ausworkshop Posted August 17, 2011 ID:466631 Share Posted August 17, 2011 Please help me clean my PC, its been running slow for a while now, I've run Malwarebytes a few times and although its not always picking up threats I am still getting the baloon that says its blocking outgoing IP's.I've read the instructions on what to do here http://forums.malwarebytes.org/index.php?showtopic=69723 I've attached the log files from MB quick scan and a previous full scan as well as the DDS GMER thingies.Please let me know if I'm infected & if there's anything else you will need? Thankyou for your time its much appreciated..DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26Run by Andrew at 22:56:12 on 2011-08-17Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.214 [GMT 10:00].AV: AVG Internet Security *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}.============== Running Processes ===============.H:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeH:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exeH:\Program Files\AVG\AVG9\avgchsvx.exeH:\Program Files\AVG\AVG9\avgrsx.exesvchost.exeH:\Program Files\AVG\AVG9\avgcsrvx.exeH:\WINDOWS\system32\spoolsv.exeH:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exeH:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exeH:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exesvchost.exeH:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeH:\Program Files\AVG\AVG9\avgwdsvc.exeH:\Program Files\Bonjour\mDNSResponder.exeH:\Program Files\Canon\IJPLM\IJPLMSVC.EXEH:\Program Files\Java\jre6\bin\jqs.exeH:\Program Files\AVG\AVG9\avgam.exeH:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeH:\Program Files\AVG\AVG9\avgnsx.exeH:\Program Files\CDBurnerXP\NMSAccessU.exeH:\WINDOWS\system32\nvsvc32.exeh:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeH:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeH:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exeH:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exeH:\WINDOWS\system32\svchost.exe -k imgsvcH:\PROGRA~1\SPEEDB~2\VideoAcceleratorService.exeH:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeH:\Program Files\Canon\CAL\CALMAIN.exeH:\WINDOWS\Explorer.EXEH:\Program Files\AVG\AVG9\avgcsrvx.exeH:\PROGRA~1\AVG\AVG9\avgtray.exeH:\WINDOWS\System32\svchost.exe -k HTTPFilterH:\Program Files\Common Files\Real\Update_OB\realsched.exeH:\Program Files\Common Files\InstallShield\UpdateService\issch.exeH:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeH:\Program Files\Common Files\Java\Java Update\jusched.exeH:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeH:\WINDOWS\system32\ctfmon.exeH:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeH:\Program Files\Microsoft ActiveSync\wcescomm.exeH:\PROGRA~1\MICROS~2\rapimgr.exeH:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeH:\Program Files\Spybot - Search & Destroy\TeaTimer.exeH:\Program Files\LG Soft India\forteManager\bin\Monitor.exeH:\Program Files\PowerMenu\PowerMenu.exeH:\Program Files\Mozilla Firefox\firefox.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.google.com/uSearch Page = hxxp://www.google.comuSearch Bar = hxxp://www.google.com/ieuSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search/?q=%smSearchAssistant = hxxp://www.google.com/ieuURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - h:\program files\utorrentbar\tbuTo1.dllmURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - h:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - h:\program files\yahoo!\companion\installs\cpn3\yt.dllBHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - h:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - h:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - h:\program files\speedbit video downloader\toolbar\tbcore3.dllBHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - h:\program files\real\realplayer\rpbrowserrecordplugin.dllBHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - h:\program files\conduitengine\ConduitEngin0.dllBHO: SBCONVERT Class: {31b27f2d-6bc6-451b-b3d2-4eab36b2fc3b} - h:\program files\speedbit video downloader\toolbar\tbcore3.dllBHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - h:\program files\canon\easy-webprint ex\ewpexbho.dllBHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - h:\progra~1\search~1\SEARCH~1.DLLBHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - h:\program files\avg\avg9\avgssie.dllBHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - h:\progra~1\spybot~1\SDHelper.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - h:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dllBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - h:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - h:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - h:\program files\google\google toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - h:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dllBHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - h:\program files\utorrentbar\tbuTo1.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - h:\program files\java\jre6\bin\jp2ssv.dllBHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - h:\program files\windows live\toolbar\wltcore.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - h:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - h:\program files\yahoo!\companion\installs\cpn3\YTSingleInstance.dllBHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - h:\progra~1\dap\DAPIEL~1.DLLBHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - h:\progra~1\speedb~1\toolbar\grabber.dllTB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - h:\program files\yahoo!\companion\installs\cpn3\yt.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - h:\program files\windows live\toolbar\wltcore.dllTB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - h:\program files\avg\avg9\toolbar\IEToolbar.dllTB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - h:\program files\canon\easy-webprint ex\ewpexhlp.dllTB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - h:\program files\utorrentbar\tbuTo1.dllTB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - h:\program files\conduitengine\ConduitEngin0.dllTB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - h:\program files\speedbit video downloader\toolbar\tbcore3.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - h:\program files\google\google toolbar\GoogleToolbar_32.dllTB: {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No FileTB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No FileEB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - h:\program files\canon\easy-webprint ex\ewpexhlp.dllEB: {B0DE3308-5D5A-470D-81B9-634FC078393B} - No FileuRun: [CTFMON.EXE] h:\windows\system32\ctfmon.exeuRun: [H/PC Connection Agent] "h:\program files\microsoft activesync\wcescomm.exe"uRun: [swg] "h:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"uRun: [Google Update] "h:\documents and settings\andrew\local settings\application data\google\update\GoogleUpdate.exe" /cuRun: [spybotSD TeaTimer] h:\program files\spybot - search & destroy\TeaTimer.exemRun: [nwiz] nwiz.exe /installmRun: [AVG9_TRAY] h:\progra~1\avg\avg9\avgtray.exemRun: [CanonMyPrinter] h:\program files\canon\myprinter\BJMyPrt.exe /logonmRun: [CanonSolutionMenu] h:\program files\canon\solutionmenu\CNSLMAIN.exe /logonmRun: [TkBellExe] "h:\program files\common files\real\update_ob\realsched.exe" -osbootmRun: [iSUSPM Startup] h:\progra~1\common~1\instal~1\update~1\isuspm.exe -startupmRun: [iSUSScheduler] "h:\program files\common files\installshield\updateservice\issch.exe" -startmRun: [QuickTime Task] "h:\program files\quicktime\qttask.exe" -atboottimemRun: [Adobe ARM] "h:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [Google Desktop Search] "h:\program files\google\google desktop search\GoogleDesktop.exe" /startupmRun: [sunJavaUpdateSched] "h:\program files\common