PDA

View Full Version : Many Computer Problems. Help!



PrincessTwa
2007-03-15, 23:35
Ok, so I've ran like 4 virus/malware/spyware scanners, and I haven't been able to find the problem. I've run VundoFix, ATF, Registry Mechanic, and Doctor Spyware, as well as AVG Anti-Spyware.

Logfile of HijackThis v1.99.1
Scan saved at 5:27:37 PM, on 3/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Gaim\gaim.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\blahblah.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = saintchad.org
O17 - HKLM\Software\..\Telephony: DomainName = saintchad.org
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = saintchad.org
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = saintchad.org
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = saintchad.org
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Desktop Monitor Web Server (DMWebSrv) - Unknown owner - C:\SyAM\jetty\DMWebSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: QBAVQH - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QBAVQH.exe (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Desktop Monitor Agent (SMAgent) - SyAM Software, Inc. - C:\SyAM\system_monitor\agent\smaagent.exe
O23 - Service: Remote Console (winvnc) - Unknown owner - C:\SyAM\system_monitor\agent\winvnc.exe" -service (file missing)

*Something I noticed was I ran Registry Mechanic and it kept coming up with 2 infected files. They were registry keys and they always appear. Tried deleting them manually, but they give the error that they can't be deleted

Also, I have the evil aspi32.sys blue screen of death error. i don't know if somehow these are linked, but if someone can help me, it'll be highly appreciated!

Mr_JAk3
2007-03-22, 12:45
Hello PrincessTwa and welcome to the Forums :)

Sorry for the long delay...

Was this log taken from the safe mode?

Please run a GMER Rootkit scan:

Download GMER's application from here:
http://www.gmer.net/gmer.zip

Unzip it and start the GMER.exe
Click the Rootkit tab and click the Scan button.

Once done, click the Copy button.
This will copy the results to your clipboard.
Paste the results in your next reply along with a fresh HijackThis log (take it in the normal mode)

Warning ! Please, do not select the "Show all" checkbox during the scan.

tashi
2007-03-29, 07:51
This topic has been archived.

If you need it re-opened please send me a private message (pm) and provide a link to the thread. Applies only to the original poster, anyone else with similar problems please start a new topic.