View Full Version : Can Only Access Internet In Safe Mode
BlackBike
2009-02-22, 08:41
On my son's computer, we are no longer able to access the Internet through either IE7, IE8, or FireFox. However, we can access the internet in Windows XP Safe Mode with Networking.
I have gone through all the steps in the Microsoft Support article KB 926431 and KB 811259.
The Linksys wireless connection we have works just fine. In fact, before I went through all the steps in KB 926431, I was able to use the Restore function to go back to a point where I could access the browser normally. The problem seems to be centered on the most recent Microsoft Updates. Unfortunately, all my old Restore points are gone, and I have been unable to delete the Windows XP Service Pack 3 and then IE7.
My research suggested that MalWare may be the problem. Therefore, I have used HijackThis and provide this log in hopes that someone will be able to help me resolve this issue. Thanks in advance for any help you can provide.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:07:59 AM, on 2/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: Microsoft Outlook.lnk = C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
O4 - Startup: YPOPs.lnk = ?
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
--
End of file - 6372 bytes
Hi
Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop. Post them back to your topic.
BlackBike
2009-02-27, 02:16
Thank You Blade,
Sorry for the late response. I was away for a couple of days. I also have to appoligize if I changed something important. I don't know what script blockers are, so to be sure, I uninstalled my son's AntiVirus protection (AVG Free) and the two spyware protections (Spybot and AdAware). I figured it can't do any harm since we can't access the internet on his computer (except when the computer is in Safe Mode).
Anyway, as instructed I have posted the DDS text file and the Attach file. I realize the instructions said to attach a zipped version of the "Attach" file, but I don't see how to do that. Anyway, it is a very short file, so I hope it is OK if I just include it with my post.
Thank you for your help and attention to this problem. I look forward to your reply.
DDS File Results:
DDS (Ver_09-02-01.01) - NTFSx86
Run by Dillon at 18:03:17.50 on Thu 02/26/2009
Internet Explorer: 8.0.6001.18372
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.253 [GMT -7:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
G:\dds.com
============== Pseudo HJT Report ===============
uSearch Bar = hxxp://www.yahoo.com/search/ie.html
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {430DDB4F-38CC-4E91-AF33-4157334EC937} - No File
TB: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [DriverMax]
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [OneTouch Monitor] c:\program files\visioneer onetouch\OneTouchMon.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\dillon\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OUTLOOK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\callwave.lnk - c:\program files\callwave\IAM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\MSOFFICE.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} - hxxp://usfulfillment.puretracks.com/onager.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235612405750
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-3 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-5-27 17376]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]
=============== Created Last 30 ================
2009-02-25 19:31 8,074 a------- c:\windows\extend.dat
2009-02-25 19:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Avg8
2009-02-25 18:47 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 <DIR> --d----- c:\program files\Trend Micro
2009-02-21 23:52 <DIR> --d----- c:\program files\Innovative Solutions
2009-02-21 23:15 <DIR> --d----- c:\program files\Eusing Free Registry Cleaner
2009-02-21 22:59 16,384 a------t c:\temp\Perflib_Perfdata_344.dat
2009-02-21 17:29 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-21 17:29 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-21 17:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:26 <DIR> --d----- c:\temp\WPDNSE
2009-02-21 16:59 <DIR> -cdsh--- c:\documents and settings\dillon\IECompatCache
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\PrivacIE
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\IETldCache
2009-02-21 16:50 <DIR> --d----- c:\windows\ie8updates
2009-02-21 16:45 <DIR> -cd-h--- c:\windows\ie8
2009-02-21 16:41 79,360 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-21 13:26 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-20 22:31 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-20 20:10 <DIR> --d----- c:\program files\Mozilla Firefox(2)
==================== Find3M ====================
2009-01-15 02:05 911,872 a------- c:\windows\system32\wininet.dll
2009-01-15 02:05 43,008 a------- c:\windows\system32\licmgr10.dll
2009-01-15 02:04 18,944 a------- c:\windows\system32\corpol.dll
2009-01-15 02:03 420,352 a------- c:\windows\system32\vbscript.dll
2009-01-15 02:03 72,704 a------- c:\windows\system32\admparse.dll
2009-01-15 02:03 71,680 a------- c:\windows\system32\iesetup.dll
2009-01-15 02:01 34,304 a------- c:\windows\system32\imgutil.dll
2009-01-15 02:00 48,128 a------- c:\windows\system32\mshtmler.dll
2009-01-15 02:00 45,568 a------- c:\windows\system32\mshta.exe
2009-01-15 01:50 156,160 a------- c:\windows\system32\msls31.dll
2009-01-05 21:39 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-01-02 11:38 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2007-09-11 21:33 5,471,581 ac------ c:\program files\acstudio.exe
2007-08-17 20:16 3,580 ac------ c:\program files\INSTALL.LOG
2003-08-29 13:12 61,440 ac------ c:\windows\inf\i386\Viz7300.dll
2003-08-29 13:12 17,376 ac------ c:\windows\inf\i386\Gt680x.sys
2001-09-28 17:00 164,864 a------- c:\program files\UNWISE.EXE
============= FINISH: 18:03:59.29 ===============
Attach File Results:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-02-01.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/22/2005 9:29:24 PM
System Uptime: 2/26/2009 6:00:18 PM (0 hours ago)
Motherboard: | | K7VT4APro
Processor: AMD Athlon(tm) XP 2200+ | Socket-A | 1798/133mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 8.266 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 97.644 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is FIXED (FAT32) - 4 GiB total, 0.76 GiB free.
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP1: 2/21/2009 9:23:54 PM - System Checkpoint
RP2: 2/21/2009 9:55:07 PM - Software Distribution Service 3.0
RP3: 2/25/2009 6:59:49 PM - Software Distribution Service 3.0
RP4: 2/25/2009 7:20:33 PM - Removed AVG Free 8.0
RP5: 2/25/2009 7:28:31 PM - Removed AVG Free 8.0
RP6: 2/25/2009 7:29:36 PM - Installed AVG Free 8.0
==== Installed Programs ======================
Acoustica Effects Pack
Adobe Flash Player 10 ActiveX
Adobe Reader 6.0.1
Before You Know It 3.6 Lite
Berlitz
C-Media WDM Audio Driver
CallWave
DriverMax 4
Eusing Free Registry Cleaner
Free DVD Decrypter version 1.2
GrammarPro
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Intel(R) 536EP Modem
InterActual Player
IrfanView (remove only)
LanguageNow!
LimeWire 4.16.6
Linksys Wireless-G PCI Network Adapter with SpeedBooster
MAGIX music maker 11 demo (US)
Malwarebytes' Anti-Malware
MaxSplitter v1.53 Free Edition
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 97, Professional Edition
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML4 Parser
Musicmatch® Jukebox
MySpaceIM
Nero Suite
NVIDIA Drivers
PaperPort 8.0 SE
PowerDVD
Quicken 2007
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960715)
Simple File Shredder 2.4
Starcraft
Text-To-Speech-Runtime
Text Thru Time Screensaver
TrustWatch Toolbar
Uninstall 1.0.0.0
Update for Windows Internet Explorer 8 (KB961813)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB958752)
Update for Windows XP (KB967715)
URGE
VC 9.0 Runtime
Visioneer OneTouch 7300
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Warcraft III: All Products
WD Diagnostics
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8 Release Candidate 1
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
World of Warcraft
Yahoo! Music Jukebox
==== Event Viewer Messages From Past Week ========
2/21/2009 2:21:30 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/21/2009 2:19:52 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 AvgLdx86 AvgMfx86 eeCtrl Fips pavboot SYMTDI
2/19/2009 8:50:04 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.101. The machine with the IP address 192.168.1.102 did not allow the name to be claimed by this machine.
2/21/2009 5:05:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
2/21/2009 9:04:35 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
2/21/2009 9:24:02 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
2/22/2009 12:08:09 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
2/25/2009 7:18:08 PM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
2/26/2009 6:01:16 PM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 0012179DD8F8 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
2/26/2009 6:02:25 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.102. The machine with the IP address 192.168.1.101 did not allow the name to be claimed by this machine.
==== End Of File ===========================
Hi again,
IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.
Limewire
I'd like you to read this thread (http://forums.spybot.info/showthread.php?t=282).
Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).
Delete these folders afterwards:
C:\Program Files\LimeWire
Empty Recycle Bin.
After that:
Please visit this webpage for download links, and instructions for running ComboFix tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New dds.txt log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
BlackBike
2009-03-01, 02:49
Thanks For Continuing To Help,
Here is what I've done:
Attempted to delete Limewire, but it was not present in Control Panel nor in the C:\Program Files.
Ran ComboFix once, only to discover that I had to have an internet connection to install the Recovery Console. I saved the reports.
Downloaded the Windows XP Home Edition with Service Pack 2 Utility and moved that icon over the ComboFix icon, as directed. ComboFix started on its own. I saved the reports after it was finished.
I wasn't sure if you wanted me to run DDS again, so I did. I noticed that Limeware was still showing as being on the computer.
After searching a bit, I found a site (http://www.spywaredb.com/remove-limewire/) that showed me how to find the two entries in my Registry where LimeWare was located. I deleted both of those entries, and rebooted the computer.
I ran ComboFix for the third time, and saved those reports. I have included both of them below.
I wanted to make sure that LimeWare was gone, so I ran DDS again. There is no mention of LimeWire anymore.
I have saved all the reports from each time I ran a program. So, if you need me to send something else, I can. However, I think you just wanted the results of ComboFix after it completed without any LimeWire. That is what is below. Thanks again for your help. I look forward to your reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ComboFix 09-02-28.01 - Dillon 2009-02-28 18:20:17.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.285 [GMT -7:00]
Running from: c:\documents and settings\Dillon\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-02-01 to 2009-03-01 )))))))))))))))))))))))))))))))
.
2009-02-25 19:31 . 2009-02-25 19:31 8,074 --a------ c:\windows\extend.dat
2009-02-25 19:29 . 2009-02-25 19:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Avg8
2009-02-25 18:47 . 2009-01-09 12:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 . 2009-02-21 23:58 <DIR> d-------- c:\program files\Trend Micro
2009-02-21 23:52 . 2009-02-21 23:52 <DIR> d-------- c:\program files\Innovative Solutions
2009-02-21 23:15 . 2009-02-21 23:15 <DIR> d-------- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:30 . 2009-02-21 17:30 <DIR> d----c--- c:\documents and settings\Mike\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-21 17:30 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:29 . 2009-02-21 17:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-21 17:28 . 2009-02-21 17:28 <DIR> d--hsc--- c:\documents and settings\Mike\PrivacIE
2009-02-21 17:27 . 2009-02-21 17:27 <DIR> d--hsc--- c:\documents and settings\Mike\IETldCache
2009-02-21 17:26 . 2009-02-21 17:26 <DIR> d-------- c:\temp\WPDNSE
2009-02-21 16:59 . 2009-02-21 16:59 <DIR> d--hsc--- c:\documents and settings\Dillon\IECompatCache
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\PrivacIE
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\IETldCache
2009-02-21 16:50 . 2009-02-21 16:50 <DIR> d-------- c:\windows\ie8updates
2009-02-21 16:45 . 2009-02-21 16:46 <DIR> d--h-c--- c:\windows\ie8
2009-02-21 16:41 . 2009-01-10 22:00 79,360 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 03:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 . 2008-07-06 05:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-20 22:31 . 2009-02-21 13:29 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\MSBuild
2009-02-20 21:25 . 2009-02-25 19:53 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-02-20 20:10 . 2009-02-20 20:50 <DIR> d-------- c:\program files\Mozilla Firefox(2)
2009-02-20 20:10 . 2009-02-20 20:10 0 --a------ c:\windows\nsreg.dat
2009-02-18 18:07 . 2009-02-18 18:07 <DIR> d----c--- c:\documents and settings\Guest\Application Data\MySpace
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 01:18 --------- d-----w c:\program files\CallWave
2009-02-26 03:01 --------- d-----w c:\program files\Panda Security
2009-02-26 03:00 --------- d-----w c:\program files\Yahoo!
2009-02-26 02:59 --------- d---a-w c:\program files\YPOPs
2009-02-26 02:53 --------- d-----w c:\program files\Lavasoft
2009-02-26 02:34 --------- dc----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-26 02:34 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-21 03:53 --------- d-----w c:\program files\Linksys Wireless-G PCI Network Adapter with SpeedBooster
2009-02-21 03:50 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-21 03:56 --------- d-----w c:\program files\World of Warcraft
2009-01-15 09:05 911,872 ----a-w c:\windows\system32\wininet.dll
2009-01-15 09:05 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-01-15 09:04 18,944 ----a-w c:\windows\system32\corpol.dll
2009-01-15 09:03 72,704 ----a-w c:\windows\system32\admparse.dll
2009-01-15 09:03 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-01-15 09:03 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-01-15 09:01 34,304 ----a-w c:\windows\system32\imgutil.dll
2009-01-15 09:00 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-01-15 09:00 45,568 ----a-w c:\windows\system32\mshta.exe
2009-01-15 08:50 156,160 ----a-w c:\windows\system32\msls31.dll
2009-01-06 05:02 --------- d-----w c:\program files\Zone Labs
2009-01-06 00:06 --------- d-----w c:\program files\Java Downloads
2009-01-05 04:35 --------- d-----w c:\program files\MaxSplitter
2009-01-04 17:56 --------- dc----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-04 02:48 --------- dc----w c:\documents and settings\All Users\Application Data\MailFrontier
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\Yahoo!
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\MailFrontier
2009-01-03 22:33 --------- d-----w c:\program files\Symantec
2009-01-03 22:33 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-03 22:20 --------- dc----w c:\documents and settings\All Users\Application Data\Symantec
2007-09-12 04:33 5,471,581 -c--a-w c:\program files\acstudio.exe
2003-08-29 20:12 61,440 -c--a-w c:\windows\inf\i386\Viz7300.dll
2003-08-29 20:12 17,376 -c--a-w c:\windows\inf\i386\Gt680x.sys
2001-09-29 00:00 164,864 ----a-w c:\program files\UNWISE.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-09-23 45108]
"OneTouch Monitor"="c:\program files\Visioneer OneTouch\OneTouchMon.exe" [2003-11-20 106496]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-09-23 36864]
"SoundMan"="SOUNDMAN.EXE" [2003-04-21 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]
c:\documents and settings\Dillon\Start Menu\Programs\Startup\
Microsoft Outlook.lnk - c:\program files\Microsoft Office\Office\OUTLOOK.EXE [1997-07-11 25872]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
CallWave.lnk - c:\program files\CallWave\IAM.exe [2005-09-24 1590352]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-07-11 111376]
Microsoft Office Shortcut Bar.lnk - c:\program files\Microsoft Office\Office\MSOFFICE.EXE [1997-07-11 333824]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-07-11 51984]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 54512]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CallWave\\IAM.exe"=
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-05-27 17376]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - GTNDIS5
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\PortableRoboForm.exe
\Shell\RoboForm2Go\command - G:\PortableRoboForm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d446baa-945a-11da-bf4c-000b6aef846f}]
\Shell\AutoRun\command - setupSNK.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-02-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
.
.
------- Supplementary Scan -------
.
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 18:22:11
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-02-28 18:24:26
ComboFix-quarantined-files.txt 2009-03-01 01:24:05
ComboFix2.txt 2009-03-01 00:54:30
ComboFix3.txt 2009-03-01 00:34:18
Pre-Run: 9,180,823,552 bytes free
Post-Run: 9,167,138,816 bytes free
156 --- E O F --- 2009-02-26 02:01:45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-02-01.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/22/2005 9:29:24 PM
System Uptime: 2/28/2009 6:17:23 PM (0 hours ago)
Motherboard: | | K7VT4APro
Processor: AMD Athlon(tm) XP 2200+ | Socket-A | 1798/133mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 8.548 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 97.657 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is FIXED (FAT32) - 4 GiB total, 1.093 GiB free.
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP1: 2/21/2009 9:23:54 PM - System Checkpoint
RP2: 2/21/2009 9:55:07 PM - Software Distribution Service 3.0
RP3: 2/25/2009 6:59:49 PM - Software Distribution Service 3.0
RP4: 2/25/2009 7:20:33 PM - Removed AVG Free 8.0
RP5: 2/25/2009 7:28:31 PM - Removed AVG Free 8.0
RP6: 2/25/2009 7:29:36 PM - Installed AVG Free 8.0
RP7: 2/26/2009 10:40:25 PM - System Checkpoint
RP8: 2/28/2009 5:29:05 PM - ComboFix created restore point
RP9: 2/28/2009 5:50:42 PM - ComboFix created restore point
==== Installed Programs ======================
Acoustica Effects Pack
Adobe Flash Player 10 ActiveX
Adobe Reader 6.0.1
Before You Know It 3.6 Lite
Berlitz
C-Media WDM Audio Driver
CallWave
DriverMax 4
Eusing Free Registry Cleaner
Free DVD Decrypter version 1.2
GrammarPro
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Intel(R) 536EP Modem
InterActual Player
IrfanView (remove only)
LanguageNow!
Linksys Wireless-G PCI Network Adapter with SpeedBooster
MAGIX music maker 11 demo (US)
Malwarebytes' Anti-Malware
MaxSplitter v1.53 Free Edition
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 97, Professional Edition
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML4 Parser
Musicmatch® Jukebox
MySpaceIM
Nero Suite
NVIDIA Drivers
PaperPort 8.0 SE
PowerDVD
Quicken 2007
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960715)
Simple File Shredder 2.4
Starcraft
Text-To-Speech-Runtime
Text Thru Time Screensaver
Uninstall 1.0.0.0
Update for Windows Internet Explorer 8 (KB961813)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB958752)
Update for Windows XP (KB967715)
URGE
VC 9.0 Runtime
Visioneer OneTouch 7300
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Warcraft III: All Products
WD Diagnostics
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8 Release Candidate 1
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
World of Warcraft
Yahoo! Music Jukebox
==== Event Viewer Messages From Past Week ========
2/26/2009 10:17:59 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.102. The machine with the IP address 192.168.1.101 did not allow the name to be claimed by this machine.
2/26/2009 6:01:16 PM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 0012179DD8F8 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
2/25/2009 7:18:38 PM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
2/25/2009 6:41:47 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/25/2009 6:41:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
2/25/2009 6:35:25 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 AvgLdx86 AvgMfx86 eeCtrl Fips pavboot SYMTDI
2/22/2009 12:09:01 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
2/21/2009 9:38:04 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.101. The machine with the IP address 192.168.1.102 did not allow the name to be claimed by this machine.
2/21/2009 9:24:02 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
2/21/2009 9:04:46 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
==== End Of File ===========================
Hi
Actually I wanted to see ComboFix log after first run :) So, could you post contents of ComboFix3.txt file (if not in c:\combofix folder then do a search from c: drive), please? Also, please post fresh DDS.txt file.
BlackBike
2009-03-01, 17:21
Sorry About That,
Here are the first ComboFix.txt file I obtained and the most recent DDS.txt file. Thanks!
ComboFix 09-02-28.01 - Dillon 2009-02-28 17:29:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.230 [GMT -7:00]
Running from: c:\documents and settings\Dillon\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\INSTALL.LOG
c:\program files\TrustWatch
c:\program files\TrustWatch\Cache\COMBOSEARCH.acs
c:\program files\TrustWatch\Cache\ErrorLog.txt
c:\program files\TrustWatch\Cache\feedback_v3.bmp
c:\program files\TrustWatch\Cache\highlight-off_v3.bmp
c:\program files\TrustWatch\Cache\highlight-on_v3.bmp
c:\program files\TrustWatch\Cache\hosts.cfg
c:\program files\TrustWatch\Cache\info-off-18_v3.bmp
c:\program files\TrustWatch\Cache\info-on-18_v3.bmp
c:\program files\TrustWatch\Cache\popup-off_v3.bmp
c:\program files\TrustWatch\Cache\popup-on_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-notverified_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-verified-ssl_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-verified_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-waiting_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-warning_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-working1_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-working2_v3.bmp
c:\program files\TrustWatch\Cache\reportfraud_v3.bmp
c:\program files\TrustWatch\Cache\trustwatchtb0401.cfg
c:\program files\TrustWatch\Cache\tw-logo_v3.bmp
c:\program files\TrustWatch\toolbar.ini
c:\program files\TrustWatch\uninst.ico
c:\program files\TrustWatch\uninstall.exe
G:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-02-01 to 2009-03-01 )))))))))))))))))))))))))))))))
.
2009-02-25 19:31 . 2009-02-25 19:31 8,074 --a------ c:\windows\extend.dat
2009-02-25 19:29 . 2009-02-25 19:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Avg8
2009-02-25 18:47 . 2009-01-09 12:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 . 2009-02-21 23:58 <DIR> d-------- c:\program files\Trend Micro
2009-02-21 23:52 . 2009-02-21 23:52 <DIR> d-------- c:\program files\Innovative Solutions
2009-02-21 23:15 . 2009-02-21 23:15 <DIR> d-------- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:30 . 2009-02-21 17:30 <DIR> d----c--- c:\documents and settings\Mike\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-21 17:30 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:29 . 2009-02-21 17:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-21 17:28 . 2009-02-21 17:28 <DIR> d--hsc--- c:\documents and settings\Mike\PrivacIE
2009-02-21 17:27 . 2009-02-21 17:27 <DIR> d--hsc--- c:\documents and settings\Mike\IETldCache
2009-02-21 17:26 . 2009-02-21 17:26 <DIR> d-------- c:\temp\WPDNSE
2009-02-21 16:59 . 2009-02-21 16:59 <DIR> d--hsc--- c:\documents and settings\Dillon\IECompatCache
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\PrivacIE
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\IETldCache
2009-02-21 16:50 . 2009-02-21 16:50 <DIR> d-------- c:\windows\ie8updates
2009-02-21 16:45 . 2009-02-21 16:46 <DIR> d--h-c--- c:\windows\ie8
2009-02-21 16:41 . 2009-01-10 22:00 79,360 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 03:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 . 2008-07-06 05:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-20 22:31 . 2009-02-21 13:29 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\MSBuild
2009-02-20 21:25 . 2009-02-25 19:53 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-02-20 20:10 . 2009-02-20 20:50 <DIR> d-------- c:\program files\Mozilla Firefox(2)
2009-02-20 20:10 . 2009-02-20 20:10 0 --a------ c:\windows\nsreg.dat
2009-02-18 18:07 . 2009-02-18 18:07 <DIR> d----c--- c:\documents and settings\Guest\Application Data\MySpace
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 00:10 --------- d-----w c:\program files\CallWave
2009-02-26 03:01 --------- d-----w c:\program files\Panda Security
2009-02-26 03:00 --------- d-----w c:\program files\Yahoo!
2009-02-26 02:59 --------- d---a-w c:\program files\YPOPs
2009-02-26 02:53 --------- d-----w c:\program files\Lavasoft
2009-02-26 02:34 --------- dc----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-26 02:34 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-21 03:53 --------- d-----w c:\program files\Linksys Wireless-G PCI Network Adapter with SpeedBooster
2009-02-21 03:50 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-21 03:56 --------- d-----w c:\program files\World of Warcraft
2009-01-15 09:05 911,872 ----a-w c:\windows\system32\wininet.dll
2009-01-15 09:05 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-01-15 09:04 18,944 ----a-w c:\windows\system32\corpol.dll
2009-01-15 09:03 72,704 ----a-w c:\windows\system32\admparse.dll
2009-01-15 09:03 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-01-15 09:03 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-01-15 09:01 34,304 ----a-w c:\windows\system32\imgutil.dll
2009-01-15 09:00 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-01-15 09:00 45,568 ----a-w c:\windows\system32\mshta.exe
2009-01-15 08:50 156,160 ----a-w c:\windows\system32\msls31.dll
2009-01-06 05:02 --------- d-----w c:\program files\Zone Labs
2009-01-06 00:06 --------- d-----w c:\program files\Java Downloads
2009-01-05 04:35 --------- d-----w c:\program files\MaxSplitter
2009-01-04 17:56 --------- dc----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-04 02:48 --------- dc----w c:\documents and settings\All Users\Application Data\MailFrontier
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\Yahoo!
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\MailFrontier
2009-01-03 22:33 --------- d-----w c:\program files\Symantec
2009-01-03 22:33 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-03 22:20 --------- dc----w c:\documents and settings\All Users\Application Data\Symantec
2007-09-12 04:33 5,471,581 -c--a-w c:\program files\acstudio.exe
2003-08-29 20:12 61,440 -c--a-w c:\windows\inf\i386\Viz7300.dll
2003-08-29 20:12 17,376 -c--a-w c:\windows\inf\i386\Gt680x.sys
2001-09-29 00:00 164,864 ----a-w c:\program files\UNWISE.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-09-23 45108]
"OneTouch Monitor"="c:\program files\Visioneer OneTouch\OneTouchMon.exe" [2003-11-20 106496]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-09-23 36864]
"SoundMan"="SOUNDMAN.EXE" [2003-04-21 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]
c:\documents and settings\Dillon\Start Menu\Programs\Startup\
Microsoft Outlook.lnk - c:\program files\Microsoft Office\Office\OUTLOOK.EXE [1997-07-11 25872]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
CallWave.lnk - c:\program files\CallWave\IAM.exe [2005-09-24 1590352]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-07-11 111376]
Microsoft Office Shortcut Bar.lnk - c:\program files\Microsoft Office\Office\MSOFFICE.EXE [1997-07-11 333824]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-07-11 51984]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 54512]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CallWave\\IAM.exe"=
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-05-27 17376]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\PortableRoboForm.exe
\Shell\RoboForm2Go\command - G:\PortableRoboForm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d446baa-945a-11da-bf4c-000b6aef846f}]
\Shell\AutoRun\command - setupSNK.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-02-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
.
- - - - ORPHANS REMOVED - - - -
Toolbar-Locked - (no file)
HKCU-Run-DriverMax - (no file)
.
------- Supplementary Scan -------
.
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 17:32:12
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-02-28 17:34:17
ComboFix-quarantined-files.txt 2009-03-01 00:33:52
Pre-Run: 9,054,937,088 bytes free
Post-Run: 9,196,048,384 bytes free
185 --- E O F --- 2009-02-26 02:01:45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
DDS (Ver_09-02-01.01) - NTFSx86
Run by Dillon at 18:26:38.60 on Sat 02/28/2009
Internet Explorer: 8.0.6001.18372
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.268 [GMT -7:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
G:\dds.com
============== Pseudo HJT Report ===============
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {430DDB4F-38CC-4E91-AF33-4157334EC937} - No File
TB: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [OneTouch Monitor] c:\program files\visioneer onetouch\OneTouchMon.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\dillon\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OUTLOOK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\callwave.lnk - c:\program files\callwave\IAM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\MSOFFICE.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} - hxxp://usfulfillment.puretracks.com/onager.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235612405750
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-3 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-5-27 17376]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]
=============== Created Last 30 ================
2009-02-28 17:28 161,792 a------- c:\windows\SWREG.exe
2009-02-28 17:28 98,816 a------- c:\windows\sed.exe
2009-02-25 19:31 8,074 a------- c:\windows\extend.dat
2009-02-25 19:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Avg8
2009-02-25 18:47 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 <DIR> --d----- c:\program files\Trend Micro
2009-02-21 23:52 <DIR> --d----- c:\program files\Innovative Solutions
2009-02-21 23:15 <DIR> --d----- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:29 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-21 17:29 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-21 17:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:26 <DIR> --d----- c:\temp\WPDNSE
2009-02-21 16:59 <DIR> -cdsh--- c:\documents and settings\dillon\IECompatCache
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\PrivacIE
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\IETldCache
2009-02-21 16:50 <DIR> --d----- c:\windows\ie8updates
2009-02-21 16:45 <DIR> -cd-h--- c:\windows\ie8
2009-02-21 16:41 79,360 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-21 13:26 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-20 22:31 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-20 20:10 <DIR> --d----- c:\program files\Mozilla Firefox(2)
==================== Find3M ====================
2009-01-15 02:05 911,872 a------- c:\windows\system32\wininet.dll
2009-01-15 02:05 43,008 a------- c:\windows\system32\licmgr10.dll
2009-01-15 02:04 18,944 a------- c:\windows\system32\corpol.dll
2009-01-15 02:03 420,352 a------- c:\windows\system32\vbscript.dll
2009-01-15 02:03 72,704 a------- c:\windows\system32\admparse.dll
2009-01-15 02:03 71,680 a------- c:\windows\system32\iesetup.dll
2009-01-15 02:01 34,304 a------- c:\windows\system32\imgutil.dll
2009-01-15 02:00 48,128 a------- c:\windows\system32\mshtmler.dll
2009-01-15 02:00 45,568 a------- c:\windows\system32\mshta.exe
2009-01-15 01:50 156,160 a------- c:\windows\system32\msls31.dll
2009-01-05 21:39 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-01-02 11:38 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2007-09-11 21:33 5,471,581 ac------ c:\program files\acstudio.exe
2003-08-29 13:12 61,440 ac------ c:\windows\inf\i386\Viz7300.dll
2003-08-29 13:12 17,376 ac------ c:\windows\inf\i386\Gt680x.sys
2001-09-28 17:00 164,864 a------- c:\program files\UNWISE.EXE
============= FINISH: 18:26:54.21 ===============
Hi again :)
Start hjt, do a system scan, check if found:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
Close browsers and fix checked.
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Kaspersky Online Scanner (http://www.kaspersky.com/kos/eng/partner/us/languages/english/check.html?n=1225554235248)
Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
Read the requirements and privacy statement then click on the Accept button.
The program will launch and start to download the latest definition files.
You will be prompted to install an application from Kaspersky. Click Run
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
Click on Save Report As....
Change the Files of type to Text file (.txt) before clicking on the Save button.
Save this report to a convenient place.
Copy and paste that information & a fresh hjt log into your topic.
The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.
If you need a tutorial, see here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif)
BlackBike
2009-03-02, 03:45
Well,
I ran HJT again, and deleted the Registry entries you identified. Then, I ran AFT and cleared the specified items. I was not able to rund the Kaspersky in regular full log on, because I am still unable to access the internet that way. So, I ran it Safe with Networking mode. There were not any problems found, so there wasn't any report to save. Finally, I ran HJT again, and I've posted the results below.
I am sure this is frustrating to you. I appreciate the time you are taking to narrow down the issues.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:55:01 PM, on 3/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: Microsoft Outlook.lnk = C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235612405750
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
--
End of file - 6089 bytes
Hi
Do the connection problems occur with both wired and wireless connection in normal mode?
BlackBike
2009-03-04, 02:39
Hi Again,
I just tried to access the internet with the Wireless capability disabled and the ethernet cable pluged in. Everything was just the same.
I should mention again that in the normal mode, the computer does connect somewhat to the internet. I have a program called "CallWave" and once the connection is complete (both wireless and wired) the program opens and works. (CallWave is an online telephone answering service) Furthermore, at least once since this problem started I have recieved Microsoft updates via the automatic download. Finally, the internet access through a browser was working until one day it just didn't. Since this isn't my computer, I don't know what the kids did just before the problem happened, and they can't seem to remember.
It may not help, but I ran a connection diagnostic while the Firewall was disabled, the Wireless was disabled, and only the ethernet connection was working. Here is that report:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Last diagnostic run time: 03/03/09 17:55:35
HTTP, HTTPS, FTP Diagnostic
HTTP, HTTPS, FTP connectivity
warn FTP (Passive): Error 12029 connecting to ftp.microsoft.com: A connection with the server could not be established
warn FTP (Active): Error 12029 connecting to ftp.microsoft.com: A connection with the server could not be established
warn HTTP: Error 12029 connecting to www.microsoft.com: A connection with the server could not be established
warn HTTPS: Error 12029 connecting to www.microsoft.com: A connection with the server could not be established
warn HTTPS: Error 12029 connecting to www.passport.net: A connection with the server could not be established
warn HTTP: Error 12029 connecting to www.hotmail.com: A connection with the server could not be established
error Could not make an HTTP connection.
error Could not make an HTTPS connection.
error Could not make an FTP connection.
info Redirecting user to support call
DNS Client Diagnostic
DNS - Not a home user scenario
info Using Web Proxy: no
info Resolving name ok for (www.microsoft.com): yes
No DNS servers
DNS failure
Gateway Diagnostic
Gateway
info The following proxy configuration is being used by IE: Automatically Detect Settings:Disabled Automatic Configuration Script: Proxy Server: Proxy Bypass list:
info This computer has the following default gateway entry(ies): 192.168.1.1
info This computer has the following IP address(es): 192.168.1.104
info The default gateway is in the same subnet as this computer
info The default gateway entry is a valid unicast address
info The default gateway address was resolved via ARP in 1 try(ies)
info The default gateway was reached via ICMP Ping in 1 try(ies)
info TCP port 80 on host 207.46.19.190 was successfully reached
info The Internet host www.microsoft.com was successfully reached
info The default gateway is OK
IP Layer Diagnostic
Corrupted IP routing table
info The default route is valid
info The loopback route is valid
info The local host route is valid
info The local subnet route is valid
Invalid ARP cache entries
action The ARP cache has been flushed
IP Configuration Diagnostic
Invalid IP address
info Valid IP address detected: 192.168.1.104
Wireless Diagnostic
Wireless - Service disabled
Wireless - User SSID
Wireless - First time setup
Wireless - Radio off
Wireless - Out of range
Wireless - Hardware issue
Wireless - Novice user
Wireless - Ad-hoc network
Wireless - Less preferred
Wireless - 802.1x enabled
Wireless - Configuration mismatch
Wireless - Low SNR
WinSock Diagnostic
WinSock status
info All base service provider entries are present in the Winsock catalog.
info The Winsock Service provider chains are valid.
info Provider entry MSAFD Tcpip [TCP/IP] passed the loopback communication test.
info Provider entry MSAFD Tcpip [UDP/IP] passed the loopback communication test.
info Provider entry RSVP UDP Service Provider passed the loopback communication test.
info Provider entry RSVP TCP Service Provider passed the loopback communication test.
info Connectivity is valid for all Winsock service providers.
Network Adapter Diagnostic
Network location detection
info Using home Internet connection
Network adapter identification
info Network connection: Name=Local Area Connection, Device=VIA Compatable Fast Ethernet Adapter, MediaType=LAN, SubMediaType=LAN
info Network connection: Name=Wireless Network Connection, Device=Linksys Wireless-G PCI Network Adapter with SpeedBooster, MediaType=LAN, SubMediaType=WIRELESS
info Both Ethernet and Wireless connections available, prompting user for selection
action User input required: Select network connection
info Ethernet connection selected
Network adapter status
info Network connection status: Connected
HTTP, HTTPS, FTP Diagnostic
HTTP, HTTPS, FTP connectivity
warn FTP (Passive): Error 12029 connecting to ftp.microsoft.com: A connection with the server could not be established
warn HTTP: Error 12029 connecting to www.microsoft.com: A connection with the server could not be established
warn HTTPS: Error 12029 connecting to www.microsoft.com: A connection with the server could not be established
warn FTP (Active): Error 12029 connecting to ftp.microsoft.com: A connection with the server could not be established
warn HTTPS: Error 12029 connecting to www.passport.net: A connection with the server could not be established
warn HTTP: Error 12029 connecting to www.hotmail.com: A connection with the server could not be established
error Could not make an HTTP connection.
error Could not make an HTTPS connection.
error Could not make an FTP connection.
Hi
Please download and run Winsock xp fix (http://www.snapfiles.com/get/winsockxpfix.html). Tell me if that helped.
BlackBike
2009-03-06, 03:27
First Of All,
I want to thank you again for your help. Of course, with that type of beginning, you may be able to guess what I'm about to write next; The Winsock application didn't appear to work. I still am unable to access the internet through browsers while in Normal mode.
Is there something else I can try?
Hi
Let's see if this finds anything.
Download GMER (http://www.gmer.net/gmer.zip) and save it your desktop:
Extract it to your desktop and double-click GMER.exe
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log & a fresh dds.txt contents in your reply.
BlackBike
2009-03-07, 22:15
Thanks,
I have attached the results of the GMER, as well as the the DDS.txt file I ran afterwards. I look forward to your reply.
GMER 1.0.15.14833 - http://www.gmer.net
Rootkit scan 2009-03-07 13:14:22
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT 82E10310 ZwConnectPort
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
DDS (Ver_09-02-01.01) - NTFSx86
Run by Dillon at 13:15:39.50 on Sat 03/07/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.144 [GMT -7:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
G:\dds.com
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {430DDB4F-38CC-4E91-AF33-4157334EC937} - No File
TB: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [OneTouch Monitor] c:\program files\visioneer onetouch\OneTouchMon.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\dillon\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OUTLOOK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\callwave.lnk - c:\program files\callwave\IAM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\MSOFFICE.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} - hxxp://usfulfillment.puretracks.com/onager.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235612405750
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-3 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-5-27 17376]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]
=============== Created Last 30 ================
2009-03-07 08:57 16,384 a------t c:\temp\Perflib_Perfdata_55c.dat
2009-03-05 18:07 16,384 a------t c:\temp\Perflib_Perfdata_7ec.dat
2009-03-03 17:48 14,592 ac------ c:\windows\system32\dllcache\kbdhid.sys
2009-03-03 17:48 14,592 a------- c:\windows\system32\drivers\kbdhid.sys
2009-03-03 17:48 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-03-03 17:48 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-03-03 17:48 10,368 ac------ c:\windows\system32\dllcache\hidusb.sys
2009-03-03 17:48 10,368 a------- c:\windows\system32\drivers\hidusb.sys
2009-03-01 13:43 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-01 13:43 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-01 13:23 35,262 a------- c:\windows\Administrator.acl
2009-02-28 17:28 161,792 a------- c:\windows\SWREG.exe
2009-02-28 17:28 98,816 a------- c:\windows\sed.exe
2009-02-25 19:31 8,074 a------- c:\windows\extend.dat
2009-02-25 19:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Avg8
2009-02-25 18:47 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 <DIR> --d----- c:\program files\Trend Micro
2009-02-21 23:52 <DIR> --d----- c:\program files\Innovative Solutions
2009-02-21 23:15 <DIR> --d----- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:29 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-21 17:29 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-21 17:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:26 <DIR> --d----- c:\temp\WPDNSE
2009-02-21 16:59 <DIR> -cdsh--- c:\documents and settings\dillon\IECompatCache
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\PrivacIE
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\IETldCache
2009-02-21 16:50 <DIR> --d----- c:\windows\ie8updates
2009-02-21 16:45 81,920 a------- c:\windows\system32\ieencode.dll
2009-02-21 13:26 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-21 13:26 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-20 22:31 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-20 20:10 <DIR> --d----- c:\program files\Mozilla Firefox(2)
==================== Find3M ====================
2009-01-05 21:39 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-01-02 11:38 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-12-20 16:15 826,368 a------- c:\windows\system32\wininet.dll
2007-09-11 21:33 5,471,581 ac------ c:\program files\acstudio.exe
2003-08-29 13:12 61,440 ac------ c:\windows\inf\i386\Viz7300.dll
2003-08-29 13:12 17,376 ac------ c:\windows\inf\i386\Gt680x.sys
2001-09-28 17:00 164,864 a------- c:\program files\UNWISE.EXE
============= FINISH: 13:15:56.60 ===============
Hi
Nothing out of ordinary there. Your log shows signs of ZoneAlarm. Did you have it installed when this connection problem began to occur? Please see topic here (http://www.digitalspy.co.uk/forums/showthread.php?t=839128&highlight=zone+alarm).
BlackBike
2009-03-09, 00:51
Wow,
I thought I had deleted all parts of Zone Alarm months ago. Yes, I did have Zone Alarm Security Suite installed on my son's computer. However, several months ago it would not update on his computer. I spent several days trying to figure out why, but finally gave up and used AVG Free instead. I remember that it was kinda difficult to completely uninstall Zone Alarm, and thought that I had removed all parts of it. Obviously, from the info in the link you sent me, I had not.
All of this was done months before this problem of internt access occured. In fact, I think this current problem is tied more to a recent Windows security update. Before I started trying to fix this problem, I could go back to a previous system setting (using Restore) and the system would access the internet just fine (without the Windows update). But, because I read about how important that update was, I tried several ways to keep the update AND keep intenet access. Unfortunately, one of the first ways I tried wiped out my earlier system Restore points, so I can't go back to a time before the Windows system update.
Anyway, I think I have removed all parts of Zone Alarm now. I know you didn't request it, but I also re-ran the GMER and DDS applications again and posted the resulting log files. Hopefully, all traces of Zone Alarm are gone now. Still no internet access in the Normal mode, but in the Safe mode I can access the internet though a browser.
GMER 1.0.15.14833 - http://www.gmer.net
Rootkit scan 2009-03-08 16:31:35
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT 82C97180 ZwConnectPort
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
DDS (Ver_09-02-01.01) - NTFSx86
Run by Dillon at 16:32:47.90 on Sun 03/08/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.203 [GMT -7:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\wscntfy.exe
G:\dds.com
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {430DDB4F-38CC-4E91-AF33-4157334EC937} - No File
TB: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [OneTouch Monitor] c:\program files\visioneer onetouch\OneTouchMon.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\dillon\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OUTLOOK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\callwave.lnk - c:\program files\callwave\IAM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\MSOFFICE.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} - hxxp://usfulfillment.puretracks.com/onager.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235612405750
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
============= SERVICES / DRIVERS ===============
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-3 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-5-27 17376]
=============== Created Last 30 ================
2009-03-08 13:11 16,384 a------t c:\temp\Perflib_Perfdata_558.dat
2009-03-08 13:10 16,384 a------t c:\temp\Perflib_Perfdata_670.dat
2009-03-08 13:05 16,384 a------t c:\temp\Perflib_Perfdata_a40.dat
2009-03-07 15:15 86,016 a------- c:\windows\unvise32qt.exe
2009-03-07 15:15 54,156 a---h--- c:\windows\QTFont.qfn
2009-03-07 15:15 1,409 a------- c:\windows\QTFont.for
2009-03-07 15:15 <DIR> --d----- c:\windows\system32\QuickTime
2009-03-07 14:22 2,882,814 a------- c:\windows\eUninstall.exe
2009-03-07 13:47 <DIR> --d----- c:\program files\eKnowledge
2009-03-07 13:22 25 a------- c:\windows\testing123.dat
2009-03-05 18:07 16,384 a------t c:\temp\Perflib_Perfdata_7ec.dat
2009-03-03 17:48 14,592 ac------ c:\windows\system32\dllcache\kbdhid.sys
2009-03-03 17:48 14,592 a------- c:\windows\system32\drivers\kbdhid.sys
2009-03-03 17:48 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-03-03 17:48 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-03-03 17:48 10,368 ac------ c:\windows\system32\dllcache\hidusb.sys
2009-03-03 17:48 10,368 a------- c:\windows\system32\drivers\hidusb.sys
2009-03-01 13:43 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-01 13:43 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-01 13:23 35,262 a------- c:\windows\Administrator.acl
2009-02-28 17:28 161,792 a------- c:\windows\SWREG.exe
2009-02-28 17:28 98,816 a------- c:\windows\sed.exe
2009-02-25 19:31 8,074 a------- c:\windows\extend.dat
2009-02-25 19:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Avg8
2009-02-25 18:47 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 <DIR> --d----- c:\program files\Trend Micro
2009-02-21 23:52 <DIR> --d----- c:\program files\Innovative Solutions
2009-02-21 23:15 <DIR> --d----- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:29 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-21 17:29 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-21 17:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:26 <DIR> --d----- c:\temp\WPDNSE
2009-02-21 16:59 <DIR> -cdsh--- c:\documents and settings\dillon\IECompatCache
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\PrivacIE
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\IETldCache
2009-02-21 16:50 <DIR> --d----- c:\windows\ie8updates
2009-02-21 16:45 81,920 a------- c:\windows\system32\ieencode.dll
2009-02-21 13:26 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-21 13:26 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-20 22:31 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-20 20:10 <DIR> --d----- c:\program files\Mozilla Firefox(2)
==================== Find3M ====================
2009-01-02 11:38 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-12-20 16:15 826,368 a------- c:\windows\system32\wininet.dll
2007-09-11 21:33 5,471,581 ac------ c:\program files\acstudio.exe
2003-08-29 13:12 61,440 ac------ c:\windows\inf\i386\Viz7300.dll
2003-08-29 13:12 17,376 ac------ c:\windows\inf\i386\Gt680x.sys
2001-09-28 17:00 164,864 a------- c:\program files\UNWISE.EXE
============= FINISH: 16:33:04.14 ===============
Hi
If you remove Windows update KB951748 and reboot the system does that restore the connection?
BlackBike
2009-03-10, 01:43
Nope,
I saw two instances of the KB951748 (one had a _0 at the end, I think), and I deleted them both. I know they are gone because the little yellow shield is now showing saying that I have two updates to install. However, I shut down the computer without installing the updates.
The computer still does not access the internet. Are there some other updates I should uninstall?
Hi
Did you remove the update thru add/remove programs? I saw only one listed in your log:
Security Update for Windows XP (KB951748)
BlackBike
2009-03-10, 13:37
Hi,
I was not able to remove the update through add/remove programs. So, after some searching online, I learned about removing updates using thte spuninst.exe files in C:\Windows. I used C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe and another spuninst.exe command for another update that had KB951748 in it's file name.
If you want, I can let the computer reinstall the updates, and then just take out the update located at C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe.
I was not able to remove the update through add/remove programs.
Did you get an error there or why wasn't uninstall successful this way?
BlackBike
2009-03-11, 13:55
Hi,
The first time, the update was listed, but it also had the messages "Click here for support info" and "This update cannot be deleted."
However, we let the update be reinstalled and last night, I was able to remove it from the computer using the Add/Remove Programs. I still was not able to access the internet after it was gone.
I've been wondering; supposed I removed all the Windows updates that have been installed around the time of this problem? Since I can't access the internet now, I really don't need the updates, and perhaps I can get the computer back to a level where it could access the internet. That would give a system restore point, which could make it easier to figure out the problem (i.e., add one system update at a time to find out which one may be causing the problem). Do you think that is a good idea?
Hi
Yes, I think that's a good idea since malware doesn't seem to be the problem causer here :) Probably need to begin with uninstalling SP3 and IE7.
BlackBike
2009-03-16, 00:24
Hi,
First of all, I want to thank you again for your efforts. I have good and bad news. The good news is, I can access the internet through a browser after I removed IE security update KB961260. The bad news is that my internet access also requires that I not have any anti-virus protection installed. :sad:
I repeated this three times, so I am pretty sure I'm on to something. I tried with both the 2007 version of CA Security Suite and the current version of AVG Free (I tried twice using AVG Free). I tried having just the KB961260 update installed without anti-virus protection, and with anti-virus protection without the KB961260 update installed. It is only when I have them both uninstalled can I get the browser to connect to the internet.
Of course, that is a silly solution. Surfing the internet without all the MS Security updates AND no anti-virus protection is begging for trouble.
Unless there is some sort of new virus that does not allow the browser to access the internet while protection is in place, I now realize this is not the correct forum for this matter. So, if you aren't allowed to assist me anymore with this, I ask that you at least point me in some direction where I can get an answer to this problem.
Once again, I thank you for all of your time and efforts. I look forward to your next posting.
BlackBike
2009-03-16, 02:01
One More Comment,
I saw on one website that Avast! anti-virus had shown success for others. I downloaded and installed it. However, after I rebooted the computer, I lost Browser internet access again. Once I deleted Avast!, I was able to access the internet through my browser. Therefore, it seems that all anti-virus applications stop me from accessing the internet through my browser.
Maybe this IS some kind of malware afterall (a new kind?).
Hi
There's been Norton installed in the system at some point. Download & run Norton removal tool (http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039).
Then locate if present the following file & delete it:
C:\windows\ntbtlog.txt
Restart the computer
Just before the OS loading screen starts hit F8 as if going to safe mode.
From the advanced boot menu choose "enable boot logging" then hit enter.
Post the following file:
C:\windows\ntbtlog.txt
BlackBike
2009-03-19, 03:10
Thank You, Thank You, Thank You!
I was really close to giving up hope, but you found the problem; Norton! :spider: I think that is pretty crappy of them to leave behind stuff that attempts to force you to use their product. I doubt that I will ever buy or use anything from Norton again.
Once I ran the tool you pointed me to, I can now access the internet in normal mode through my browser. I was also able to install all the IE Security updates and AVG Free anti-virus. All seems to be in good working order. The only problem I had was I was unable to completely remove the C:\windows\ntbtlog.txt file. I deleted it, as you instructed, but when I rebooted it returned. When I rebooted and enabledboot logging, the computer just started up as normal. If there is something I missed, please let me know. I'm hoping that because it is a .txt file, it doesn't do any real harm.
I don't have much, but I would like to offer you $20 for your help. I know it is not even close to a fair payment for all of your experience and help, but it is about the best I can do right now.
Thanks again for all your help!
You're welcome :) Norton does leave sometimes stuff behind causing mysterious symptoms.
Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.
THESE STEPS ARE VERY IMPORTANT
Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /u in the runbox and click OK
Next we remove all used tools.
Please download OTMoveIt3 (http://download.bleepingcomputer.com/oldtimer/OTMoveIt3.exe) and save it to desktop.
Double-click OTMoveIt3.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet, please allow it to do so.
Delete dds.scr file and related logs if those still exist.
UPDATING WINDOWS AND INTERNET EXPLORER
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.
If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.
Make your Internet Explorer more secure
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok
Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system... problems etc.
Have a great day,
Blade :cool:
BlackBike
2009-03-22, 22:13
All Done!
Well, almost all. I chose not to install the hosts file program. Since this is my son's computer, I know he will not faithfully update and use the program (it is hard enough to get him to update spyware and anti-virus programs (smile)).
However, I did do everything else you directed, and everything seems to be working just great. I've asked him several times this past week, and he tells me that everything is running smoothly.
I thank you again for all of your help!
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)
Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.