files\java\java update\jusched.exe"mRun: [Malwarebytes' Anti-Malware] "h:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttraymRun: [NvCplDaemon] RUNDLL32.EXE h:\windows\system32\NvCpl.dll,NvStartupdRun: [CTFMON.EXE] h:\windows\system32\CTFMON.EXEStartupFolder: h:\docume~1\andrew\startm~1\programs\startup\powerm~1.lnk - h:\program files\powermenu\PowerMenu.exeStartupFolder: h:\docume~1\alluse~1\startm~1\programs\startup\fortem~1.lnk - h:\program files\lg soft india\fortemanager\bin\Monitor.exeIE: &Clean Traces - h:\program files\dap\privacy package\dapcleanerie.htmIE: &Download with &DAP - h:\program files\dap\dapextie.htmIE: Add to Google Photos Screensa&ver - h:\windows\system32\GPhotos.scr/200IE: Download &all with DAP - h:\program files\dap\dapextie2.htmIE: Google Sidewiki... - h:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.htmlIE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - h:\program files\paltalk messenger\Paltalk.exeIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - h:\program files\messenger\msmsgs.exeIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - h:\program files\windows live\writer\WriterBrowserExtension.dllIE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - h:\progra~1\micros~2\INetRepl.dllIE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - h:\progra~1\micros~2\INetRepl.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - h:\progra~1\mi1933~1\office11\REFIEBAR.DLLIE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - h:\progra~1\spybot~1\SDHelper.dllLSP: h:\program files\speedbit video accelerator\lsp3.2.2.4\SBLSP.dllDPF: DirectAnimation Java Classes - file://h:\windows\system\dajava.cabDPF: Internet Explorer Classes for Java - file://h:\windows\system\iejava.cabDPF: Microsoft XML Parser for Java - file://h:\windows\java\classes\xmldso.cabDPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cabDPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cabDPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cabDPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - h:\program files\yahoo!\common\Yinsthelper200711281.dllDPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc2.cabDPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cabDPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cabDPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230361826875DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38096.7684259259DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cabDPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cabDPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cabDPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} - hxxp://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://fdl.msn.com/public/chat/msnchat45.cabTCP: DhcpNameServer = 192.168.0.1TCP: Interfaces\{577A338A-A6AF-475F-AAAB-69028292F41D} : DhcpNameServer = 192.168.0.1Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - h:\program files\avg\avg9\toolbar\IEToolbar.dllHandler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - h:\program files\belarc\advisor\system\BAVoilaX.dllHandler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - h:\program files\avg\avg9\avgpp.dllNotify: avgrsstarter - avgrsstx.dllNotify: PFW - UmxWnp.DllAppInit_DLLs: h:\progra~1\google\go333c~1\GOEC62~1.DLLSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - h:\windows\system32\WPDShServiceObj.dllmASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "h:\progra~1\outloo~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /installmASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "h:\progra~1\outloo~1\setup50.exe" /app:oe /caller:win9x /user /install - "h:\progra~1\outloo~1\setup50.exe" /APP:OE /CALLER:IE50 /user /installmASetup: {44BBA851-CC51-11CF-AAFA-00AA00B6015C} - rundll32.exeadvpack.dllmASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "h:\progra~1\outloo~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /installmASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "h:\progra~1\outloo~1\setup50.exe" /app:wab /caller:win9x /user /install - "h:\progra~1\outloo~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /installmASetup: {9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} - h:\windows\system32\updcrl.exe -e -u h:\windows\system\verisignpub1.crlmASetup: >IEPerUser - RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUPHosts: 127.0.0.1 www.spywareinfo.com.================= FIREFOX ===================.FF - ProfilePath - h:\documents and settings\andrew\application data\mozilla\firefox\profiles\zsuktr8w.default\FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=FF - prefs.js: browser.search.selectedEngine - Yahoo! SearchFF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/FF - prefs.js: keyword.URL - hxxp://au.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_au&p=FF - component: h:\documents and settings\andrew\application data\mozilla\firefox\profiles\zsuktr8w.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dllFF - component: h:\documents and settings\andrew\application data\mozilla\firefox\profiles\zsuktr8w.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dllFF - component: h:\program files\dap\dapfirefox\components\DAPFireFox.dllFF - component: h:\program files\speedbit video downloader\spfirefox\components\Engine.dllFF - plugin: c:\windows\system32\macromed\flash\NPSWF32.dllFF - plugin: h:\documents and settings\andrew\local settings\application data\google\update\1.3.21.65\npGoogleUpdate3.dllFF - plugin: h:\progra~1\yahoo!\common\npyaxmpb.dllFF - plugin: h:\program files\adobe\reader 10.0\reader\air\nppdf32.dllFF - plugin: h:\program files\canon\easy-photoprint ex\NPEZFFPI.DLLFF - plugin: h:\program files\google\google earth\plugin\npgeplugin.dllFF - plugin: h:\program files\google\picasa3\npPicasa3.dllFF - plugin: h:\program files\google\update\1.3.21.57\npGoogleUpdate3.dllFF - plugin: h:\program files\google\update\1.3.21.65\npGoogleUpdate3.dllFF - plugin: h:\program files\java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: h:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dllFF - plugin: h:\program files\microsoft\office live\npOLW.dllFF - plugin: h:\program files\mozilla firefox\plugins\npdeployJava1.dllFF - plugin: h:\program files\windows live\photo gallery\NPWLPG.dll.============= SERVICES / DRIVERS ===============.R0 AvgRkx86;avgrkx86.sys;h:\windows\system32\drivers\avgrkx86.sys [2010-2-2 52872]R0 KmxStart;KmxStart;h:\windows\system32\drivers\KmxStart.sys [2009-6-8 107000]R1 AvgLdx86;AVG AVI Loader Driver x86;h:\windows\system32\drivers\avgldx86.sys [2010-2-2 216400]R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;h:\windows\system32\drivers\avgmfx86.sys [2010-2-2 29584]R1 AvgTdiX;AVG Network Redirector;h:\windows\system32\drivers\avgtdix.sys [2010-2-2 243152]R1 KmxAgent;KmxAgent;h:\windows\system32\drivers\KmxAgent.sys [2009-9-30 72184]R2 avg9wd;AVG WatchDog;h:\program files\avg\avg9\avgwdsvc.exe [2010-6-24 308136]R2 MBAMService;MBAMService;h:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-5 366640]R2 SentinelKeysServer;Sentinel Keys Server;h:\program files\common files\safenet sentinel\sentinel keys server\sntlkeyssrvr.exe [2007-4-27 316992]R2 UmxAgent;HIPS Event Manager;h:\program files\ca\sharedcomponents\hipsengine\UmxAgent.exe [2009-8-4 1141240]R2 UmxCfg;HIPS Configuration Interpreter;h:\program files\ca\sharedcomponents\hipsengine\UmxCfg.exe [2009-7-13 801272]R2 UmxPol;HIPS Policy Manager;h:\program files\ca\sharedcomponents\hipsengine\UmxPol.exe [2009-7-27 289272]R2 VideoAcceleratorService;VideoAcceleratorService;h:\progra~1\speedb~2\videoacceleratorservice.exe -start -scm --> h:\progra~1\speedb~2\VideoAcceleratorService.exe -start -scm [?]R3 KmxCfg;KmxCfg;h:\windows\system32\drivers\KmxCfg.sys [2009-9-30 203768]R3 LGDDCDevice;LGDDCDevice;h:\program files\lg soft india\fortemanager\bin\I2CDriver.sys [2010-9-18 14336]R3 Mach3;Mach3 Pulseing