cant run hjt, mbam or gmer.. help!

sean dorian · October 21, 2010

Sorry LDTate, I can't do that either hahah.. I always get an error when I do a search, even before all of this. The title is "Microsoft Visual C++ Runtime Library" and the message "Program: C:\WINDOWS\explorer.exe This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information."

Whats next? You're a genius if you get me through all of this hahaha, thanks again.

LDTate · October 21, 2010

You can use windows sfc (system file checker) You'd need your XP CD to make this work.

Click Start> Run> type sfc /scannow Note the space.

(Note that there is a space between sfc and /scannow)

sean dorian · October 21, 2010

I'm sure I'm killing you here, but I don't have an XP disk. This computer is a hand me down for work, and they dont have any software for it.

LDTate · October 21, 2010

Rename SystemLook.exe to SystemLook.com and see if that will work

sean dorian · October 21, 2010

Sorry, still the same result

LDTate · October 21, 2010

How about a new DDS scan?

sean dorian · October 21, 2010

Here is the new DDS log..

DDS (Ver_10-10-10.03) - NTFSx86

Run by Tom at 14:59:16.25 on Thu 10/21/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.439 [GMT -7:00]

AV: avast! antivirus 4.8.1229 [VPS 080930-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\System32\alg.exe

"\\.\globalroot\Device\svchost.exe\svchost.exe"

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\sysedit.exe

C:\WINDOWS\debug.exe

C:\WINDOWS\avp32.exe

C:\WINDOWS\install.exe

C:\WINDOWS\mdm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\sysedit.exe

C:\WINDOWS\debug.exe

C:\WINDOWS\avp32.exe

C:\WINDOWS\install.exe

C:\WINDOWS\mdm.exe

C:\Program Files\WhiskeyMilitia\Desktop Alert\WM-Desktop-Alert.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\explorer.exe

C:\DOCUME~1\Tom\LOCALS~1\Temp\iexplorer.exe

C:\Documents and Settings\Tom\Desktop\dds.scr

C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = <local>

BHO: c:\windows\system32\pwvrpzgte.dll: {d6ba40a1-a502-59bd-f413-04b03a2c8953} - c:\windows\system32\pwvrpzgte.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

TB: Delicious Toolbar: {61d1c847-df80-423a-8c6d-dc03b97e6ebe} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll

EB: Delicious Sidebar: {9d19c405-ba93-461b-871f-97992cc45972} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Google Update] "c:\documents and settings\tom\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [HNUjHTgph] c:\docume~1\tom\locals~1\temp\setup.exe

uRun: [HNUjHTgruf] c:\docume~1\tom\locals~1\temp\wininst.exe

uRun: [HNUjHTgre] c:\docume~1\tom\locals~1\temp\smss.exe

uRun: [HNUjHTgoe] c:\docume~1\tom\locals~1\temp\avp.exe

uRun: [HNUjHTgrvg] c:\docume~1\tom\locals~1\temp\spoolsv.exe

uRun: [HNUjHTgrsc] c:\docume~1\tom\locals~1\temp\winlogon.exe

uRun: [HNUjHTgrA] c:\docume~1\tom\locals~1\temp\win16.exe

uRun: [HNUjHTgta] c:\docume~1\tom\locals~1\temp\user.exe

uRun: [HNUjHTgne] c:\docume~1\tom\locals~1\temp\mdm.exe

uRun: [HNUjHTglb] c:\docume~1\tom\locals~1\temp\debug.exe

uRun: [HNUjHTgmve] c:\docume~1\tom\locals~1\temp\hexdump.exe

uRun: [HNUjHTgrrc] c:\docume~1\tom\locals~1\temp\winamp.exe

uRun: [HNUjHTgpb] c:\docume~1\tom\locals~1\temp\login.exe

uRun: [HNUjHTgoh] c:\docume~1\tom\locals~1\temp\csrss.exe

uRun: [HNUjHTgob] c:\docume~1\tom\locals~1\temp\drweb.exe

uRun: [HNUjHTgsfP] c:\docume~1\tom\locals~1\temp\nvsvc32.exe

uRun: [HNUjHTgotd] c:\docume~1\tom\locals~1\temp\install.exe

uRun: [HNUjHTgN2zc\Tom\LOCALS~1\Temp\2799445640.exe] c:\docume~1\tom\locals~1\temp\2799445640.exe

uRun: [HNUjHTgosf] c:\docume~1\tom\locals~1\temp\taskmgr.exe

uRun: [HNUjHTgnb] c:\docume~1\tom\locals~1\temp\cmd.exe

uRun: [HNUjHTgupf] c:\docume~1\tom\locals~1\temp\sysedit.exe

uRun: [HNUjHTgl/] c:\docume~1\tom\locals~1\temp\gdi32.exe

uRun: [HNUjHTgmtd] c:\docume~1\tom\locals~1\temp\iexplarer.exe

uRun: [HNUjHTgqd] c:\docume~1\tom\locals~1\temp\lsass.exe

uRun: [HNUjHTgO2x1\Tom\LOCALS~1\Temp\593788024.exe] c:\docume~1\tom\locals~1\temp\593788024.exe

uRun: [MKetc] c:\windows\sysedit.exe

uRun: [MKaoc] c:\windows\debug.exe

uRun: [MKese] c:\windows\svchost.exe

uRun: [MKZSc] c:\windows\avp32.exe

uRun: [MKayc] c:\windows\csrss.exe

uRun: [MKbta] c:\windows\install.exe

uRun: [MKcZ] c:\windows\mdm.exe

uRun: [HNUjHTgoh.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1] c:\docume~1\tom\locals~1\temp\csrss.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe

mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"

mRun: [hpbdfawep] c:\program files\hp\dfawep\bin\hpbdfawep.exe 1

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [HNUjHTgph] c:\docume~1\tom\locals~1\temp\setup.exe

mRun: [HNUjHTgruf] c:\docume~1\tom\locals~1\temp\wininst.exe

mRun: [HNUjHTgre] c:\docume~1\tom\locals~1\temp\smss.exe

mRun: [HNUjHTgoe] c:\docume~1\tom\locals~1\temp\avp.exe

mRun: [HNUjHTgrvg] c:\docume~1\tom\locals~1\temp\spoolsv.exe

mRun: [HNUjHTgrsc] c:\docume~1\tom\locals~1\temp\winlogon.exe

mRun: [HNUjHTgrA] c:\docume~1\tom\locals~1\temp\win16.exe

mRun: [HNUjHTgta] c:\docume~1\tom\locals~1\temp\user.exe

mRun: [HNUjHTgne] c:\docume~1\tom\locals~1\temp\mdm.exe

mRun: [HNUjHTglb] c:\docume~1\tom\locals~1\temp\debug.exe

mRun: [HNUjHTgmve] c:\docume~1\tom\locals~1\temp\hexdump.exe

mRun: [HNUjHTgrrc] c:\docume~1\tom\locals~1\temp\winamp.exe

mRun: [HNUjHTgpb] c:\docume~1\tom\locals~1\temp\login.exe

mRun: [HNUjHTgoh] c:\docume~1\tom\locals~1\temp\csrss.exe

mRun: [HNUjHTgob] c:\docume~1\tom\locals~1\temp\drweb.exe

mRun: [HNUjHTgsfP] c:\docume~1\tom\locals~1\temp\nvsvc32.exe

mRun: [HNUjHTgotd] c:\docume~1\tom\locals~1\temp\install.exe

mRun: [HNUjHTgN2zc\Tom\LOCALS~1\Temp\2799445640.exe] c:\docume~1\tom\locals~1\temp\2799445640.exe

mRun: [HNUjHTgosf] c:\docume~1\tom\locals~1\temp\taskmgr.exe

mRun: [HNUjHTgnb] c:\docume~1\tom\locals~1\temp\cmd.exe

mRun: [HNUjHTgupf] c:\docume~1\tom\locals~1\temp\sysedit.exe

mRun: [HNUjHTgl/] c:\docume~1\tom\locals~1\temp\gdi32.exe

mRun: [HNUjHTgmtd] c:\docume~1\tom\locals~1\temp\iexplarer.exe

mRun: [HNUjHTgqd] c:\docume~1\tom\locals~1\temp\lsass.exe

mRun: [HNUjHTgO2x1\Tom\LOCALS~1\Temp\593788024.exe] c:\docume~1\tom\locals~1\temp\593788024.exe

mRun: [MKetc] c:\windows\sysedit.exe

mRun: [MKaoc] c:\windows\debug.exe

mRun: [MKese] c:\windows\svchost.exe

mRun: [MKZSc] c:\windows\avp32.exe

mRun: [MKayc] c:\windows\csrss.exe

mRun: [MKbta] c:\windows\install.exe

mRun: [MKcZ] c:\windows\mdm.exe

mRun: [HNUjHTgoh.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1] c:\docume~1\tom\locals~1\temp\csrss.exe

dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

StartupFolder: c:\docume~1\tom\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wm-des~1.lnk - c:\program files\whiskeymilitia\desktop alert\WM-Desktop-Alert.exe

uPolicies-explorer: NoFolderOptions = 1 (0x1)

uPolicies-system: DisableRegistryTools = 1 (0x1)

dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {2C887991-08F0-11DC-A9B2-0012F0B227DD} - {B8D8B1D0-83AF-451B-8CD9-8F1BF4ED8FEA} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll

IE: {2C887992-08F0-11DC-A9B2-0012F0B227DD} - {9D19C405-BA93-461b-871F-97992CC45972} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll

IE: {2C887993-08F0-11DC-A9B2-0012F0B227DD} - {4D3D441F-9543-4941-B664-2EDCF9FC1B56} - c:\program files\delicious add-on for internet explorer\DeliciousExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

LSP: winsock.dll

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211587291171

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1259707250250

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

STS: c:\windows\system32\pwvrpzgte.dll: {d6ba40a1-a502-59bd-f413-04b03a2c8953} - c:\windows\system32\pwvrpzgte.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

LSA: Authentication Packages = msv1_0 relog_ap

mASetup: {8CD620CB-E463-446F-A79C-F2DA6C90C382} - rundll32.exe "c:\documents and settings\tom\application data\bitrix security\xaukvmm60.dll", DllUnrer

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\vj895qtp.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox

FF - prefs.js: keyword.URL - hxxp://search.start-search.net/?sid=10101065100&s=

FF - plugin: c:\documents and settings\tom\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll

FF - HiddenExtension: XULRunner: {60936386-F8F0-497F-9CB8-B5B399B0E4E7} - c:\documents and settings\tom\local settings\application data\{60936386-F8F0-497F-9CB8-B5B399B0E4E7}

FF - HiddenExtension: Firefox security: No Registry Reference - c:\program files\mozilla firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - Google

FF - user.js: browser.search.order.1 - Google

FF - user.js: keyword.URL - hxxp://search.start-search.net/?sid=10101065100&s=c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

============= SERVICES / DRIVERS ===============

R1 cvmacii;cvmacii;c:\windows\system32\drivers\cvmacii.sys [2007-11-30 303904]

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2008-10-9 38144]

R3 RTL8187B;Airlink101 802.11g USB 2.0 Adapter;c:\windows\system32\drivers\RTL8187B.sys [2008-10-14 238208]

S0 kcdwnloe;kcdwnloe; [x]

S1 aAAAAAa;aAAAAAa;c:\windows\system32\drivers\aaaaaaa.sys --> c:\windows\system32\drivers\aAAAAAa.sys [?]

S3 5DE6C4AB;5DE6C4AB; [x]

S3 OKI OPHG DCS Loader;OKI OPHG DCS Loader;c:\windows\system32\spool\drivers\w32x86\3\OPHGLDCS.EXE [2005-11-22 24576]

S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2007-11-16 550272]

=============== Created Last 30 ================

2010-10-21 20:42:56 -------- d-s---w- C:\ComboFix

2010-10-20 22:19:47 21636 ---h--w- c:\windows\mdm.exe

2010-10-20 22:19:46 21636 ---h--w- c:\windows\install.exe

2010-10-20 22:12:04 21636 ---h--w- c:\windows\svchost.exe

2010-10-20 22:12:04 21636 ---h--w- c:\windows\csrss.exe

2010-10-20 22:12:03 21636 ---h--w- c:\windows\sysedit.exe

2010-10-20 22:12:03 21636 ---h--w- c:\windows\avp32.exe

2010-10-20 22:12:02 21636 ---h--w- c:\windows\debug.exe

2010-10-20 19:31:05 -------- d-----w- c:\program files\ESET

2010-10-19 22:30:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-19 22:30:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-19 20:18:12 -------- d-----w- c:\docume~1\alluse~1\applic~1\Trend Micro

