Malwarebytes Stops & Closes

fxp · August 9, 2010

I run a Dell with Windows XP fully patched and up-to-date. It now seems to run slow and the keyboard crashes, just stops working. I usually run Malwarebytes weekly and the app works fine and doesn't find a problem. Now, Malwarebytes starts slow, stops during execution and the last time closed before ending without creating a log file. I first thought I had a bad keyboard, but now am not so sure. I've enclosed a link for the hijacthis.log file. Thanks for any help you can give me to figure out what is going on.

http://cid-c96b5052195124ca.office.live.co.../hijackthis.log

fxp · August 10, 2010

I ran Avast! and it found Win32Malware-gen which it moved to the Virus Chest. I don't know if this has fixed it, will run more diagnostics.

screen317 · August 10, 2010

Hi and welcome to Malwarebytes.

In the future please post all logs directly into your reply instead of attaching them.

Please download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

fxp · August 10, 2010

Hi Chris,

Thanks for the fast reply. It looks like Avast! didn't fix the problem. After it found something and isolated it, pc still runs slow.

I am pasting the DDS report you requested.

Thanks again.

Frank

DDS (Ver_10-03-17.01) - NTFSx86

Run by Frank at 16:01:38.48 on Tue 08/10/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.9 [GMT -4:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\System32\inetsrv\inetinfo.exe

C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe

C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

C:\WINDOWS\System32\DSentry.exe

C:\WINDOWS\system32\JupitCo.exe

C:\WINDOWS\TPPALDR.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\SiteAdvisor\6253\SiteAdv.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe

C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe

C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

C:\Program Files\Nero\Nero 7\InCD\InCD.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\HDD Thermometer\HDD Thermometer.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

C:\Program Files\TurboNote\tbnote.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\SysInternals\ProcessExplorer\procexp.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\AutoHotkey\AutoHotkey.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Frank\Desktop\dds.scr

C:\Documents and Settings\Frank\Local Settings\Temp\B.tmp\evP.exe

C:\Documents and Settings\Frank\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.com

uSearch Bar =

uWindow Title = Microsoft Internet Explorer

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

mWinlogon: Userinit=c:\windows\system32\Userinit.exe

BHO: {089fd14d-132b-48fc-8861-0048ae113215} - c:\program files\siteadvisor\6261\SiteAdv.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Netcraft Toolbar: {d554d8fc-b36d-4bb4-93db-4a3394d505e3} - c:\program files\netcraft toolbar\nctb.dll

TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\6261\SiteAdv.dll

TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

EB: Notes: {0432fc96-1af4-11d4-9996-00b0d0278826} - c:\windows\system32\Shdocvw.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"

uRun: [RSD_HDDThermo] c:\program files\hdd thermometer\HDD Thermometer.exe

uRun: [Google Update] "c:\documents and settings\frank\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [iE Privacy Keeper] "c:\program files\unh solutions\ie privacy keeper\IEPrivacyKeeper.exe" -startup

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [DVDSentry] c:\windows\system32\DSentry.exe

mRun: [uSB SECURITY DEVICE CoInstaller] JupitCo.exe

mRun: [TPP Auto Loader] c:\windows\TPPALDR.EXE

mRun: [Logitech Utility] Logi_MwX.Exe

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe

mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe

mRun: [symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"

mRun: [siteAdvisor] c:\program files\siteadvisor\6253\SiteAdv.exe

mRun: [VerizonServicepoint.exe] "c:\program files\verizon\vsp\VerizonServicepoint.exe" /AUTORUN

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [CTCheck] c:\program files\creative\creative zen\zen media explorer\CTCheck.exe

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui

mRun: [inCD] c:\program files\nero\nero 7\incd\InCD.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

StartupFolder: c:\docume~1\frank\startm~1\programs\startup\sysint~1.lnk - c:\program files\sysinternals\processexplorer\procexp.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\colorc~1.lnk - c:\program files\sec\magictune 2.5\GammaTray.exe

uPolicies-explorer: NoViewOnDrive = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\mi69df~1\office12\EXCEL.EXE/3000

IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html

IE: Edit with X&ML Spy - c:\program files\altova\xmlspy2004\spy.htm

IE: {2222EF56-F49E-4d07-A14E-8D2B08766958} - c:\program files\altova\xmlspy2004\spy.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi69df~1\office12\REFIEBAR.DLL

IE: {D8DEE6AE-1AE4-11D4-9996-00B0D0278826} - {0432FC96-1AF4-11D4-9996-00B0D0278826} - c:\windows\system32\Shdocvw.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA}

Trusted Zone: intuit.com\ttlc

Trusted Zone: turbotax.com

DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB

DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemydsl.verizon.net/sdcCommon/download/DSL/tgctlcm.cab

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {4BEE3896-4820-48D1-85EA-5A9A9ECD3D95} - hxxp://office.microsoft.com/productupdates/content/opuc/opuc.cab

DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126651071953

DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab

DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www3.ca.com/securityadvisor/virusinfo/webscan.cab

DPF: {7C896371-4B7F-4B34-95B1-24851F5DED24} - hxxps://www.microsoft.com/resources/virtuallabs/ActiveX/VMRCActiveXClient.cab

DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxp://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab

DPF: {83229950-AD1D-4B94-8304-F56E95AFACF7} - hxxp://technet.msft.demoservers.com/SupportFiles/Client/srdp.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - hxxp://toolbar.google.com/data/GoogleActivate.cab

DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37626.2954513889

DPF: {A80D199B-CFDD-4DA4-8C47-2310D5B8DD97} - hxxps://accounting.quickbooks.com/v7.576/qboax5.cab

DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} - hxxps://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab

DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} - hxxp://scpwbe.ops.placeware.com/etc/place/RCC-BETA/pws-pw-03/5.1.0.104/lib/quicksilver.cab

DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - hxxp://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} - hxxp://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15112/CTPID.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - c:\program files\siteadvisor\6261\SiteAdv.dll

AppInit_DLLs:

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\frank\applic~1\mozilla\firefox\profiles\tcl00tj5.alt user\

FF - prefs.js: browser.search.selectedEngine - Dictionary

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk

FF - component: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll

FF - component: c:\program files\siteadvisor\6261\ff\components\FFHook.dll

FF - plugin: c:\documents and settings\frank\application data\mozilla\firefox\profiles\tcl00tj5.alt user\extensions\devicedetection@logitech.com\plugins\npLogitechDeviceDetection.dll

FF - plugin: c:\documents and settings\frank\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\google updater\1.0.377.3622\npCIDetect.dll

FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPMGWRAP.DLL

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R? bcgame;Nostromo HID Device Minidriver

R? ccPwdSvc;Symantec Password Validation

R? DCamUSBBVI;SiPix StyleCam RAVE/SNAP Dual Mode Camera

R? gupdate;Google Update Service (gupdate)

R? MSSQL$SQL;MSSQL$SQL

R? NPF;NetGroup Packet Filter Driver

R? onfb;onfb

R? PortReporter;Port Reporter

R? Radialpoint Security Services;Radialpoint Security Services

R? SECURITY;%JUPITER.DeviceDesc%

R? SQLAgent$SQL;SQLAgent$SQL

R? TPP300;USB Storage Adapter V3 (TPP)

R? Usblink;Usblink Driver

S? Active@ Disk Monitor;Active@ Disk Monitor

S? aswFsBlk;aswFsBlk

S? aswSP;aswSP

S? avast! Antivirus;avast! Antivirus

S? avast! Mail Scanner;avast! Mail Scanner

S? avast! Web Scanner;avast! Web Scanner

S? BCMNTIO;BCMNTIO

S? ccEvtMgr;Symantec Event Manager

S? ccSetMgr;Symantec Settings Manager

S? Lbd;Lbd

S? MAPMEM;MAPMEM

S? NProtectService;Norton Unerase Protection

S? PQIMount;PQIMount

S? PQV2i;PQV2i

S? psqlWGE;Pervasive PSQL Workgroup Engine

S? SBRE;SBRE

S? Symantec Core LC;Symantec Core LC

S? VPCAppSv;Virtual PC Application Services

============== File Associations ===============

inffile=c:\dpl\DPLAS.EXE %1

=============== Created Last 30 ================

2010-07-27 00:04:14 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll

2010-07-27 00:04:13 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll

2010-07-27 00:04:10 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll

2010-07-27 00:04:09 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe

2010-07-27 00:04:08 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe

2010-07-27 00:03:50 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe

2010-07-27 00:03:49 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys

2010-07-27 00:03:23 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys

2010-07-27 00:03:14 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys

2010-07-27 00:03:13 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys

2010-07-27 00:03:09 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys

2010-07-27 00:03:06 87040 ----a-w- c:\windows\system32\dllcache\wiafbdrv.dll

2010-07-27 00:03:06 53760 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll

2010-07-27 00:03:04 41600 ----a-w- c:\windows\system32\dllcache\weitekp9.dll

2010-07-27 00:03:04 31232 ----a-w- c:\windows\system32\dllcache\weitekp9.sys

2010-07-27 00:03:01 701386 ----a-w- c:\windows\system32\dllcache\wdhaalba.sys

2010-07-27 00:01:59 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe

2010-07-27 00:00:59 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys

2010-07-26 23:59:59 50432 ----a-w- c:\windows\system32\dllcache\sisv.sys

2010-07-26 23:58:59 166720 ----a-w- c:\windows\system32\dllcache\s3m.sys

2010-07-26 23:57:58 130942 ----a-w- c:\windows\system32\dllcache\ptserlv.sys

2010-07-26 23:56:59 30495 ----a-w- c:\windows\system32\dllcache\pc100nds.sys

2010-07-26 23:55:59 60480 ----a-w- c:\windows\system32\dllcache\neo20xx.dll

2010-07-26 23:54:58 6528 ----a-w- c:\windows\system32\dllcache\miniqic.sys

2010-07-26 23:53:38 18432 ----a-w- c:\windows\system32\dllcache\jupiw.dll

2010-07-26 23:52:59 109085 ----a-w- c:\windows\system32\dllcache\ibmtrp.sys

2010-07-26 23:51:59 7680 ----a-w- c:\windows\system32\dllcache\ftpctrs2.dll

2010-07-26 23:50:57 334208 ----a-w- c:\windows\system32\dllcache\ds1wdm.sys

2010-07-26 23:49:59 42112 ----a-w- c:\windows\system32\dllcache\crtaud.sys

2010-07-26 23:48:59 66082 ----a-w- c:\windows\system32\dllcache\c_1047.nls

2010-07-26 23:47:59 27678 ----a-w- c:\windows\system32\dllcache\ali5261.sys

2010-07-14 14:45:58 38848 ----a-w- c:\windows\avastSS.scr

==================== Find3M ====================

2010-07-27 06:30:35 8462336 ----a-w- c:\windows\system32\dllcache\shell32.dll

2010-06-14 14:31:20 744448 ----a-w- c:\windows\system32\dllcache\helpsvc.exe

2001-10-05 16:53:04 21866 ------w- c:\program files\common files\tppupd2k.dll

2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\cookies\index.dat

2009-12-13 22:24:02 16384 --sha-w- c:\windows\system32\config\systemprofile\application data\earthlink\6.0\pucci@ix.netcom.com\ietldcache\index.dat

2008-05-21 16:38:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052120080522\index.dat

============= FINISH: 16:16:39.82 ===============

screen317 · August 12, 2010

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

fxp · August 13, 2010

Hi Chris,

I just ran Combofix and am sending the log report and the DDS report post Combofix, too. I am now going to run Malwarebytes again and see if it completes. Thanks for the help.

ComboFix 10-08-12.03 - Frank 08/13/2010 11:08:56.1.1 - x86

Running from: c:\documents and settings\Frank\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Frank\GoToAssistDownloadHelper.exe

C:\Documents

C:\Microsoft

c:\program files\WinPCap

c:\program files\WinPCap\daemon_mgm.exe

c:\program files\WinPCap\INSTALL.LOG

c:\program files\WinPCap\npf_mgm.exe

c:\program files\WinPCap\rpcapd.exe

c:\program files\WinPCap\Uninstall.exe

c:\windows\system32\bszip.dll

c:\windows\system32\Cache

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\Thumbs.db

c:\windows\system32\wpcap.dll

c:\windows\winhelp.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_FILEMON

-------\Legacy_NM

-------\Legacy_NPF

-------\Legacy_SECURITY

-------\Service_NM

-------\Service_NPF

-------\Service_SECURITY

((((((((((((((((((((((((( Files Created from 2010-07-13 to 2010-08-13 )))))))))))))))))))))))))))))))

.

No new files created in this timespan

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-13 16:07 . 2005-07-31 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\HDD Thermometer

2010-08-10 01:22 . 2005-04-30 14:50 -------- d-----w- c:\documents and settings\Frank\Application Data\KeePass

2010-08-04 21:29 . 2004-01-05 20:02 -------- d-----w- c:\program files\Norton SystemWorks

2010-07-23 15:16 . 2004-05-28 23:50 -------- d-----w- c:\program files\Active Ports

2010-07-14 16:23 . 2003-01-05 15:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-06-30 13:34 . 2007-10-25 23:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-06-28 20:57 . 2010-07-14 14:45 38848 ----a-w- c:\windows\avastSS.scr

2010-06-28 20:57 . 2009-01-23 16:19 165032 ----a-w- c:\windows\system32\aswBoot.exe

2010-06-28 20:37 . 2009-01-23 16:20 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-06-28 20:37 . 2009-01-23 16:20 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-06-28 20:33 . 2009-01-23 16:20 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-06-28 20:32 . 2009-01-23 16:20 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2010-06-28 20:32 . 2009-01-23 16:20 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys

2010-06-28 20:32 . 2009-01-23 16:20 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-06-28 20:32 . 2009-01-23 16:20 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2010-06-23 16:28 . 2010-06-23 16:28 -------- d-----w- c:\program files\LSoft Technologies Inc

2010-06-23 16:28 . 2002-12-12 00:00 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-06-16 20:01 . 2008-05-10 23:03 -------- d-----w- c:\program files\Debugging Tools for Windows (x86)

2010-06-14 16:19 . 2010-06-14 16:19 -------- d-----w- c:\program files\KeePass Password Safe 2

2001-10-05 16:53 . 2003-03-08 19:32 21866 ------w- c:\program files\Common Files\tppupd2k.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RSD_HDDThermo"="c:\program files\HDD Thermometer\HDD Thermometer.exe" [2005-04-01 215040]

"Google Update"="c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-12 133104]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-23 68856]

"IE Privacy Keeper"="c:\program files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe" [2005-12-03 1015808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-15 28672]

"USB SECURITY DEVICE CoInstaller"="JupitCo.exe" [2002-04-22 28672]

"TPP Auto Loader"="c:\windows\TPPALDR.EXE" [2001-10-05 118784]

"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]

"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-05-04 161328]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]

"SiteAdvisor"="c:\program files\SiteAdvisor\6253\SiteAdv.exe" [2007-12-04 36640]

"VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2007-11-16 2065648]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]

"CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]

"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-04 1057328]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-10-06 5058560]

"nwiz"="nwiz.exe" [2003-10-06 741376]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2003-10-06 49152]

c:\documents and settings\Frank\Start Menu\Programs\Startup\

SysInt Process Explorer.lnk - c:\program files\SysInternals\ProcessExplorer\procexp.exe [2004-11-15 3623736]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Color Calibration.lnk - c:\program files\SEC\MagicTune 2.5\GammaTray.exe [2005-1-12 36864]

Microsoft Office.lnk - c:\program files\Microsoft Office XP\Office10\OSA.EXE [2001-2-13 83360]

TurboNote.lnk - c:\program files\TurboNote\tbnote.exe [2003-1-4 199168]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]

Source= c:\documents and settings\Frank\My Documents\My Web Sites\LocalDesktop\local_desktop.htm

FriendlyName=

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]

@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"<NO NAME>"=

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=

"c:\\Program Files\\Microsoft Office\\OFFICE11\\FRONTPG.EXE"=

"c:\\Program Files\\Microsoft Visual Studio .NET 2003\\Common7\\IDE\\devenv.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=

"c:\\Program Files\\Altova\\XMLSPY2004\\XMLSpy.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\FTP Explorer\\ftpx.exe"=

"c:\\Program Files\\Java\\j2re1.4.2_03\\bin\\javaw.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Intuit\\QuickBooks 2005\\QBDBMgrN.exe"=

"c:\\Program Files\\Microsoft Office 2007\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\PhraseExpress\\phraseexpress.exe"=

"c:\\Program Files\\Pervasive Software\\PSQL\\bin\\w3dbsmgr.exe"=

"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=

"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

"1583:TCP"= 1583:TCP:Pervasive DBEngine

"3351:TCP"= 3351:TCP:Pervasive DBEngine

R0 onfb;onfb;c:\windows\System32\drivers\urhy.sys [x]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 135664]

R3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys [x]

R3 DCamUSBBVI;SiPix StyleCam RAVE/SNAP Dual Mode Camera;c:\windows\system32\Drivers\biomini.sys [2002-08-31 397184]

R3 MSSQL$SQL;MSSQL$SQL;c:\progra~1\MI6841~1\MSSQL$~1\binn\sqlservr.exe [2002-12-17 7520337]

R3 PortReporter;Port Reporter;c:\program files\PortReporter\portreporter.exe [2004-03-30 90183]

R3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\system32\dllhost.exe [2008-04-14 5120]

R3 SQLAgent$SQL;SQLAgent$SQL;c:\progra~1\MI6841~1\MSSQL$~1\binn\sqlagent.exe [2002-12-17 311872]

R3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\DRIVERS\TPP300.SYS [2001-10-05 33669]

R3 Usblink;Usblink Driver;c:\windows\system32\Drivers\ulink.sys [2003-06-02 40060]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-01-27 64160]

S0 PQV2i;PQV2i; [x]

S1 aswSP;aswSP; [x]

S1 PQIMount;PQIMount; [x]

S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [2009-08-05 93872]

S2 Active@ Disk Monitor;Active@ Disk Monitor;c:\program files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe [2009-09-02 1127944]

S2 aswFsBlk;aswFsBlk; [x]

S2 BCMNTIO;BCMNTIO;c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 3744]

S2 MAPMEM;MAPMEM;c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 3904]

S2 NProtectService;Norton Unerase Protection;c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE [2004-08-31 95328]

S2 psqlWGE;Pervasive PSQL Workgroup Engine;c:\program files\Pervasive Software\PSQL\bin\w3dbsmgr.exe [2007-09-05 455968]

S2 VPCAppSv;Virtual PC Application Services;c:\windows\system32\DRIVERS\VPCAppSv.sys [2002-05-21 10374]

--- Other Services/Drivers In Memory ---

*Deregistered* - PROCEXP100

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2007-04-19 17:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

2010-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 00:20]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 00:20]

2010-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2187484283-3964311654-1397676033-1005Core.job

- c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-12 14:55]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2187484283-3964311654-1397676033-1005UA.job

- c:\documents and settings\Frank\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-12 14:55]

2009-12-28 c:\windows\Tasks\PandaUSBVaccine.job

- c:\program files\Panda USB Vaccine\RunInteractiveWin.exe [2009-12-28 21:45]

2009-06-07 c:\windows\Tasks\RegistryBackup.job

- c:\windows\system32\ntbackup.exe [2002-08-29 00:12]

2009-01-25 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job

- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2010-01-07 20:31]

2010-08-13 c:\windows\Tasks\User_Feed_Synchronization-{ABAB6777-B3C7-440A-BEC7-38C62D5C8307}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xport to Microsoft Excel - c:\progra~1\MI69DF~1\Office12\EXCEL.EXE/3000

IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

IE: Edit with X&ML Spy - c:\program files\Altova\XMLSPY2004\spy.htm

IE: {{D8DEE6AE-1AE4-11D4-9996-00B0D0278826} - {0432FC96-1AF4-11D4-9996-00B0D0278826} - c:\windows\system32\Shdocvw.dll

Trusted Zone: intuit.com\ttlc

Trusted Zone: turbotax.com

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings_POTT20009/include/vzTCPConfig.CAB

DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab

DPF: {BCD5A227-8720-497B-AF5F-4403E94342E3} - hxxps://netservices.verizon.net/portal/verizon/passwdchg/activex/DSLControl.cab

DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} - hxxp://scpwbe.ops.placeware.com/etc/place/RCC-BETA/pws-pw-03/5.1.0.104/lib/quicksilver.cab

FF - ProfilePath -

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHANS REMOVED - - - -

AddRemove-WinPcapInst - c:\program files\WinPcap\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-13 12:04

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\TEMP\_asw_aisI.tm~a02192

c:\windows\TEMP\_asw_aisI.tm~a02192\onefile 0 bytes

scan completed successfully

hidden files: 2

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2187484283-3964311654-1397676033-1005\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Pervasive Software\PSQL]

@Denied: ) (Everyone)

@=""

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4188)

c:\windows\system32\WININET.dll

c:\windows\system32\nView.dll

c:\program files\Logitech\MouseWare\System\LgWndHk.dll

c:\program files\SiteAdvisor\6253\saHook.dll

c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll

c:\windows\system32\nvwddi.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\ftpxext.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\System32\drivers\CDAC11BA.EXE

c:\windows\system32\CTsvcCDA.exe

c:\windows\System32\inetsrv\inetinfo.exe

c:\program files\Nero\Nero 7\InCD\InCDsrv.exe

c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe

c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe

c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

c:\program files\Microsoft Analysis Services\Bin\msmdsrv.exe

c:\program files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

c:\progra~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

c:\windows\system32\SearchIndexer.exe

c:\windows\system32\fxssvc.exe

c:\windows\system32\JupitCo.exe

c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe

c:\program files\Logitech\MouseWare\system\em_exec.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\system32\rundll32.exe

c:\program files\Microsoft ActiveSync\wcescomm.exe

c:\progra~1\MICROS~4\rapimgr.exe

c:\windows\system32\SearchProtocolHost.exe

c:\windows\system32\SearchFilterHost.exe

.

**************************************************************************

.

Completion time: 2010-08-13 12:43:33 - machine was rebooted

ComboFix-quarantined-files.txt 2010-08-13 16:43

Pre-Run: 23,963,938,816 bytes free

Post-Run: 23,586,652,160 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 4B6890BC03837AF23D9B055C3C7236C6

DDS (Ver_10-03-17.01) - NTFSx86

Run by Frank at 12:55:29.23 on Fri 08/13/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.123 [GMT -4:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\System32\inetsrv\inetinfo.exe

C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe

C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe

C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe

C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe

C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\fxssvc.exe

C:\WINDOWS\System32\DSentry.exe

C:\WINDOWS\system32\JupitCo.exe

C:\WINDOWS\TPPALDR.EXE

C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe

C:\Program Files\SiteAdvisor\6253\SiteAdv.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe

C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

C:\Program Files\Nero\Nero 7\InCD\InCD.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\HDD Thermometer\HDD Thermometer.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPrivacyKeeper.exe

C:\Program Files\SEC\MagicTune 2.5\GammaTray.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\TurboNote\tbnote.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Program Files\SysInternals\ProcessExplorer\procexp.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Documents and Settings\Frank\Desktop\SysDiags\dds.scr