Service;h:\windows\system32\drivers\Mach3.sys [2010-3-29 103040]R3 MBAMProtector;MBAMProtector;h:\windows\system32\drivers\mbam.sys [2011-8-5 22712]R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [2008-12-27 222976]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;h:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 gupdate;Google Update Service (gupdate);h:\program files\google\update\GoogleUpdate.exe [2010-2-15 135664]S3 aawservice;Lavasoft Ad-Aware Service;h:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-11 611664]S3 AVG Security Toolbar Service;AVG Security Toolbar Service;h:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-27 1025352]S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;h:\program files\google\google desktop search\GoogleDesktop.exe [2011-7-3 30192]S3 gupdatem;Google Update Service (gupdatem);h:\program files\google\update\GoogleUpdate.exe [2010-2-15 135664]S3 LGII2CDevice;LGII2CDevice;h:\program files\lg soft india\fortemanager\bin\PII2CDriver.sys [2010-9-18 18432]S3 McComponentHostService;McAfee Security Scan Component Host Service;h:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;h:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504].=============== Created Last 30 ================.2011-08-10 01:06:39 139656 -c----w- h:\windows\system32\dllcache\rdpwd.sys2011-08-10 01:05:00 10496 -c----w- h:\windows\system32\dllcache\ndistapi.sys2011-08-05 04:23:50 41272 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys2011-08-05 04:23:47 22712 ----a-w- h:\windows\system32\drivers\mbam.sys2011-08-05 04:23:47 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware.==================== Find3M ====================.2011-08-15 07:08:01 404640 ----a-w- h:\windows\system32\FlashPlayerCPLApp.cpl2011-07-15 13:29:31 456320 ----a-w- h:\windows\system32\drivers\mrxsmb.sys2011-07-08 14:02:00 10496 ----a-w- h:\windows\system32\drivers\ndistapi.sys2011-06-24 14:10:36 139656 ----a-w- h:\windows\system32\drivers\rdpwd.sys2011-06-23 18:36:30 916480 ----a-w- h:\windows\system32\wininet.dll2011-06-23 18:36:30 43520 ----a-w- h:\windows\system32\licmgr10.dll2011-06-23 18:36:30 1469440 ------w- h:\windows\system32\inetcpl.cpl2011-06-23 12:05:13 385024 ----a-w- h:\windows\system32\html.iec2011-06-22 10:43:49 1126851 ----a-w- h:\windows\wallhalla_saver_f.scr2011-06-20 17:44:52 293376 ----a-w- h:\windows\system32\winsrv.dll2011-06-02 14:02:05 1858944 ----a-w- h:\windows\system32\win32k.sys2011-01-21 00:41:49 19985265 ----a-w- h:\program files\vlc-1.1.5-win32.exe2005-07-30 07:10:00 556704 ----a-w- h:\program files\GoogleToolbarInstaller.exe2005-07-26 03:16:40 6285024 ----a-w- h:\program files\emssetup122.exe2005-07-26 01:49:30 20798256 ----a-w- h:\program files\AdbeRdr70_enu_full.exe2005-07-26 01:45:56 6811904 ----a-w- h:\program files\psa2011se_us.exe.============= FINISH: 22:57:15.17 ===============attach.zipmbam-log-2011-05-18 (11-18-48).txtmbam-log-2011-05-18 (13-55-48).txt Link to post Share on other sites More sharing options...
Staff screen317 Posted August 21, 2011 Staff ID:467946 Share Posted August 21, 2011 Hi and welcome to Malwarebytes.Please update MBAM, run a Quick Scan, and post its log.Next, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
ausworkshop Posted August 22, 2011 Author ID:468249 Share Posted August 22, 2011 Hi,Thanks for your help, here are the requested logs.RegardsAndrewMalwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7534Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.1870222/08/2011 11:34:45 PMmbam-log-2011-08-22 (23-34-45).txtScan type: Quick scanObjects scanned: 201653Time elapsed: 8 minute(s), 9 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)ComboFix 11-08-22.03 - Andrew 23/08/2011 0:26.1.2 - x86Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.364 [GMT 10:00]Running from: h:\documents and settings\Andrew\Desktop\ComboFix.exeAV: AVG Internet Security *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} * Created a new restore point..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..h:\documents and settings\Andrew\Application Data\PriceGongh:\documents and settings\Andrew\Application Data\PriceGong\Data\1.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\a.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\b.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\c.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\d.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\e.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\f.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\g.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\h.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\i.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\J.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\k.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\l.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\m.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\mru.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\n.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\o.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\p.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\q.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\r.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\s.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\t.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\u.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\v.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\w.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\x.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\y.xmlh:\documents and settings\Andrew\Application Data\PriceGong\Data\z.xmlh:\documents and settings\Andrew\My Documents\981.JPGh:\documents and settings\Andrew\Systemh:\documents and settings\Andrew\System\win_qs8.jqxh:\documents and settings\Andrew\WINDOWSh:\program files\SpeedBit Video Downloader\Toolbar\tbcore3.dllh:\program files\SpeedBit Video Downloader\Toolbar\tbhelper.dllh:\windows\start.exeh:\windows\system32\Thumbs.dbh:\windows\Web\default.htt..((((((((((((((((((((((((( Files Created from 2011-07-22 to 2011-08-22 )))))))))))))))))))))))))))))))..2011-08-11 06:22 . 2011-08-11 06:22 -------- d-----w- h:\program files\Apple Software Update2011-08-10 15:08 . 2011-08-10 15:08 -------- d-sh--w- h:\documents and settings\Default User\IETldCache2011-08-10 01:06 . 2011-06-24 14:10 139656 -c----w- h:\windows\system32\dllcache\rdpwd.sys2011-08-10 01:05 . 2011-07-08 14:02 10496 -c----w- h:\windows\system32\dllcache\ndistapi.sys2011-08-05 04:23 . 2011-07-06 09:52 41272 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys2011-08-05 04:23 . 2011-08-05 04:23 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware2011-08-05 04:23 . 2011-07-06 09:52 22712 ----a-w- h:\windows\system32\drivers\mbam.sys2011-08-04 15:38 . 2011-08-05 00:50 -------- d-----w- h:\documents and settings\Administrator...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2011-08-15 07:08 . 2011-05-14 02:54 404640 ----a-w- h:\windows\system32\FlashPlayerCPLApp.cpl2011-07-15 13:29 . 2004-08-04 12:00 456320 ----a-w- h:\windows\system32\drivers\mrxsmb.sys2011-07-14 15:31 . 2011-07-13 07:17 416 ----a-w- h:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll2011-07-13 07:19 . 2011-07-13 07:19 348256 ----a-w- h:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\CorelPHOTOPAINT\9.0\1033\ResourceCache.dll2011-07-13 07:19 . 2011-07-13 07:19 348256 ----a-w- h:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\CorelDRAW\9.0\1033\ResourceCache.dll2011-07-08 14:02 . 2004-08-04 12:00 10496 ----a-w- h:\windows\system32\drivers\ndistapi.sys2011-06-24 14:10 . 2008-12-27 00:18 139656 ----a-w- h:\windows\system32\drivers\rdpwd.sys2011-06-23 18:36 . 2004-08-04 12:00 916480 ----a-w- h:\windows\system32\wininet.dll2011-06-23 18:36 . 2004-08-04 12:00 43520 ----a-w- h:\windows\system32\licmgr10.dll2011-06-23 18:36 . 