2010-10-19 20:18:11 -------- d-----w- c:\program files\Trend Micro

2010-10-19 18:41:32 -------- d-s---w- C:\Combo-Fix6475C

2010-10-19 17:46:22 -------- d-s---w- C:\Combo-Fix

2010-10-15 21:18:36 190 ----a-w- c:\docume~1\tom\applic~1\jsfhjjsd.bat

2010-10-15 21:18:06 -------- d-----w- c:\docume~1\tom\applic~1\Bitrix Security

2010-10-11 21:55:19 0 ----a-w- c:\windows\Nbimupe.bin

2010-10-11 21:54:41 -------- d-----w- c:\docume~1\tom\locals~1\applic~1\{60936386-F8F0-497F-9CB8-B5B399B0E4E7}

2010-09-29 19:13:11 -------- d-----w- c:\docume~1\tom\applic~1\Delicious IE Extension

2010-09-29 19:12:45 -------- d-----w- c:\program files\Delicious Add-on for Internet Explorer

2010-09-28 19:29:27 -------- d-sh--w- c:\docume~1\tom\applic~1\SystemProc

==================== Find3M ====================

2010-09-08 18:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 18:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts

============= FINISH: 14:59:56.17 ===============

and Attach

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-10-10.03)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 5/23/2008 4:24:51 PM

System Uptime: 10/21/2010 1:58:44 PM (1 hours ago)

Motherboard: ASUSTek Computer INC. | | IVY

Processor: AMD Athlon 64 Processor 3800+ | Socket AM2 | 2410/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 59 GiB total, 39.517 GiB free.

D: is FIXED (NTFS) - 90 GiB total, 44.571 GiB free.

E: is Removable

F: is Removable

G: is Removable

H: is Removable

I: is CDROM (CDFS)

Z: is NetworkDisk (NTFS) - 40 GiB total, 8.282 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E97D-E325-11CE-BFC1-08002BE10318}

Description: Microsoft System Management BIOS Driver

Device ID: ROOT\SYSTEM\0002

Manufacturer: (Standard system devices)

Name: Microsoft System Management BIOS Driver

PNP Device ID: ROOT\SYSTEM\0002

Service: mssmbios

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

Acronis

LDTate · October 21, 2010

Delete these Files if listed:

c:\docume~1\tom\locals~1\temp\ ALL files in this folder

c:\documents and settings\tom\application data\bitrix security\xaukvmm60.dll

c:\windows\system32\pwvrpzgte.dll

c:\windows\system32\drivers\aaaaaaa.sys

c:\docume~1\tom\applic~1\jsfhjjsd.bat

c:\windows\Nbimupe.bin

Delete these Folders if listed:

c:\documents and settings\tom\application data\bitrix security

Reboot and let me know how it's running

sean dorian · October 21, 2010

Alright I deleted those files and folder, restarted and did a new DDS scan.. I tried hijackthis but it is still acting the same

DDS (Ver_10-10-10.03) - NTFSx86

Run by Tom at 15:53:42.53 on Thu 10/21/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.482 [GMT -7:00]

AV: avast! antivirus 4.8.1229 [VPS 080930-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

"\\.\globalroot\Device\svchost.exe\svchost.exe"

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\sysedit.exe

C:\WINDOWS\debug.exe

"C:\WINDOWS\svchost.exe"

C:\WINDOWS\avp32.exe

C:\WINDOWS\install.exe

C:\WINDOWS\mdm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\sysedit.exe

C:\WINDOWS\debug.exe

"C:\WINDOWS\svchost.exe"

C:\WINDOWS\avp32.exe

C:\WINDOWS\install.exe

C:\WINDOWS\mdm.exe

C:\Program Files\WhiskeyMilitia\Desktop Alert\WM-Desktop-Alert.exe

C:\Program Files\iPod\bin\iPodService.exe