View Full Version : PC sounds like a hoover, extremely slow;IE or Firefox no longer working
Blackredgold1964
2008-11-29, 02:34
Good Day,
My PC's internet browsers don't work, hangs in a loop. I get one msg consistently"IE cannot download KB112608age02.dll.html from XXXX" (I can give this IP address on request) . Any help would be greatly appreciated.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:16:53, on 29/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\CNAC4RPK.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\Dell Wireless\PRISMCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {f519fcf9-813a-4ea7-a487-4d9c6f5ffd1f} - C:\WINDOWS\system32\bebufizu.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [gafibemaga] Rundll32.exe "C:\WINDOWS\system32\vokizaku.dll",s
O4 - HKLM\..\Run: [CPM4fafd443] Rundll32.exe "c:\windows\system32\dejufedu.dll",a
O4 - HKLM\..\Run: [4c9ce7df] rundll32.exe "C:\WINDOWS\system32\fipuyuko.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [gafibemaga] Rundll32.exe "C:\WINDOWS\system32\vokizaku.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [gafibemaga] Rundll32.exe "C:\WINDOWS\system32\vokizaku.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: Wireless USB 2.0 WLAN Card Utility.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\jupozife.dll c:\windows\system32\puzesale.dll c:\windows\system32\dokohoke.dll c:\windows\system32\dejufedu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dejufedu.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dejufedu.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 10964 bytes
pskelley
2008-12-02, 10:49
Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.
Make sure you read and follow the directions, anything else will slow the process and waste both of our time. I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
The junk can be tough to remove, so do not expect fast or easy.
1) If you have noise coming from the computer it is unlikely that is malware related. May be the dust needs to be blown out of the fans or that your hard drive is about to go, there are few moving parts in a computer that cause noise, you may get information from a free diagnostic here:
http://www.pcpitstop.com/pcpitstop/
(not suggestions to purchase anything)
You are infected so let's start with malware removal like this:
2) Post an uninstall list: Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list..." Button.
Save it to your desktop. Copy and paste the contents into your reply.
Image: http://img.bleepingcomputer.com/tutorials/hijackthis/uninstall-man.jpg
3) DO NOT ENABLE Spybot S&D TeaTimer while we are working together.
4) A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use
Download ComboFix from one of these locations:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link (http://www.bleepingcomputer.com/forums/topic114351.html) for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
http://i24.photobucket.com/albums/c30/ken545/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://i24.photobucket.com/albums/c30/ken545/whatnext.jpg
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.
*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Tutorial if needed
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Thanks
Blackredgold1964
2008-12-05, 01:34
Dear pskelley,
Thanks for your reply. Menawhile I reimaged my PC since it became so chaotic. IE is now running fine but since we started this thread I still wanted to take the opportunity to post the logs which I suppose are clean now.
Maybe you can answer some questions as well.
Can I use PC Cillin Internet security 2007 with a renewed subsription until Sept 2009, or do the two not go together well? I don't want to buy PC Cillin 2008.
Additionally, today I got the trend micro warning that 2 minor and 3 major suspicious changes were made to IE:
Twice it said "Change to the homepage" , although it's still Dell as it has been ever since I reimaged
And then 3 Changes to IE. Tools - Internet Options - Advanced:
I think they were
"Do not save encrypted pages to disk" is now disabled
"Empty Temp interent files" is now disabled
Additionally I get with almost every Internet page "suspected spyware detected: Infected file: "A0003419.ocx. Name: ADWare GTDown."
The Trend micro support page does not seem to give info on what to do with it.
I remember that in April I had to reimage due to malware and it all started as harmless as this so I wonder if I am infected again and if PC Cillin might not be safe enough.
here we go with the posts:
ComboFix 08-12-04.04 - Matthias 2008-12-05 0:00:39.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.449 [GMT 0:00]
Running from: c:\documents and settings\Matthias\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-11-04 to 2008-12-04 )))))))))))))))))))))))))))))))
.