2004-08-04 12:00 1469440 ------w- h:\windows\system32\inetcpl.cpl2011-06-23 12:05 . 2004-08-04 12:00 385024 ----a-w- h:\windows\system32\html.iec2011-06-22 10:43 . 2011-06-22 10:45 1126851 ----a-w- h:\windows\wallhalla_saver_f.scr2011-06-20 17:44 . 2004-08-04 12:00 293376 ----a-w- h:\windows\system32\winsrv.dll2011-06-02 14:02 . 2004-08-04 12:00 1858944 ----a-w- h:\windows\system32\win32k.sys2011-01-21 00:41 . 2011-01-21 00:36 19985265 ----a-w- h:\program files\vlc-1.1.5-win32.exe2005-07-30 07:10 . 2005-07-30 07:09 556704 ----a-w- h:\program files\GoogleToolbarInstaller.exe2005-07-26 03:16 . 2005-07-26 03:16 6285024 ----a-w- h:\program files\emssetup122.exe2005-07-26 01:49 . 2005-07-26 01:45 20798256 ----a-w- h:\program files\AdbeRdr70_enu_full.exe2005-07-26 01:45 . 2005-07-26 01:44 6811904 ----a-w- h:\program files\psa2011se_us.exe2009-01-27 01:34 . 2009-01-27 01:34 1044480 ----a-w- h:\program files\mozilla firefox\plugins\libdivx.dll2009-01-27 01:34 . 2009-01-27 01:34 200704 ----a-w- h:\program files\mozilla firefox\plugins\ssldivx.dll2011-08-18 02:11 . 2011-05-12 10:03 134104 ----a-w- h:\program files\mozilla firefox\components\browsercomps.dll2011-07-03 01:43 . 2011-07-03 01:43 119808 ----a-w- h:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "h:\program files\uTorrentBar\tbuTo1.dll" [2011-01-01 3911776].[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}].[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]2011-01-01 07:53 3911776 ----a-w- h:\program files\ConduitEngine\ConduitEngin0.dll.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{389943B0-C3A2-4E69-82CB-8596A84CB3DC}].[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]2011-07-26 00:15 2532680 ----a-w- h:\program files\AVG\AVG9\Toolbar\IEToolbar.dll.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]2011-01-01 07:53 3911776 ----a-w- h:\program files\uTorrentBar\tbuTo1.dll.[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "h:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-07-26 2532680]"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "h:\program files\uTorrentBar\tbuTo1.dll" [2011-01-01 3911776]"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "h:\program files\ConduitEngine\ConduitEngin0.dll" [2011-01-01 3911776].[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}].[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}].[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}].[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "h:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-07-26 2532680]"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "h:\program files\uTorrentBar\tbuTo1.dll" [2011-01-01 3911776].[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}].[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]@="{7D688A77-C613-11D0-999B-00C04FD655E1}"[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]2011-01-21 14:44 8462336 ----a-w- h:\windows\system32\shell32.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"H/PC Connection Agent"="h:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]"swg"="h:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 68856]"SpybotSD TeaTimer"="h:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"nwiz"="nwiz.exe" [2007-12-04 1626112]"AVG9_TRAY"="h:\progra~1\AVG\AVG9\avgtray.exe" [2011-03-14 2071904]"CanonMyPrinter"="h:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 1983816]"CanonSolutionMenu"="h:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]"TkBellExe"="h:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-08-20 198160]"ISUSPM Startup"="h:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]"ISUSScheduler"="h:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-12 69632]"QuickTime Task"="h:\program files\QuickTime\qttask.exe" [2010-11-29 421888]"Adobe ARM"="h:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]"Google Desktop Search"="h:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-07-03 30192]"SunJavaUpdateSched"="h:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]"Malwarebytes' Anti-Malware"="h:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2007-12-04 8523776].[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2008-04-14 15360].h:\documents and settings\Andrew\Start Menu\Programs\Startup\PowerMenu.lnk - h:\program files\PowerMenu\PowerMenu.exe [2002-12-20 57344].h:\documents and settings\All Users\Start Menu\Programs\Startup\forteManager.lnk - h:\program files\LG Soft India\forteManager\bin\Monitor.exe [2010-9-18 1687552].[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2010-06-24 01:44 12536 ----a-w- h:\windows\system32\avgrsstx.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]2007-06-06 05:46 79368 ----a-w- h:\windows\system32\UmxWNP.dll.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]@="Service".[HKLM\~\startupfolder\H:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]path=h:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnkbackup=h:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup.[HKLM\~\startupfolder\H:^Documents and Settings^Andrew^Start Menu^Programs^Startup^Easy HDTV DVR.lnk]path=h:\documents and settings\Andrew\Start Menu\Programs\Startup\Easy HDTV DVR.lnkbackup=h:\windows\pss\Easy HDTV DVR.lnkStartup.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]2011-04-20 02:48 58656 ----a-w- h:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ask and Record FLV Service]2009-03-10 02:29 156672 ----a-w- h:\program files\Ask & Record Toolbar\FLVSrvc.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]2008-04-10 03:36 29757440 ----a-r- h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]2011-06-07 07:51 421160 ----a-w- h:\program files\iTunes\iTunesHelper.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]2008-04-14 00:12 1695232 ------w- h:\program files\Messenger\msmsgs.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]2007-12-04 17:41 8523776 ----a-w- h:\windows\system32\nvcpl.dll.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]2007-12-04 17:41 81920 ----a-w- h:\windows\system32\nvmctray.dll.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]2010-12-21 00:53 1483264 ----a-w- h:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]2010-08-20 07:29 214536 ----a-w- h:\program files\Real\RealPlayer\realplay.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]2009-06-17 11:44 85160 ----a-w- h:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]2007-03-27 04:22 4670968 ----a-w- h:\program files\Yahoo!\Messenger\YahooMessenger.exe.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]"HotKeysCmds"=h:\windows\system32\hkcmd.exe"IgfxTray"=h:\windows\system32\igfxtray.exe"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"Tweak UI"=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0).[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="h:\\Program Files\\Spearit\\Move Me\\MoveMe.exe"="h:\program files\Microsoft ActiveSync\rapimgr.exe"= h:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"h:\program files\Microsoft ActiveSync\wcescomm.exe"= h:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"h:\program files\Microsoft ActiveSync\WCESMgr.exe"= h:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"h:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="h:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"="h:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="h:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="h:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="h:\\Program Files\\AVG\\AVG9\\avgam.exe"="h:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"="h:\\Program Files\\AVG\\AVG9\\avgnsx.exe"="h:\\Program Files\\AVG\\AVG9\\avgupd.exe"="h:\\Program Files\\uTorrent\\uTorrent.exe"="h:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="h:\\Program Files\\Sprite Software\\Sprite Backup\\spriteservice.exe"="h:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"="h:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Keys Server\\sntlkeyssrvr.exe"="h:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"="h:\\Program Files\\Bonjour\\mDNSResponder.exe"="h:\\Program Files\\iTunes\\iTunes.exe"=.[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service.R0 AvgRkx86;avgrkx86.sys;h:\windows\system32\drivers\avgrkx86.sys [2/02/2010 3:35 PM 52872]R0 KmxStart;KmxStart;h:\windows\system32\drivers\KmxStart.sys [8/06/2009 10:02 AM 107000]R1 AvgLdx86;AVG AVI Loader Driver x86;h:\windows\system32\drivers\avgldx86.sys [2/02/2010 3:35 PM 216400]R1 AvgTdiX;AVG Network Redirector;h:\windows\system32\drivers\avgtdix.sys [2/02/2010 3:35 PM 243152]R1 KmxAgent;KmxAgent;h:\windows\system32\drivers\KmxAgent.sys [30/09/2009 4:51 PM 72184]R2 avg9wd;AVG WatchDog;h:\program files\AVG\AVG9\avgwdsvc.exe [24/06/2010 11:43 AM 308136]R2 MBAMService;MBAMService;h:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/08/2011 2:23 PM 366640]R2 SentinelKeysServer;Sentinel Keys Server;h:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [27/04/2007 12:00 AM 316992]R2 UmxAgent;HIPS Event Manager;h:\program files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [4/08/2009 10:42 AM 1141240]R2 UmxCfg;HIPS Configuration Interpreter;h:\program files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [13/07/2009 10:39 AM 801272]R2 UmxPol;HIPS Policy Manager;h:\program files\CA\SharedComponents\HIPSEngine\UmxPol.exe [27/07/2009 3:40 PM 289272]R2 VideoAcceleratorService;VideoAcceleratorService;h:\progra~1\SPEEDB~2\VideoAcceleratorService.exe -start -scm --> h:\progra~1\SPEEDB~2\VideoAcceleratorService.exe -start -scm [?]R3 KmxCfg;KmxCfg;h:\windows\system32\drivers\KmxCfg.sys [30/09/2009 4:51 PM 203768]R3 LGDDCDevice;LGDDCDevice;h:\program files\LG Soft India\forteManager\bin\I2CDriver.sys [18/09/2010 3:56 PM 14336]R3 Mach3;Mach3 Pulseing Service;h:\windows\system32\drivers\Mach3.sys [29/03/2010 1:30 PM 103040]R3 MBAMProtector;MBAMProtector;h:\windows\system32\drivers\mbam.sys [5/08/2011 2:23 PM 22712]R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [27/12/2008 4:26 PM 222976]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;h:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 1:16 PM 130384]S2 gupdate;Google Update Service (gupdate);h:\program files\Google\Update\GoogleUpdate.exe [15/02/2010 3:43 PM 135664]S3 AVG Security Toolbar Service;AVG Security Toolbar Service;h:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [27/10/2010 9:14 AM 1025352]S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;h:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3/07/2011 11:43 AM 30192]S3 gupdatem;Google Update Service (gupdatem);h:\program files\Google\Update\GoogleUpdate.exe [15/02/2010 3:43 PM 135664]S3 LGII2CDevice;LGII2CDevice;h:\program files\LG Soft India\forteManager\bin\PII2CDriver.sys [18/09/2010 3:56 PM 18432]S3 McComponentHostService;McAfee Security Scan Component Host Service;h:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 10:49 PM 227232]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;h:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 1:16 PM 753504].[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]2008-04-14 00:12 73216 ----a-w- h:\progra~1\OUTLOO~1\setup50.exe.[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]2008-04-14 00:12 73216 ----a-w- h:\progra~1\OUTLOO~1\setup50.exe.[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]2008-04-14 00:12 73216 ----a-w- h:\progra~1\OUTLOO~1\setup50.exe.[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]2008-04-14 00:12 73216 ----a-w- h:\progra~1\OUTLOO~1\setup50.exe.[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]2001-03-23 05:17 7168 ----a-w- h:\windows\system32\updcrl.exe.Contents of the 'Scheduled Tasks' folder.2011-08-16 h:\windows\Tasks\AppleSoftwareUpdate.job- h:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57].2011-08-22 h:\windows\Tasks\GoogleUpdateTaskMachineCore.job- h:\program files\Google\Update\GoogleUpdate.exe [2010-02-15 05:43].2011-08-22 h:\windows\Tasks\GoogleUpdateTaskMachineUA.job- h:\program files\Google\Update\GoogleUpdate.exe [2010-02-15 05:43].2011-08-14 h:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-2025429265-725345543-1003Core.job- h:\documents and settings\Andrew\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-06 04:22].2011-08-22 h:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-2025429265-725345543-1003UA.job- h:\documents and settings\Andrew\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-06 04:22].2011-08-22 h:\windows\Tasks\User_Feed_Synchronization-{F9D3AA91-4906-4EE2-896B-5EBD33F422DB}.job- h:\windows\system32\msfeedssync.exe [2007-08-14 18:31]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search/?q=%sIE: &Clean Traces - h:\program files\DAP\Privacy Package\dapcleanerie.htmIE: &Download with &DAP - h:\program files\DAP\dapextie.htmIE: Add to Google Photos Screensa&ver - h:\windows\system32\GPhotos.scr/200IE: Download &all with DAP - h:\program files\DAP\dapextie2.htmIE: Google Sidewiki... - h:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.htmlLSP: h:\program files\SpeedBit Video Accelerator\LSP3.2.2.4\SBLSP.dllTCP: DhcpNameServer = 192.168.0.1Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - h:\program files\AVG\AVG9\Toolbar\IEToolbar.dllDPF: DirectAnimation Java Classes - file://h:\windows\SYSTEM\dajava.cabDPF: Internet Explorer Classes for Java - file://h:\windows\SYSTEM\iejava.cabDPF: Microsoft XML Parser for Java - file://h:\windows\Java\classes\xmldso.cabFF - ProfilePath - h:\documents and settings\Andrew\Application Data\Mozilla\Firefox\Profiles\zsuktr8w.default\FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=FF - prefs.js: browser.search.selectedEngine - Yahoo! SearchFF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/FF - prefs.js: keyword.URL - hxxp://au.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_au&p=.- - - - ORPHANS REMOVED - - - -.BHO-{3017FB3E-9A77-4396-88C5-0EC9548FB42F} - h:\program files\SpeedBit Video Downloader\Toolbar\tbcore3.dllBHO-{31B27F2D-6BC6-451B-B3D2-4EAB36B2FC3B} - h:\program files\SpeedBit Video Downloader\Toolbar\tbcore3.dllToolbar-Locked - (no file)WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)MSConfigStartUp-Adobe Reader Speed Launcher - h:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exeMSConfigStartUp-TomTomHOME - h:\program files\TomTom HOME 2\TomTomHOMERunner.exeHKLM_ActiveSetup-{44BBA851-CC51-11CF-AAFA-00AA00B6015C} - rundll32.exeadvpack.dllAddRemove-Canon Digital Camera USB Driver - h:\program files\Canon\Digital Camera USB Driver\Uninst.isuAddRemove-Canon PhotoStitch 3.1 - h:\program files\Canon\PhotoStitch\Uninst.isuAddRemove-Canon Utilities RAW Image Converter - h:\program files\Canon\RAW Image Converter\Uninst.isuAddRemove-PhotoRecord - h:\program files\Canon\PhotoRecord\Uninst.isuAddRemove-RemoteCapture - h:\program files\Canon\RemoteCapture\Uninst.isuAddRemove-SigmaTel AC97 Audio Drivers - h:\program files\SigmaTel\SigmaTel AC97 Audio Drivers\Uninst.isuAddRemove-ZoomBrowserEXDeInstall - h:\program files\Canon\ZoomBrowser EX\Uninst.isu...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2011-08-23 00:40Windows 5.1.2600 Service Pack 3 NTFS.scanning hidden processes ... .scanning hidden autostart entries ... .scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'winlogon.exe'(748)h:\windows\system32\UmxWnp.Dll.- - - - - - - > 'lsass.exe'(804)h:\program files\SpeedBit Video Accelerator\LSP3.2.2.4\SBLSP.dllh:\program files\SpeedBit Video Accelerator\DLL3.2.2.6\ConfigDB.dll.- - - - - - - > 'explorer.exe'(4068)h:\windows\system32\WININET.dllh:\program files\PowerMenu\PowerMenuHook.dllh:\windows\system32\ieframe.dllh:\windows\system32\webcheck.dllh:\windows\system32\WPDShServiceObj.dllh:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dllh:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLLh:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dllh:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlrh:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngrh:\windows\system32\PortableDeviceTypes.dllh:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.h:\program files\AVG\AVG9\avgchsvx.exeh:\program files\AVG\AVG9\avgrsx.exeh:\program files\AVG\AVG9\avgcsrvx.exeh:\windows\System32\SCardSvr.exeh:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeh:\program files\Bonjour\mDNSResponder.exeh:\program files\Canon\IJPLM\IJPLMSVC.EXEh:\program files\Java\jre6\bin\jqs.exeh:\program files\AVG\AVG9\avgam.exeh:\program files\AVG\AVG9\avgnsx.exeh:\program files\CDBurnerXP\NMSAccessU.exeh:\windows\system32\nvsvc32.exeh:\program files\Common Files\Protexis\License Service\PsiService_2.exeh:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeh:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exeh:\progra~1\SPEEDB~2\VideoAcceleratorService.exeh:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exeh:\program files\Canon\CAL\CALMAIN.exeh:\windows\system32\wscntfy.exeh:\program files\AVG\AVG9\avgcsrvx.exeh:\progra~1\MICROS~2\rapimgr.exe.**************************************************************************.Completion time: 2011-08-23 00:45:02 - machine was rebootedComboFix-quarantined-files.txt 2011-08-22 14:44.Pre-Run: 34,918,535,168 bytes freePost-Run: 38,545,018,880 bytes free.WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsUnsupportedDebug="do not select this" /debugmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect.- - End Of File - - 79D6ED891FB921A029C28A04BD88B5BA.DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26Run by Andrew at 0:52:21 on 2011-08-23Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.306 [GMT 10:00].AV: AVG Internet Security *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}.============== Running Processes ===============.H:\WINDOWS\system32\svchost.exe -k DcomLaunchsvchost.exeH:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exeH:\Program Files\AVG\AVG9\avgchsvx.exeH:\Program Files\AVG\AVG9\avgrsx.exesvchost.exeH:\Program Files\AVG\AVG9\avgcsrvx.exeH:\WINDOWS\system32\spoolsv.exeH:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exeH:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exeH:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exesvchost.exeH:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeH:\Program Files\AVG\AVG9\avgwdsvc.exeH:\Program Files\Bonjour\mDNSResponder.exeH:\Program Files\Canon\IJPLM\IJPLMSVC.EXEH:\Program Files\Java\jre6\bin\jqs.exeH:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeH:\Program Files\AVG\AVG9\avgam.exeH:\Program Files\AVG\AVG9\avgnsx.exeH:\Program Files\CDBurnerXP\NMSAccessU.exeH:\WINDOWS\system32\nvsvc32.exeh:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeH:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeH:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exeH:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exeH:\WINDOWS\system32\svchost.exe -k imgsvcH:\PROGRA~1\SPEEDB~2\VideoAcceleratorService.exeH:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeH:\Program Files\Canon\CAL\CALMAIN.exeH:\Program Files\AVG\AVG9\avgcsrvx.exeH:\PROGRA~1\AVG\AVG9\avgtray.exeH:\WINDOWS\System32\svchost.exe -k HTTPFilterH:\Program Files\Common Files\Real\Update_OB\realsched.exeH:\Program Files\Common Files\InstallShield\UpdateService\issch.exeH:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeH:\Program Files\Common Files\Java\Java Update\jusched.exeH:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeH:\Program Files\Microsoft ActiveSync\wcescomm.exeH:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeH:\PROGRA~1\MICROS~2\rapimgr.exeH:\Program Files\LG Soft India\forteManager\bin\Monitor.exeH:\Program Files\PowerMenu\PowerMenu.exeH:\WINDOWS\explorer.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.google.com/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search/?q=%suURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - h:\program files\utorrentbar\tbuTo1.dllmURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - h:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - h:\program files\yahoo!\companion\installs\cpn3\yt.dllBHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - h:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - h:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - h:\program files\real\realplayer\rpbrowserrecordplugin.dllBHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - h:\program files\conduitengine\ConduitEngin0.dllBHO: Canon Easy-WebPrint EX BHO: {3785d0ad-bfff-47f6-bf5b-a587c162fed9} - h:\program files\canon\easy-webprint ex\ewpexbho.dllBHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - h:\progra~1\search~1\SEARCH~1.DLLBHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - h:\program files\avg\avg9\avgssie.dllBHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - h:\progra~1\spybot~1\SDHelper.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - h:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dllBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - h:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - h:\program files\avg\avg9\toolbar\IEToolbar.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - h:\program files\google\google toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - h:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dllBHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - h:\program files\utorrentbar\tbuTo1.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - h:\program files\java\jre6\bin\jp2ssv.dllBHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - h:\program files\windows live\toolbar\wltcore.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - h:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - h:\program files\yahoo!\companion\installs\cpn3\YTSingleInstance.dllBHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - h:\progra~1\dap\DAPIEL~1.DLLBHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - h:\progra~1\speedb~1\toolbar\grabber.dllTB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - h:\program files\yahoo!\companion\installs\cpn3\yt.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - h:\program files\windows live\toolbar\wltcore.dllTB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - h:\program files\avg\avg9\toolbar\IEToolbar.dllTB: Canon Easy-WebPrint EX: {759d9886-0c6f-4498-bab6-4a5f47c6c72f} - h:\program files\canon\easy-webprint ex\ewpexhlp.dllTB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - h:\program files\utorrentbar\tbuTo1.dllTB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - h:\program files\conduitengine\ConduitEngin0.dllTB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - h:\program files\speedbit video downloader\toolbar\tbcore3.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - h:\program files\google\google toolbar\GoogleToolbar_32.dllEB: Canon Easy-WebPrint EX: {21347690-ec41-4f9a-8887-1f4aee672439} - h:\program files\canon\easy-webprint ex\ewpexhlp.dllEB: {B0DE3308-5D5A-470D-81B9-634FC078393B} - No FileuRun: [H/PC Connection Agent] "h:\program files\microsoft activesync\wcescomm.exe"uRun: [swg] "h:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"uRun: [spybotSD TeaTimer] h:\program files\spybot - search & destroy\TeaTimer.exemRun: [nwiz] nwiz.exe /installmRun: [AVG9_TRAY] h:\progra~1\avg\avg9\avgtray.exemRun: [CanonMyPrinter] h:\program files\canon\myprinter\BJMyPrt.exe /logonmRun: [CanonSolutionMenu] h:\program files\canon\solutionmenu\CNSLMAIN.exe /logonmRun: [TkBellExe] "h:\program files\common files\real\update_ob\realsched.exe" -osbootmRun: [iSUSPM Startup] h:\progra~1\common~1\instal~1\update~1\isuspm.exe -startupmRun: [iSUSScheduler] "h:\program files\common files\installshield\updateservice\issch.exe" -startmRun: [QuickTime Task] "h:\program files\quicktime\qttask.exe" -atboottimemRun: [Adobe ARM] "h:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [Google Desktop Search] "h:\program files\google\google desktop search\GoogleDesktop.exe" /startupmRun: [sunJavaUpdateSched] "h:\program files\common files\java\java update\jusched.exe"mRun: [Malwarebytes' Anti-Malware] "h:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttraymRun: [NvCplDaemon] RUNDLL32.EXE h:\windows\system32\NvCpl.dll,NvStartupdRun: [CTFMON.EXE] h:\windows\system32\CTFMON.EXEStartupFolder: h:\docume~1\andrew\startm~1\programs\startup\powerm~1.lnk - h:\program files\powermenu\PowerMenu.exeStartupFolder: h:\docume~1\alluse~1\startm~1\programs\startup\fortem~1.lnk - h:\program files\lg soft india\fortemanager\bin\Monitor.exeIE: &Clean Traces - h:\program files\dap\privacy package\dapcleanerie.htmIE: &Download with &DAP - h:\program files\dap\dapextie.htmIE: Add to Google Photos Screensa&ver - h:\windows\system32\GPhotos.scr/200IE: Download &all with DAP - h:\program files\dap\dapextie2.htmIE: Google Sidewiki... - h:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.htmlIE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - h:\program files\paltalk messenger\Paltalk.exeIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - h:\program files\messenger\msmsgs.exeIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - h:\program files\windows live\writer\WriterBrowserExtension.dllIE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - h:\progra~1\micros~2\INetRepl.dllIE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - h:\progra~1\micros~2\INetRepl.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - h:\progra~1\mi1933~1\office11\REFIEBAR.DLLIE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - h:\progra~1\spybot~1\SDHelper.dllLSP: h:\program files\speedbit video accelerator\lsp3.2.2.4\SBLSP.dllDPF: DirectAnimation Java Classes - file://h:\windows\system\dajava.cabDPF: Internet Explorer Classes for Java - file://h:\windows\system\iejava.cabDPF: Microsoft XML Parser for Java - file://h:\windows\java\classes\xmldso.cabDPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cabDPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cabDPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cabDPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - h:\program files\yahoo!\common\Yinsthelper200711281.dllDPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc2.cabDPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cabDPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cabDPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230361826875DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38096.7684259259DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cabDPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cabDPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cabDPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} - hxxp://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://fdl.msn.com/public/chat/msnchat45.cabTCP: DhcpNameServer = 192.168.0.1TCP: Interfaces\{577A338A-A6AF-475F-AAAB-69028292F41D} : DhcpNameServer = 192.168.0.1Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - h:\program files\avg\avg9\toolbar\IEToolbar.dllHandler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - h:\program files\belarc\advisor\system\BAVoilaX.dllHandler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - h:\program files\avg\avg9\avgpp.dllNotify: avgrsstarter - avgrsstx.dllNotify: PFW - UmxWnp.DllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - h:\windows\system32\WPDShServiceObj.dllmASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "h:\progra~1\outloo~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /installmASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "h:\progra~1\outloo~1\setup50.exe" /app:oe /caller:win9x /user /install - "h:\progra~1\outloo~1\setup50.exe" /APP:OE /CALLER:IE50 /user /installmASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "h:\progra~1\outloo~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /installmASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "h:\progra~1\outloo~1\setup50.exe" /app:wab /caller:win9x /user /install - "h:\progra~1\outloo~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /installmASetup: {9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} - h:\windows\system32\updcrl.exe -e -u h:\windows\system\verisignpub1.crlmASetup: >IEPerUser - RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP.================= FIREFOX ===================.FF - ProfilePath - h:\documents and settings\andrew\application data\mozilla\firefox\profiles\zsuktr8w.default\FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=FF - prefs.js: browser.search.selectedEngine - Yahoo! SearchFF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/FF - prefs.js: keyword.URL - hxxp://au.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_au&p=FF - plugin: h:\documents and settings\andrew\local settings\application data\google\update\1.3.21.65\npGoogleUpdate3.dllFF - plugin: h:\progra~1\yahoo!\common\npyaxmpb.dllFF - plugin: h:\program files\adobe\reader 10.0\reader\air\nppdf32.dllFF - plugin: h:\program files\canon\easy-photoprint ex\NPEZFFPI.DLLFF - plugin: h:\program files\google\google earth\plugin\npgeplugin.dllFF - plugin: h:\program files\google\picasa3\npPicasa3.dllFF - plugin: h:\program files\google\update\1.3.21.65\npGoogleUpdate3.dllFF - plugin: h:\program files\java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: h:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dllFF - plugin: h:\program files\microsoft\office live\npOLW.dllFF - plugin: h:\program files\mozilla firefox\plugins\npdeployJava1.dllFF - plugin: h:\program files\windows live\photo gallery\NPWLPG.dll.============= SERVICES / DRIVERS ===============.R0 AvgRkx86;avgrkx86.sys;h:\windows\system32\drivers\avgrkx86.sys [2010-2-2 52872]R0 KmxStart;KmxStart;h:\windows\system32\drivers\KmxStart.sys [2009-6-8 107000]R1 AvgLdx86;AVG AVI Loader Driver x86;h:\windows\system32\drivers\avgldx86.sys [2010-2-2 216400]R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;h:\windows\system32\drivers\avgmfx86.sys [2010-2-2 29584]R1 AvgTdiX;AVG Network Redirector;h:\windows\system32\drivers\avgtdix.sys [2010-2-2 243152]R1 KmxAgent;KmxAgent;h:\windows\system32\drivers\KmxAgent.sys [2009-9-30 72184]R2 avg9wd;AVG WatchDog;h:\program files\avg\avg9\avgwdsvc.exe [2010-6-24 308136]R2 MBAMService;MBAMService;h:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-5 366640]R2 SentinelKeysServer;Sentinel Keys Server;h:\program files\common files\safenet sentinel\sentinel keys server\sntlkeyssrvr.exe [2007-4-27 316992]R2 UmxAgent;HIPS Event Manager;h:\program files\ca\sharedcomponents\hipsengine\UmxAgent.exe [2009-8-4 1141240]R2 UmxCfg;HIPS Configuration Interpreter;h:\program files\ca\sharedcomponents\hipsengine\UmxCfg.exe [2009-7-13 801272]R2 UmxPol;HIPS Policy Manager;h:\program files\ca\sharedcomponents\hipsengine\UmxPol.exe [2009-7-27 289272]R2 VideoAcceleratorService;VideoAcceleratorService;h:\progra~1\speedb~2\videoacceleratorservice.exe -start -scm --> h:\progra~1\speedb~2\VideoAcceleratorService.exe -start -scm [?]R3 KmxCfg;KmxCfg;h:\windows\system32\drivers\KmxCfg.sys [2009-9-30 203768]R3 LGDDCDevice;LGDDCDevice;h:\program files\lg soft india\fortemanager\bin\I2CDriver.sys [2010-9-18 14336]R3 Mach3;Mach3 Pulseing Service;h:\windows\system32\drivers\Mach3.sys [2010-3-29 103040]R3 MBAMProtector;MBAMProtector;h:\windows\system32\drivers\mbam.sys [2011-8-5 22712]R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [2008-12-27 222976]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;h:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 gupdate;Google Update Service (gupdate);h:\program files\google\update\GoogleUpdate.exe [2010-2-15 135664]S3 aawservice;Lavasoft Ad-Aware Service;h:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-11 611664]S3 AVG Security Toolbar Service;AVG Security Toolbar Service;h:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-27 1025352]S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;h:\program files\google\google desktop search\GoogleDesktop.exe [2011-7-3 30192]S3 gupdatem;Google Update Service (gupdatem);h:\program files\google\update\GoogleUpdate.exe [2010-2-15 135664]S3 LGII2CDevice;LGII2CDevice;h:\program files\lg soft india\fortemanager\bin\PII2CDriver.sys [2010-9-18 18432]S3 McComponentHostService;McAfee Security Scan Component Host Service;h:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;h:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504].=============== Created Last 30 ================.2011-08-22 14:23:43 -------- d-sha-r- H:\cmdcons2011-08-22 14:19:50 98816 ----a-w- h:\windows\sed.exe2011-08-22 14:19:50 518144 ----a-w- h:\windows\SWREG.exe2011-08-22 14:19:50 256000 ----a-w- h:\windows\PEV.exe2011-08-22 14:19:50 208896 ----a-w- h:\windows\MBR.exe2011-08-10 01:06:39 139656 -c----w- h:\windows\system32\dllcache\rdpwd.sys2011-08-10 01:05:00 10496 -c----w- h:\windows\system32\dllcache\ndistapi.sys2011-08-05 04:23:50 41272 ----a-w- h:\windows\system32\drivers\mbamswissarmy.sys2011-08-05 04:23:47 22712 ----a-w- h:\windows\system32\drivers\mbam.sys2011-08-05 04:23:47 -------- d-----w- h:\program files\Malwarebytes' Anti-Malware.==================== Find3M ====================.2011-08-15 07:08:01 404640 ----a-w- h:\windows\system32\FlashPlayerCPLApp.cpl2011-07-15 13:29:31 456320 ----a-w- h:\windows\system32\drivers\mrxsmb.sys2011-07-08 14:02:00 10496 ----a-w- h:\windows\system32\drivers\ndistapi.sys2011-06-24 14:10:36 139656 ----a-w- h:\windows\system32\drivers\rdpwd.sys2011-06-23 18:36:30 916480 ----a-w- h:\windows\system32\wininet.dll2011-06-23 18:36:30 43520 ----a-w- h:\windows\system32\licmgr10.dll2011-06-23 18:36:30 1469440 ------w- h:\windows\system32\inetcpl.cpl2011-06-23 12:05:13 385024 ----a-w- h:\windows\system32\html.iec2011-06-22 10:43:49 1126851 ----a-w- h:\windows\wallhalla_saver_f.scr2011-06-20 17:44:52 293376 ----a-w- h:\windows\system32\winsrv.dll2011-06-02 14:02:05 1858944 ----a-w- h:\windows\system32\win32k.sys2011-01-21 00:41:49 19985265 ----a-w- h:\program files\vlc-1.1.5-win32.exe2005-07-30 07:10:00 556704 ----a-w- h:\program files\GoogleToolbarInstaller.exe2005-07-26 03:16:40 6285024 ----a-w- h:\program files\emssetup122.exe2005-07-26 01:49:30 20798256 ----a-w- h:\program files\AdbeRdr70_enu_full.exe2005-07-26 01:45:56 6811904 ----a-w- h:\program files\psa2011se_us.exe.============= FINISH: 0:53:08.70 =============== Link to post Share on other sites More sharing options...
Staff screen317 Posted August 25, 2011 Staff ID:469370 Share Posted August 25, 2011 Hi, Next, please run a free online scan with the ESET Online Scanner Note: You will need to use Internet Explorer for this scan.Tick the box next to YES, I accept the Terms of Use.Click StartWhen asked, allow the ActiveX control to installClick StartMake sure that the options Remove found threats and the option Scan unwanted applications is checkedClick Scan Wait for the scan to finishUse Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txtCopy and paste that log as a reply to this topic Next, download my Security Check from here or here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document. Let me know how things are running now and what issues remain. Link to post Share on other sites More sharing options...
ausworkshop Posted August 27, 2011 Author ID:469900 Share Posted August 27, 2011 Sorry for the delay. I tried to download and run eset online scanner in Explorer as requested. When I clicked yes to accept terms of use the explorer asked to click here to allow Active X control but when I tried to click it explorer stopped responding. After reading some info and trying a few things it still wouldn't work so I tried downloading it using Firefox and it worked by using a 'smart installer' so I have attached the results of this scan and the checkup text below, I hope this is ok.ESETSmartInstaller@High as downloader log:all ok# version=7# OnlineScannerApp.exe=1.0.0.1# OnlineScanner.ocx=1.0.0.6528# api_version=3.0.2# EOSSerial=42da200e8bda8c44b2bcbec56c237e9b# end=finished# remove_checked=true# archives_checked=false# unwanted_checked=true# unsafe_checked=false# antistealth_checked=true# utc_time=2011-08-27 04:31:35# local_time=2011-08-27 02:31:35 (+1000, AUS Eastern Standard Time)# country="Australia"# lang=1033# osver=5.1.2600 NT Service Pack 3# compatibility_mode=1029 16777189 100 91 0 48491398 0 0# compatibility_mode=4864 16777215 100 0 80987459 80987459 0 0# compatibility_mode=8192 67108863 100 0 0 0 0 0# scanned=190410# found=2# cleaned=2# scan_time=3988H:\Documents and Settings\All Users\Application Data\SpeedBit\DAP\Offers\speedupmypc.exe Win32/SpeedUpMyPC application (deleted - quarantined) 00000000000000000000000000000000 CH:\System Volume Information\_restore{6DD0277A-5759-4FD7-8A97-2A22CAE790E9}\RP1067\A0143434.exe Win32/SpeedUpMyPC application (deleted - quarantined) 00000000000000000000000000000000 C Results of screen317's Security Check version 0.99.18 Windows XP Service Pack 3 Internet Explorer 8 `````````````````````````````` Antivirus/Firewall Check: AVG 9.0 ESET Online Scanner v3 McAfee Security Scan Plus Antivirus up to date! ``````````````````````````````` Anti-malware/Other Utilities Check: Malwarebytes' Anti-Malware CCleaner Java 6 Update 26 Adobe Flash Player 10.3.183.5 Adobe Reader X (10.1.0) ```````````````````````````````` Process Check: objlist.exe by Laurent Malwarebytes' Anti-Malware mbamservice.exe Malwarebytes' Anti-Malware mbamgui.exe AVG avgwdsvc.exe AVG avgtray.exe AVG avgrsx.exe AVG avgnsx.exe AVG avgemc.exe ``````````End of Log```````````` My pc seems to be running better now although my Malwarebytes trial period expired so I am unable to check if its still detecting outgoing IP's as it was before.Please let me know if there is anything else I need to do and thank you so much for your time spent helping me. Link to post Share on other sites More sharing options...
Staff screen317 Posted August 29, 2011 Staff ID:470781 Share Posted August 29, 2011 Hi,Your version of AVG is out of date.Please update it and ensure that you are using AVG version 11.Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstallThis uninstalls all of ComboFix's components.Delete SecurityCheck.After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program(s) (if present):ESET Online Scanner v3 Restart your computer.Let me know what issues remain.-screen317 Link to post Share on other sites More sharing options...
ausworkshop Posted September 2, 2011 Author ID:471783 Share Posted September 2, 2011 Thanks for your help. I thought AVG would update to 2011 automatically when I click 'update' but it hasn't so I've uninstalled it and installed the 2011 version.My pc seems to be running better now although I can't check it for outgoing IP's without the full version of Malwarebytes. I had a trial for a few weeks but its expired now. Hopefully all will be ok.Sometimes when watching a youtube video it will crash when I go from small screen to full screen mode but this is probably a separate problem.Thanks so much for your time helping me with all this. Link to post Share on other sites More sharing options...
Staff screen317 Posted September 5, 2011 Staff ID:472889 Share Posted September 5, 2011 Hi,Update your graphics card drive for the video issue.If there are no issues then I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:Green to go Yellow for caution Red to stop WOT has an addon available for both Firefox and IE.5) Be sure to update your Antivirus and Antispyware programs often!Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?Safe surfing,-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted September 28, 2011 Staff ID:480173 Share Posted September 28, 2011 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts