress.exe

C:\Downloads\M'Bytes files\dds.com