2008-12-04 21:24 . 2008-12-04 21:49 <DIR> d-------- c:\documents and settings\Christiane\Application Data\AdobeUM
2008-11-30 21:37 . 2008-11-30 21:46 <DIR> d-------- c:\documents and settings\Svenja\Application Data\AdobeUM
2008-11-30 17:42 . 2008-04-13 18:45 26,368 --a------ c:\windows\SYSTEM32\DLLCACHE\usbstor.sys
2008-11-30 17:38 . 2005-05-09 08:30 <DIR> d-------- c:\documents and settings\Svenja\Application Data\You've Got Pictures Screensaver
2008-11-30 17:38 . 2005-05-09 08:35 <DIR> d-------- c:\documents and settings\Svenja\Application Data\Sonic
2008-11-30 17:38 . 2005-05-09 08:28 <DIR> d-------- c:\documents and settings\Svenja\Application Data\Jasc Software Inc
2008-11-30 17:38 . 2005-05-09 08:32 <DIR> d--h----- c:\documents and settings\Svenja\Application Data\Gtek
2008-11-30 17:38 . 2008-11-30 17:38 <DIR> d-------- c:\documents and settings\Svenja
2008-11-30 17:36 . 2005-05-09 08:30 <DIR> d-------- c:\documents and settings\Sophie\Application Data\You've Got Pictures Screensaver
2008-11-30 17:36 . 2005-05-09 08:35 <DIR> d-------- c:\documents and settings\Sophie\Application Data\Sonic
2008-11-30 17:36 . 2005-05-09 08:28 <DIR> d-------- c:\documents and settings\Sophie\Application Data\Jasc Software Inc
2008-11-30 17:36 . 2005-05-09 08:32 <DIR> d--h----- c:\documents and settings\Sophie\Application Data\Gtek
2008-11-30 17:36 . 2008-11-30 17:36 <DIR> d-------- c:\documents and settings\Sophie
2008-11-30 17:34 . 2005-05-09 08:30 <DIR> d-------- c:\documents and settings\Christiane\Application Data\You've Got Pictures Screensaver
2008-11-30 17:34 . 2005-05-09 08:35 <DIR> d-------- c:\documents and settings\Christiane\Application Data\Sonic
2008-11-30 17:34 . 2005-05-09 08:28 <DIR> d-------- c:\documents and settings\Christiane\Application Data\Jasc Software Inc
2008-11-30 17:34 . 2005-05-09 08:32 <DIR> d--h----- c:\documents and settings\Christiane\Application Data\Gtek
2008-11-30 17:34 . 2008-11-30 17:34 <DIR> d-------- c:\documents and settings\Christiane
2008-11-30 17:03 . 2008-04-13 18:47 25,856 --a------ c:\windows\SYSTEM32\DRIVERS\usbprint.sys
2008-11-30 17:03 . 2008-04-13 18:47 25,856 --a------ c:\windows\SYSTEM32\DLLCACHE\usbprint.sys
2008-11-30 17:02 . 2007-01-11 15:00 184,320 --a------ c:\windows\SYSTEM32\CNAC4EMU.DLL
2008-11-30 17:02 . 2007-01-11 15:00 102,457 --a------ c:\windows\SYSTEM32\CNAC4SMK.DLL
2008-11-30 17:02 . 2007-01-15 01:13 63,176 --a------ c:\windows\SYSTEM32\CNAC4RPK.EXE
2008-11-30 17:02 . 2007-01-11 15:00 28,737 --a------ c:\windows\SYSTEM32\CNAC4LMK.DLL
2008-11-30 17:02 . 2007-01-11 15:00 28,672 --a------ c:\windows\SYSTEM32\CNAC4PTU.DLL
2008-11-30 17:01 . 2008-11-30 17:03 <DIR> d-------- c:\program files\Canon
2008-11-30 15:56 . 2008-11-30 15:56 <DIR> d-------- c:\windows\SYSTEM32\scripting
2008-11-30 15:56 . 2008-11-30 15:56 <DIR> d-------- c:\windows\SYSTEM32\en
2008-11-30 15:56 . 2008-11-30 15:56 <DIR> d-------- c:\windows\SYSTEM32\bits
2008-11-30 15:56 . 2008-11-30 15:56 <DIR> d-------- c:\windows\l2schemas
2008-11-30 15:54 . 2008-11-30 15:54 <DIR> d-------- c:\windows\ServicePackFiles
2008-11-30 15:47 . 2008-11-30 15:47 <DIR> d-------- c:\windows\EHome
2008-11-30 14:46 . 2004-08-03 22:29 327,040 --------- c:\windows\SYSTEM32\DRIVERS\ati2mtaa.sys
2008-11-30 14:16 . 2008-06-13 11:05 272,128 --------- c:\windows\SYSTEM32\DRIVERS\bthport.sys
2008-11-30 14:16 . 2008-06-13 11:05 272,128 --------- c:\windows\SYSTEM32\DLLCACHE\bthport.sys
2008-11-30 14:15 . 2008-08-14 10:04 138,496 --------- c:\windows\SYSTEM32\DLLCACHE\afd.sys
2008-11-30 14:14 . 2008-09-15 12:12 1,846,400 --------- c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2008-11-30 14:14 . 2008-09-08 10:41 333,824 --------- c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-11-30 14:09 . 2008-08-14 10:11 2,189,184 --------- c:\windows\SYSTEM32\DLLCACHE\ntoskrnl.exe
2008-11-30 14:09 . 2008-08-14 10:09 2,145,280 --------- c:\windows\SYSTEM32\DLLCACHE\ntkrnlmp.exe
2008-11-30 14:09 . 2008-08-14 09:33 2,066,048 --------- c:\windows\SYSTEM32\DLLCACHE\ntkrnlpa.exe
2008-11-30 14:09 . 2008-08-14 09:33 2,023,936 --------- c:\windows\SYSTEM32\DLLCACHE\ntkrpamp.exe
2008-11-30 14:04 . 2008-05-08 14:02 203,136 --------- c:\windows\SYSTEM32\DLLCACHE\rmcast.sys
2008-11-30 14:01 . 2008-10-24 11:21 455,296 --------- c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-11-30 14:00 . 2008-11-30 14:00 <DIR> d-------- c:\documents and settings\Matthias\Application Data\AdobeUM
2008-11-30 14:00 . 2008-04-11 19:04 691,712 --------- c:\windows\SYSTEM32\DLLCACHE\inetcomm.dll
2008-11-30 14:00 . 2008-05-01 14:33 331,776 --------- c:\windows\SYSTEM32\DLLCACHE\msadce.dll
2008-11-30 13:59 . 2008-11-30 13:59 <DIR> d-------- c:\program files\Common Files\Adobe
2008-11-30 13:59 . 2008-10-15 16:34 337,408 --------- c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2008-11-30 13:58 . 2008-09-04 17:15 1,106,944 --------- c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-11-30 13:56 . 2007-08-10 20:46 26,488 --a------ c:\windows\SYSTEM32\spupdsvc.exe
2008-11-30 12:28 . 2008-11-30 12:28 <DIR> d-------- c:\program files\Trend Micro
2008-11-30 12:28 . 2008-11-30 12:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Trend Micro
2008-11-30 12:28 . 2008-08-16 02:53 1,195,448 --a------ c:\windows\SYSTEM32\DRIVERS\vsapint.sys
2008-11-30 12:28 . 2007-03-07 22:19 288,848 --a------ c:\windows\SYSTEM32\DRIVERS\TM_CFW.sys
2008-11-30 12:28 . 2008-08-16 03:00 205,328 --a------ c:\windows\SYSTEM32\DRIVERS\tmxpflt.sys
2008-11-30 12:28 . 2007-03-07 22:19 111,888 --a------ c:\windows\SYSTEM32\DRIVERS\tm_mbd_c.sys
2008-11-30 12:28 . 2007-03-07 22:19 75,088 --a------ c:\windows\SYSTEM32\DRIVERS\tmtdi.sys
2008-11-30 12:28 . 2008-08-16 03:00 36,368 --a------ c:\windows\SYSTEM32\DRIVERS\tmpreflt.sys
2008-11-30 11:15 . 2008-11-30 11:15 2 --a------ c:\windows\msoffice.ini
2008-11-30 11:11 . 2008-11-30 11:11 <DIR> d-------- c:\documents and settings\Matthias\Application Data\McAfee.com Personal Firewall
2008-11-30 11:11 . 2008-11-30 11:11 <DIR> d-------- c:\documents and settings\LocalService\Application Data\McAfee.com Personal Firewall
2008-11-30 11:10 . 2005-05-09 08:30 <DIR> d-------- c:\documents and settings\Matthias\Application Data\You've Got Pictures Screensaver
2008-11-30 11:10 . 2005-05-09 08:35 <DIR> d-------- c:\documents and settings\Matthias\Application Data\Sonic
2008-11-30 11:10 . 2005-05-09 08:28 <DIR> d-------- c:\documents and settings\Matthias\Application Data\Jasc Software Inc
2008-11-30 11:10 . 2005-05-09 08:32 <DIR> d--h----- c:\documents and settings\Matthias\Application Data\Gtek
2008-11-30 11:10 . 2008-12-01 21:03 <DIR> d-------- c:\documents and settings\Matthias
2008-11-30 11:10 . 2008-04-14 00:12 221,184 --a------ c:\windows\SYSTEM32\wmpns.dll
2008-11-30 11:10 . 2004-07-27 23:00 108,544 --------- c:\windows\SYSTEM32\pxcpyi64.exe
2008-11-30 11:10 . 2004-08-02 00:03 104,960 --------- c:\windows\SYSTEM32\pxinsi64.exe
2008-11-30 11:04 . 2008-04-13 18:39 14,592 --a------ c:\windows\SYSTEM32\DRIVERS\kbdhid.sys
2008-11-30 11:04 . 2001-08-17 13:48 12,160 --a------ c:\windows\SYSTEM32\DRIVERS\mouhid.sys
2008-11-30 11:04 . 2008-04-13 18:45 10,368 --a------ c:\windows\SYSTEM32\DRIVERS\hidusb.sys
2008-11-30 11:04 . 2008-11-30 11:04 8,192 --a------ c:\windows\REGLOCS.OLD
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-30 11:18 --------- d-----w c:\program files\McAfee.com
2008-11-30 11:15 --------- d-----w c:\program files\Modem Helper
2008-11-30 11:15 --------- d-----w c:\program files\Common Files\AOL
2008-11-30 11:15 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-11-30 11:13 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 14:13 202,776 ----a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 14:13 202,776 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 14:09 51,224 ----a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 14:09 51,224 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 14:09 43,544 ----a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\SYSTEM32\WUPS.DLL
2008-10-16 14:08 34,328 ----a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll
2008-10-03 17:41 6,066,176 ------w c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\SYSTEM32\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\SYSTEM32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\SYSTEM32\DLLCACHE\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\SYSTEM32\msxml3.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2004-07-19 306688]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-05-09 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-05-09 98304]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
"pccguide.exe"="c:\program files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-03-07 3429904]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Wireless USB 2.0 WLAN Card Utility.lnk - c:\program files\Dell Wireless\PRISMCFG.exe [2005-05-09 917611]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\CNAC4RPK.EXE"=
R2 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2007-03-07 480784]
R2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [2007-03-07 943696]
R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2008-11-30 36368]
R2 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [2007-03-07 566872]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\DRIVERS\TM_CFW.sys [2008-11-30 288848]
S4 PRISMSVC;PRISMSVC;c:\windows\system32\PRISMSVC.EXE [2005-05-09 57344]
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-05 00:02:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\PRISMAPI.dll
- - - - - - - > 'winlogon.exe'(2460)
c:\windows\system32\PRISMAPI.dll
.
Completion time: 2008-12-05 0:03:18
ComboFix-quarantined-files.txt 2008-12-05 00:03:15
Pre-Run: 127,432,589,312 bytes free
Post-Run: 127,671,750,656 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
183 --- E O F --- 2008-12-01 19:07:05
Adobe Acrobat - Reader 6.0.2 Update
Adobe Reader 6.0.1
ARTEuro
ATI Control Panel
ATI Display Driver
Broadcom Management Programs
Business Contact Manager for Outlook 2003
Canon LBP5000
Dell Driver Reset Tool
Dell Media Experience
Dell Support 5.0.0 (630)
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
Intel(R) 537EP V9x DF PCI Modem
Internet Explorer Default Page
Jasc Paint Shop Photo Album
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2_03
Learn2 Player (Uninstall Only)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Small Business Edition 2003
Modem Event Monitor
Modem Helper
Modem On Hold
PowerDVD 5.3
QuickTime
RealPlayer Basic
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Sonic DLA
Sonic MyDVD
Sonic RecordNow!
Sonic Update Manager
Trend Micro PC-cillin Internet Security 2007
Trend Micro PC-cillin Internet Security 2007
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
USB 2.0 Wireless LAN Card Utility
Viewpoint Media Player
Windows XP Service Pack 3
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:28:21, on 05/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\CNAC4RPK.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Dell Wireless\PRISMCFG.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCMAIN.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PccHCMS.exe
C:\Documents and Settings\Matthias\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKUS\S-1-5-21-4039293457-654909319-3567631755-1011\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Sophie')
O4 - HKUS\S-1-5-21-4039293457-654909319-3567631755-1011\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'Sophie')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless USB 2.0 WLAN Card Utility.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
--
End of file - 6338 bytes
Thanks for your time!
Blackredgold1964
pskelley
2008-12-05, 09:07
Thanks for letting me know, looking at your uninstall list first.
Uninstall list: I look for malware and security issues and will not know all of your programs, but you should.
Hackers are using out of date programs to infect folks more and more,
Here is a small free tool that lets you know when something needs an update if you are interested:
http://secunia.com/vulnerability_scanning/personal/ While PSI runs in the System Tray for realtime notifications, I personally prefer to turn it off in MSConfig and run it from All Programs when I want to do a check.
Adobe Acrobat - Reader 6.0.2 Update
Adobe Reader 6.0.1 <<< out of date, see this information:
http://news.cnet.com/8301-1009_3-10081618-83.html?tag=nl.e433
http://www.filehippo.com/download_adobe_reader/
(if you want a smaller program, look at this one)
Foxit Reader 2.3 for Windows
http://www.foxitsoftware.com/pdf/rd_intro.php
Java 2 Runtime Environment, SE v1.4.2_03
VERY, VERY old and exploitable, see this information:
http://forums.spybot.info/showpost.php?p=12880&postcount=2
Be aware of this information so you can opt out of anything you do not want.
Microsoft Does MSN Toolbar Distribution Deal With Java:
http://searchengineland.com/microsoft-does-msn-toolbar-distribution-deal-with-java-15413.php
I have seen it can be very hard to uninstall these old versions, this tool will help if that is the case:
http://raproducts.org/
Viewpoint Media Player <<< suggested uninstall, see this information:
For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
http://www.spywareinfo.com/newsletter/archives/2005/nov4.php#viewpoint
http://www.clickz.com/news/article.php/3561546
I am not seeing anything in the these logs that looks like malware but since you reformatted, that is not unusual since the combofix database is geared toward nasty malware. I am not sure what Trend Micro is finding?
Can I use PC Cillin Internet security 2007 with a renewed subsription until Sept 2009, or do the two not go together well? I don't want to buy PC Cillin 2008.
That is a question for Trend Micro support:
http://esupport.trendmicro.com/support/supportcentral/supportcentral.do?id=m1
Additionally, today I got the trend micro warning that 2 minor and 3 major suspicious changes were made to IE:
If you will look at your HijackThis log, here is a tutorial:
http://www.bleepingcomputer.com/tutorials/tutorial42.html
Look at Section 12 in the Table of contents to understand, then look at your HJT log at the R0/R1 items. You have Dell and Microsoft set there and I suggest you use HJT log to remove all of those and set the Home Page you wish to have.
http://www.my-pc-help.com/Articles/Software/HowtosetyourHomepageinInternetExplorer67/tabid/103/Default.aspx
Additionally I get with almost every Internet page "suspected spyware detected: Infected file: "A0003419.ocx. Name: ADWare GTDown."
The Trend micro support page does not seem to give info on what to do with it.
That's just not enough information, I would need the name and location of any item being described, if it is occuring when you surf, take care where you go, see this:
Infected websites are the next internet security threats
http://www.google.com/search?hl=en&q=infected+websites&btnG=Google+Search
If you wish to run another good scan for a second opinion before we remove combofix, try this one.
Run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner
Next Click on Launch Kaspersky Online Scanner
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
* The program will launch and then begin downloading the latest definition files:
* Once the files have been downloaded click on NEXT
* Now click on Scan Settings
* In the scan settings make that the following are selected:
* Scan using the following Anti-Virus database:
* Standard
* Scan Options:
* Scan Archives
* Scan Mail Bases
* Click OK
* Now under select a target to scan:
* Select My Computer
* This will program will start and scan your system.
* The scan will take a while so be patient and let it run.
* Once the scan is complete it will display if your system has been infected.
* Now click on the Save as Text button:
* Save the file to your desktop.
Then post it here.
Thanks
Blackredgold1964
2008-12-05, 09:31
Dear pskelley,
Thanks for the reply.
I used last night to install Adobe version 9 plus the Google bar and ran a Trend Micro virus scan and this morning got message that it found two viruses, one quaranteened, the other not possible to quaranteen. I took a screenshot, restarted and I log on with any of my 5 profiles and it just sits there with the Dell desktop wallpaper but no start bar or desktop icons. The HD is completely quiet. When clicking ctrl/alt/del I am able to see the task mgr only which shows 0%cpu usage.
Do you possibly have any suggestions?
Regards
Blackredgold1964 (sending this mail from another PC)
pskelley
2008-12-05, 09:46
Sounds like it might be a hardware problem but that is only a guess. Post here for help, these folks are good with those kinds of issues.
http://forums.pcpitstop.com/index.php?showforum=3
Hope it helps:santa:
Blackredgold1964
2008-12-11, 18:09
Dear pskelley,
Thank you very, very for the many helpful tips. Just to keep yo updated , here's what I did.
I tried to log on to http://forums.pcpitstop.com/index.php?showforum=3 as you suggested to investigate a HW issue but somehow did not manage to get through the registration procedure and when mailing the Adminstrators did not get a reply.
Meanwile I reimaged the PC and it has been stable for one week so should be fine now.
I removed the Java 2 Runtime Environment, SE v1.4.2_03
as suggested here
http://forums.spybot.info/showpost.p...80&postcount=2
and loaded the latest version- seems fine.
Adobe updated - seems fine.
Viewpoint Media Player - I removed this.
I mailed Trend Micro but did not get a reply and now run AVG - fine.
So hopefully it should run well, I learned something along the way, albeit the hard way.
Thanks again
blackredgold1964
pskelley
2008-12-11, 18:25
Thanks for the feedback, and I am glad you resolved the issues. Here is more good information:
http://www.netsquirrel.com/msconfig/msconfig_xp.html
http://www.malwareremoval.com/tutorials/runningslowly.php
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
Some good information for you:
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx
Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml
http://www.malwarecomplaints.info/
Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.
http://users.telenet.be/bluepatchy/miekiemoes/Links.html
Safe surfing and Happy Holidays:santa: