Neon3001
2012-08-06, 06:48
Hi,
I am usually very careful about malware etc but I think I have something on the system. When it boots, it halts for 5 to 10 mins at the desktop wallpaper before loading the desktop, also every program takes a long time to load and the whole compute is generally running quite slow.
System Specs:
AMD Athlon dual core 3ghz 4G ram (Windows XP uses only 2)
Nvidia 9600 GT vid card with 2g vram, and 300gb hdd and 500gb
usb hdd. System is running Windows XP SP3. In the last 6 weeks
I have reformatted and rebuilt 3 times, once because of a malware
problem. The current problem started about 3 weeks ago. Today
the system got caught in a loop in task manager, loading Update.exe
and GSV.exe then unloading them and repeating until I rebooted.
Spybot and Antivirus (Zone Alarm free) find no issues, I see nothing in HiJackthis or Cleaner.
I have run ERUNT and backed up the registry.
I ran aswMBR full scan overnight and when I came back next day the screen
was black, the mouse was active so I was not able to get the aswMBR
logs. I have now done a quick scan (as suggested in "Before you post...")
aswMBR log is under the DDS log.
I'll now run Spybot n disable TeaTimer after updating, n will check in here every day until the problem is resolved.
Thankyou for this service, I'm sure everyone appreciates the help.
Here is the DDS log:
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.6.2
Run by Neon at 13:32:46 on 2012-08-06
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2265 [GMT 9.5:30]
.
AV: ZoneAlarm Antivirus *Enabled/Updated* {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\GIGABYTE\ET6\GUI.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Mozilla Firefox\firefox.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.zonealarm.com/?Source=Homepage&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b
mSearchAssistant = ${SEARCH_URL_IE7}
uURLSearchHooks: DeviceVM Url Search Hook: {0063bf63-bfff-4b8f-9d26-4267df7f17dd} - c:\windows\system32\dvmurl.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Zonealarm Helper Object: {2a841f7a-a014-4da5-b6d9-8b913dfb7a8c} - c:\program files\check point software technologies ltd\zonealarm\1.5.24.4\bh\zonealarm.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: ZoneAlarm Security Toolbar: {438fae3e-bdef-44d3-ab8b-0c7c8350df59} - c:\program files\check point software technologies ltd\zonealarm\1.5.24.4\zonealarmTlbr.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
mRun: [Start WingMan Profiler] c:\program files\logitech\gaming software\LWEMon.exe /noui
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [EasyTuneVI] c:\program files\gigabyte\et6\ETcall.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [GEST] m‘|\ü
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [ISW] c:\program files\checkpoint\zaforcefield\ForceField.exe /icon="hidden"
mRun: [ZoneAlarm] c:\program files\checkpoint\zonealarm\zatray.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
StartupFolder: c:\docume~1\neon\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1341765315843
TCP: DhcpNameServer = 10.1.1.1
TCP: Interfaces\{35FCFEF3-5FF7-4D61-B321-5017B008FD19} : DhcpNameServer = 10.1.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
LSA: Notification Packages = scecli scecli scecli
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\neon\application data\mozilla\firefox\profiles\055x4kf3.default\
FF - prefs.js: browser.search.selectedEngine - Search By ZoneAlarm
FF - prefs.js: browser.startup.homepage - hxxp://apod.nasa.gov/apod/astropix.html
FF - prefs.js: keyword.URL - hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b&q={searchTerms}
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm_i.hmpg - true
FF - user.js: extensions.zonealarm.hmpgUrl - hxxp://search.zonealarm.com/?Source=Homepage&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b
FF - user.js: extensions.zonealarm.dfltSrch - true
FF - user.js: extensions.zonealarm.srchPrvdr - Search By ZoneAlarm
FF - user.js: extensions.zonealarm.keyWordUrl - hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b&q={searchTerms}
FF - user.js: extensions.zonealarm_i.dnsErr - true
FF - user.js: extensions.zonealarm_i.newTab - true
FF - user.js: extensions.zonealarm.newTabUrl - hxxp://search.zonealarm.com/?Source=Newtab&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?Source=ToolBar&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan={dfltLng}&utid=ac138ca9000000000000001fd0286b8b&q=
FF - user.js: extensions.zonealarm.id - ac138ca9000000000000001fd0286b8b
FF - user.js: extensions.zonealarm.instlDay - 15533
FF - user.js: extensions.zonealarm.vrsn - 1.5.24.4
FF - user.js: extensions.zonealarm.vrsni - 1.5.24.4
FF - user.js: extensions.zonealarm_i.vrsnTs - 1.5.24.418:43:42
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1001
FF - user.js: extensions.zonealarm_i.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base
FF - user.js: extensions.zonealarm.instlRef - ZLN27867823447900-1001
FF - user.js: extensions.zonealarm.dfltLng - en
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.admin - false
.
============= SERVICES / DRIVERS ===============
.
R0 KL1;kl1;c:\windows\system32\drivers\kl1.sys [2012-7-12 133208]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2012-7-12 11352]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2012-7-12 485808]
R1 Vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2012-6-21 526640]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-5-1 27016]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-5-1 497280]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-7-9 1262400]
R2 vsmon;TrueVector Internet Monitor;c:\program files\checkpoint\zonealarm\vsmon.exe -service --> c:\program files\checkpoint\zonealarm\vsmon.exe -service [?]
R3 AODDriver;AODDriver;c:\program files\gigabyte\et6\i386\AODDriver.sys [2009-2-23 7168]
R3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2012-7-8 24944]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-7-27 116648]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-3 160944]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-7-27 116648]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-08-06 03:46:09 -------- d-----w- c:\documents and settings\neon\local settings\application data\PCHealth
2012-08-06 03:25:06 -------- d-----w- C:\3cd1c5311552eb3b9d14456440
2012-08-06 03:23:50 221184 ----a-w- c:\windows\system32\wmpns.dll
2012-08-06 02:47:14 -------- d-----w- c:\windows\system32\LogFiles
2012-08-05 11:16:11 -------- d-----w- C:\637570fee2d8f02a61c8d107
2012-08-05 01:24:41 -------- d-----w- c:\documents and settings\neon\application data\PriceGong
2012-08-05 01:24:26 -------- d-----w- c:\documents and settings\neon\application data\Check Point Software Technologies LTD
2012-08-04 19:03:45 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2012-08-04 19:03:18 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2012-08-04 19:02:55 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2012-08-04 19:01:53 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2012-08-04 18:49:32 536576 -c----w- c:\windows\system32\dllcache\msado15.dll
2012-08-04 18:48:50 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2012-08-04 18:41:44 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2012-08-04 18:37:23 852480 -c----w- c:\windows\system32\dllcache\vgx.dll
2012-08-04 18:36:57 718336 -c----w- c:\windows\system32\dllcache\ntdll.dll
2012-08-04 18:36:55 2148352 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2012-08-04 18:36:54 2192640 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2012-08-04 18:36:52 2026496 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2012-08-04 18:36:51 2069120 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2012-08-04 18:36:31 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2012-08-04 18:36:15 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2012-08-04 18:35:51 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2012-08-04 18:35:51 3072 ------w- c:\windows\system32\iacenc.dll
2012-08-04 18:31:29 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2012-08-04 18:31:17 590848 -c----w- c:\windows\system32\dllcache\rpcrt4.dll
2012-08-04 18:31:17 5120 ------w- c:\windows\system32\xpsp4res.dll
2012-08-04 18:30:39 -------- d-----w- c:\windows\system32\PreInstall
2012-08-04 18:30:36 -------- d--h--w- c:\windows\$hf_mig$
2012-07-28 01:29:44 -------- d-----w- c:\program files\FS Water Configurator
2012-07-27 12:24:49 -------- d-----w- c:\documents and settings\neon\local settings\application data\Google
2012-07-27 12:23:34 -------- d-----w- c:\documents and settings\neon\local settings\application data\IsolatedStorage
2012-07-27 12:20:45 -------- d-----w- C:\TA Software
2012-07-27 03:18:42 -------- d-----w- C:\Your Folder FS2004
2012-07-25 01:22:03 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-07-25 01:22:03 214256 ----a-w- c:\windows\system32\muweb.dll
2012-07-25 01:22:03 17136 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-07-24 03:08:03 -------- d-----w- c:\documents and settings\neon\local settings\application data\Adobe
2012-07-23 17:26:25 -------- d-----w- c:\documents and settings\neon\.swt
2012-07-22 03:06:24 -------- d-----w- c:\documents and settings\neon\local settings\application data\Real_Environment_Simulati
2012-07-22 02:58:13 -------- d-----w- c:\program files\Real Environment Xtreme 2.0
2012-07-21 12:08:12 -------- d-----r- c:\program files\Skype
2012-07-20 03:10:55 -------- d-----w- c:\documents and settings\neon\local settings\application data\VAFinancials
2012-07-17 17:45:27 -------- d-----w- c:\documents and settings\neon\local settings\application data\Black_Tree_Gaming
2012-07-17 17:45:20 -------- d-----w- c:\program files\Nexus Mod Manager
2012-07-14 18:13:20 -------- d-----w- c:\documents and settings\neon\local settings\application data\Ilivid Player
2012-07-12 09:14:41 -------- d-----w- c:\windows\Internet Logs
2012-07-12 09:14:19 133208 ----a-w- c:\windows\system32\drivers\kl1.sys
2012-07-12 09:14:19 11352 ----a-w- c:\windows\system32\drivers\kl2.sys
2012-07-12 09:13:41 -------- d-----w- c:\program files\Check Point Software Technologies LTD
2012-07-11 22:35:21 -------- d-----w- c:\documents and settings\all users\application data\CheckPoint
2012-07-11 09:03:50 188866 ----a-w- c:\documents and settings\all users\application data\1341997380.bdinstall.bin
2012-07-09 15:40:04 78336 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\rxpGnsDriver.dll
2012-07-09 15:38:17 -------- d-----w- C:\RealityXP
2012-07-09 14:24:03 61 --sh--w- c:\windows\cnerolf.bin
2012-07-09 14:15:33 34064 ----a-w- c:\windows\system32\lhacm.acm
2012-07-09 14:15:29 -------- d-----w- c:\program files\Teamspeak2_RC2
2012-07-09 14:14:51 -------- d--h--w- c:\program files\InstallJammer Registry
2012-07-09 14:14:46 -------- d-----w- c:\program files\VAFS5
2012-07-09 14:14:30 -------- d-----w- c:\program files\Pilot Assistant
2012-07-09 14:14:09 -------- d-----w- c:\program files\Open Clouds
2012-07-09 14:12:22 414744 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\FSUIPC4.DLL
2012-07-09 14:04:21 599552 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\A2A_Feel.dll
2012-07-09 14:04:21 135168 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\AccuFeelMenu.dll
2012-07-09 14:04:20 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\feel\UNWISE.EXE
2012-07-09 14:00:57 -------- d-----w- c:\windows\Flight1 Citation Mustang
2012-07-09 13:59:07 -------- d-----w- c:\program files\IconA5
2012-07-09 13:50:55 -------- d-----w- c:\program files\Wings of POWER II WWII FIGHTERS
2012-07-09 13:46:16 45568 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\spitfire\tools\Spitfire Input Configurator.exe
2012-07-09 13:46:04 697344 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wop3_spitfire\panel\A2A_Spit.dll
2012-07-09 13:46:02 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\spitfire\UNWISE.EXE
2012-07-09 13:42:53 217088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\a2a_piperj3\panel\A2A_PiperJ3s.dll
2012-07-09 13:42:53 139264 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\a2a_piperj3\panel\A2A_PiperSound.dll
2012-07-09 13:42:52 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\piperj3\UNWISE.EXE
2012-07-09 13:41:08 41472 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\b377\tools\B377 Input Configurator.exe
2012-07-09 13:40:46 617984 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wos_b377\panel\b377sv2.dll
2012-07-09 13:36:28 204800 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wos_b377\panel\B377s.dll
2012-07-09 13:36:27 153088 ----a-w- c:\windows\UNWISE.EXE
2012-07-09 13:35:10 57344 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\shared\A2A_Service.dll
2012-07-09 13:35:10 47104 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\b17\tools\B-17 Input Configurator.exe
2012-07-09 13:35:10 144384 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\shared\A2AserviceInstaller.exe
2012-07-09 13:34:54 397312 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wop2_b17g\panel\A2A_B17Sound.dll
2012-07-09 13:34:54 303616 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wop2_b17g\panel\WoP3_B17s.dll
2012-07-09 13:34:46 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\b17\UNWISE.EXE
2012-07-09 13:34:23 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\UNWISE.EXE
2012-07-09 13:34:22 -------- d-----w- c:\program files\Wings of POWER II
2012-07-09 13:27:40 82590 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\Uninstal Carenado C208B Super Cargomaster Expansion Pack HD.exe
2012-07-09 13:26:38 54311 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uninstall_C90B.exe
2012-07-09 13:19:58 53555 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uninstallC337.exe
2012-07-09 13:18:40 54272 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uninstallT210M.exe
2012-07-09 13:11:55 580608 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uk2000 scenery\uk2000 vfr scenery volume3\uninstall.exe
2012-07-09 13:10:21 286720 ----a-w- c:\windows\iun506.exe
2012-07-09 12:45:08 47616 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\orbx\scripts\ftxcentral\work\FTXConfigurator.exe
2012-07-09 12:43:18 83373 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\addon scenery\scenery\Uninstal.exe
2012-07-09 11:18:01 77139 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\Uninstal.exe
2012-07-09 11:10:53 1212928 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\gauges\rxpGNS.dll
2012-07-09 11:10:52 929792 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\gauges\rxpDrop.dll
2012-07-09 11:10:50 -------- d-----w- c:\program files\Reality XP
2012-07-09 11:10:35 -------- d-----w- c:\documents and settings\all users\application data\Reality XP
2012-07-09 11:09:17 -------- d-----w- c:\program files\Garmin
2012-07-09 11:08:28 32768 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2012-07-09 11:08:28 225280 ----a-w- c:\program files\common files\installshield\iscript\IScript.dll
2012-07-09 11:08:28 176128 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2012-07-09 11:08:27 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2012-07-09 11:08:27 212992 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ILog.dll
2012-07-09 06:26:27 -------- d-----w- c:\program files\MSXML 4.0
2012-07-09 05:46:01 -------- d-----w- c:\program files\Microsoft Games
.
==================== Find3M ====================
.
2012-08-06 03:42:09 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-08-06 03:41:51 17488 ----a-w- c:\windows\gdrv.sys
2012-07-15 13:25:04 1074676 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-07-15 13:25:04 1074676 ----a-w- c:\windows\system32\nvdrsdb0.bin
2012-07-15 13:25:04 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-07-08 21:05:57 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2012-07-08 21:05:57 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2012-07-08 18:21:11 93640 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-07-08 18:21:10 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-07-08 18:21:09 811968 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-07-08 18:21:09 737208 ----a-w- c:\windows\system32\deployJava1.dll
2012-07-08 17:45:52 693268 ----a-w- c:\documents and settings\all users\application data\1341767658.bdinstall.bin
2012-07-08 15:22:58 315392 ----a-w- c:\windows\HideWin.exe
2012-07-08 14:52:25 81920 ----a-w- c:\windows\DUMP2f6c.tmp
2012-06-05 15:50:25 1372672 ------w- c:\windows\system32\msxml6.dll
2012-06-05 15:50:25 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-02 05:49:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 05:49:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 05:49:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 05:49:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 05:49:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-15 10:18:00 883008 ----a-w- c:\windows\system32\nvgenco32.dll
2012-05-15 10:18:00 65536 ----a-w- c:\windows\system32\OpenCL.dll
2012-05-15 10:18:00 6012928 ----a-w- c:\windows\system32\nvcuda.dll
2012-05-15 10:18:00 4373248 ----a-w- c:\windows\system32\nv4_disp.dll
2012-05-15 10:18:00 2530624 ----a-w- c:\windows\system32\nvcuvid.dll
2012-05-15 10:18:00 2445120 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-05-15 10:18:00 2359808 ----a-w- c:\windows\system32\nvapi.dll
2012-05-15 10:18:00 18771968 ----a-w- c:\windows\system32\nvoglnt.dll
2012-05-15 10:18:00 17543168 ----a-w- c:\windows\system32\nvcompiler.dll
2012-05-15 10:18:00 14014656 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-05-15 10:18:00 1000768 ----a-w- c:\windows\system32\nvdispco32.dll
2012-05-15 09:40:26 54272 ----a-w- c:\windows\system32\nvwddi.dll
2012-05-15 09:40:02 15504192 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 09:40:02 143680 ----a-w- c:\windows\system32\nvcolor.exe
2012-05-15 09:40:01 164160 ----a-w- c:\windows\system32\nvsvc32.exe
2012-05-15 09:40:01 108352 ----a-w- c:\windows\system32\nvmctray.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x8B057030]
3 CLASSPNP[0xB8108FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\0000006c[0x8B0D1410]
5 ACPI[0xB7F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Ide\IdeDeviceP2T0L0-16[0x8B0983C8]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
user != kernel MBR !!!
.
============= FINISH: 13:36:28.62 ===============
Here is the aswMBR log:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-06 13:53:51
-----------------------------
13:53:51.437 OS Version: Windows 5.1.2600 Service Pack 3
13:53:51.437 Number of processors: 2 586 0x170A
13:53:51.437 ComputerName: PLATOSCAVE UserName: Neon
13:53:54.921 Initialize success
13:54:33.328 AVAST engine defs: 12080500
13:54:48.921 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-16
13:54:48.921 Disk 0 Vendor: Size: 0MB BusType: 0
13:54:48.921 Disk 1 \Device\Harddisk1\DR2 -> \Device\0000007a
13:54:48.921 Disk 1 Vendor: Size: 0MB BusType: 0
13:54:48.968 Disk 0 MBR read successfully
13:54:48.968 Disk 0 MBR scan
13:54:49.062 Disk 0 Windows XP default MBR code
13:54:49.062 Disk 0 MBR hidden
13:54:49.062 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 305234 MB offset 63
13:54:49.125 Disk 0 scanning C:\WINDOWS\system32\drivers
13:55:09.468 Service scanning
13:55:42.015 Modules scanning
13:55:54.000 Disk 0 trace - called modules:
13:55:54.343 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
13:55:54.343 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b057030]
13:55:54.343 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\0000006c[0x8b0d1410]
13:55:54.343 5 ACPI.sys[b7f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-16[0x8b0983c8]
13:55:57.734 AVAST engine scan C:\WINDOWS
13:56:12.125 AVAST engine scan C:\WINDOWS\system32
14:01:45.203 AVAST engine scan C:\WINDOWS\system32\drivers
14:02:05.984 AVAST engine scan C:\Documents and Settings\Neon
14:03:03.015 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Neon\Desktop\MBR.dat"
14:03:03.015 The log file has been saved successfully to "C:\Documents and Settings\Neon\Desktop\aswMBR.txt"
14:06:04.609 AVAST engine scan C:\Documents and Settings\All Users
14:08:28.218 Scan finished successfully
14:11:36.609 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Neon\Desktop\MBR.dat"
14:11:36.609 The log file has been saved successfully to "C:\Documents and Settings\Neon\Desktop\aswMBR.txt"
I am usually very careful about malware etc but I think I have something on the system. When it boots, it halts for 5 to 10 mins at the desktop wallpaper before loading the desktop, also every program takes a long time to load and the whole compute is generally running quite slow.
System Specs:
AMD Athlon dual core 3ghz 4G ram (Windows XP uses only 2)
Nvidia 9600 GT vid card with 2g vram, and 300gb hdd and 500gb
usb hdd. System is running Windows XP SP3. In the last 6 weeks
I have reformatted and rebuilt 3 times, once because of a malware
problem. The current problem started about 3 weeks ago. Today
the system got caught in a loop in task manager, loading Update.exe
and GSV.exe then unloading them and repeating until I rebooted.
Spybot and Antivirus (Zone Alarm free) find no issues, I see nothing in HiJackthis or Cleaner.
I have run ERUNT and backed up the registry.
I ran aswMBR full scan overnight and when I came back next day the screen
was black, the mouse was active so I was not able to get the aswMBR
logs. I have now done a quick scan (as suggested in "Before you post...")
aswMBR log is under the DDS log.
I'll now run Spybot n disable TeaTimer after updating, n will check in here every day until the problem is resolved.
Thankyou for this service, I'm sure everyone appreciates the help.
Here is the DDS log:
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.6.2
Run by Neon at 13:32:46 on 2012-08-06
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2265 [GMT 9.5:30]
.
AV: ZoneAlarm Antivirus *Enabled/Updated* {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\GIGABYTE\ET6\GUI.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Mozilla Firefox\firefox.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.zonealarm.com/?Source=Homepage&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b
mSearchAssistant = ${SEARCH_URL_IE7}
uURLSearchHooks: DeviceVM Url Search Hook: {0063bf63-bfff-4b8f-9d26-4267df7f17dd} - c:\windows\system32\dvmurl.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Zonealarm Helper Object: {2a841f7a-a014-4da5-b6d9-8b913dfb7a8c} - c:\program files\check point software technologies ltd\zonealarm\1.5.24.4\bh\zonealarm.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: ZoneAlarm Security Toolbar: {438fae3e-bdef-44d3-ab8b-0c7c8350df59} - c:\program files\check point software technologies ltd\zonealarm\1.5.24.4\zonealarmTlbr.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
mRun: [Start WingMan Profiler] c:\program files\logitech\gaming software\LWEMon.exe /noui
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [EasyTuneVI] c:\program files\gigabyte\et6\ETcall.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [GEST] m‘|\ü
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [ISW] c:\program files\checkpoint\zaforcefield\ForceField.exe /icon="hidden"
mRun: [ZoneAlarm] c:\program files\checkpoint\zonealarm\zatray.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
StartupFolder: c:\docume~1\neon\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1341765315843
TCP: DhcpNameServer = 10.1.1.1
TCP: Interfaces\{35FCFEF3-5FF7-4D61-B321-5017B008FD19} : DhcpNameServer = 10.1.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
LSA: Notification Packages = scecli scecli scecli
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\neon\application data\mozilla\firefox\profiles\055x4kf3.default\
FF - prefs.js: browser.search.selectedEngine - Search By ZoneAlarm
FF - prefs.js: browser.startup.homepage - hxxp://apod.nasa.gov/apod/astropix.html
FF - prefs.js: keyword.URL - hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b&q={searchTerms}
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm_i.hmpg - true
FF - user.js: extensions.zonealarm.hmpgUrl - hxxp://search.zonealarm.com/?Source=Homepage&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b
FF - user.js: extensions.zonealarm.dfltSrch - true
FF - user.js: extensions.zonealarm.srchPrvdr - Search By ZoneAlarm
FF - user.js: extensions.zonealarm.keyWordUrl - hxxp://search.zonealarm.com/search?Source=Browser&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b&q={searchTerms}
FF - user.js: extensions.zonealarm_i.dnsErr - true
FF - user.js: extensions.zonealarm_i.newTab - true
FF - user.js: extensions.zonealarm.newTabUrl - hxxp://search.zonealarm.com/?Source=Newtab&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan=en&utid=ac138ca9000000000000001fd0286b8b
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?Source=ToolBar&oemCode=ZLN27867823447900-1001&toolbarId=base&affiliateId=1001&Lan={dfltLng}&utid=ac138ca9000000000000001fd0286b8b&q=
FF - user.js: extensions.zonealarm.id - ac138ca9000000000000001fd0286b8b
FF - user.js: extensions.zonealarm.instlDay - 15533
FF - user.js: extensions.zonealarm.vrsn - 1.5.24.4
FF - user.js: extensions.zonealarm.vrsni - 1.5.24.4
FF - user.js: extensions.zonealarm_i.vrsnTs - 1.5.24.418:43:42
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1001
FF - user.js: extensions.zonealarm_i.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base
FF - user.js: extensions.zonealarm.instlRef - ZLN27867823447900-1001
FF - user.js: extensions.zonealarm.dfltLng - en
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.admin - false
.
============= SERVICES / DRIVERS ===============
.
R0 KL1;kl1;c:\windows\system32\drivers\kl1.sys [2012-7-12 133208]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2012-7-12 11352]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2012-7-12 485808]
R1 Vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2012-6-21 526640]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-5-1 27016]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-5-1 497280]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-7-9 1262400]
R2 vsmon;TrueVector Internet Monitor;c:\program files\checkpoint\zonealarm\vsmon.exe -service --> c:\program files\checkpoint\zonealarm\vsmon.exe -service [?]
R3 AODDriver;AODDriver;c:\program files\gigabyte\et6\i386\AODDriver.sys [2009-2-23 7168]
R3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2012-7-8 24944]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-7-27 116648]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-3 160944]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-7-27 116648]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-08-06 03:46:09 -------- d-----w- c:\documents and settings\neon\local settings\application data\PCHealth
2012-08-06 03:25:06 -------- d-----w- C:\3cd1c5311552eb3b9d14456440
2012-08-06 03:23:50 221184 ----a-w- c:\windows\system32\wmpns.dll
2012-08-06 02:47:14 -------- d-----w- c:\windows\system32\LogFiles
2012-08-05 11:16:11 -------- d-----w- C:\637570fee2d8f02a61c8d107
2012-08-05 01:24:41 -------- d-----w- c:\documents and settings\neon\application data\PriceGong
2012-08-05 01:24:26 -------- d-----w- c:\documents and settings\neon\application data\Check Point Software Technologies LTD
2012-08-04 19:03:45 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2012-08-04 19:03:18 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2012-08-04 19:02:55 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2012-08-04 19:01:53 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2012-08-04 18:49:32 536576 -c----w- c:\windows\system32\dllcache\msado15.dll
2012-08-04 18:48:50 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2012-08-04 18:41:44 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2012-08-04 18:37:23 852480 -c----w- c:\windows\system32\dllcache\vgx.dll
2012-08-04 18:36:57 718336 -c----w- c:\windows\system32\dllcache\ntdll.dll
2012-08-04 18:36:55 2148352 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2012-08-04 18:36:54 2192640 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2012-08-04 18:36:52 2026496 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2012-08-04 18:36:51 2069120 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2012-08-04 18:36:31 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2012-08-04 18:36:15 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2012-08-04 18:35:51 3072 -c----w- c:\windows\system32\dllcache\iacenc.dll
2012-08-04 18:35:51 3072 ------w- c:\windows\system32\iacenc.dll
2012-08-04 18:31:29 45568 -c----w- c:\windows\system32\dllcache\wab.exe
2012-08-04 18:31:17 590848 -c----w- c:\windows\system32\dllcache\rpcrt4.dll
2012-08-04 18:31:17 5120 ------w- c:\windows\system32\xpsp4res.dll
2012-08-04 18:30:39 -------- d-----w- c:\windows\system32\PreInstall
2012-08-04 18:30:36 -------- d--h--w- c:\windows\$hf_mig$
2012-07-28 01:29:44 -------- d-----w- c:\program files\FS Water Configurator
2012-07-27 12:24:49 -------- d-----w- c:\documents and settings\neon\local settings\application data\Google
2012-07-27 12:23:34 -------- d-----w- c:\documents and settings\neon\local settings\application data\IsolatedStorage
2012-07-27 12:20:45 -------- d-----w- C:\TA Software
2012-07-27 03:18:42 -------- d-----w- C:\Your Folder FS2004
2012-07-25 01:22:03 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-07-25 01:22:03 214256 ----a-w- c:\windows\system32\muweb.dll
2012-07-25 01:22:03 17136 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-07-24 03:08:03 -------- d-----w- c:\documents and settings\neon\local settings\application data\Adobe
2012-07-23 17:26:25 -------- d-----w- c:\documents and settings\neon\.swt
2012-07-22 03:06:24 -------- d-----w- c:\documents and settings\neon\local settings\application data\Real_Environment_Simulati
2012-07-22 02:58:13 -------- d-----w- c:\program files\Real Environment Xtreme 2.0
2012-07-21 12:08:12 -------- d-----r- c:\program files\Skype
2012-07-20 03:10:55 -------- d-----w- c:\documents and settings\neon\local settings\application data\VAFinancials
2012-07-17 17:45:27 -------- d-----w- c:\documents and settings\neon\local settings\application data\Black_Tree_Gaming
2012-07-17 17:45:20 -------- d-----w- c:\program files\Nexus Mod Manager
2012-07-14 18:13:20 -------- d-----w- c:\documents and settings\neon\local settings\application data\Ilivid Player
2012-07-12 09:14:41 -------- d-----w- c:\windows\Internet Logs
2012-07-12 09:14:19 133208 ----a-w- c:\windows\system32\drivers\kl1.sys
2012-07-12 09:14:19 11352 ----a-w- c:\windows\system32\drivers\kl2.sys
2012-07-12 09:13:41 -------- d-----w- c:\program files\Check Point Software Technologies LTD
2012-07-11 22:35:21 -------- d-----w- c:\documents and settings\all users\application data\CheckPoint
2012-07-11 09:03:50 188866 ----a-w- c:\documents and settings\all users\application data\1341997380.bdinstall.bin
2012-07-09 15:40:04 78336 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\rxpGnsDriver.dll
2012-07-09 15:38:17 -------- d-----w- C:\RealityXP
2012-07-09 14:24:03 61 --sh--w- c:\windows\cnerolf.bin
2012-07-09 14:15:33 34064 ----a-w- c:\windows\system32\lhacm.acm
2012-07-09 14:15:29 -------- d-----w- c:\program files\Teamspeak2_RC2
2012-07-09 14:14:51 -------- d--h--w- c:\program files\InstallJammer Registry
2012-07-09 14:14:46 -------- d-----w- c:\program files\VAFS5
2012-07-09 14:14:30 -------- d-----w- c:\program files\Pilot Assistant
2012-07-09 14:14:09 -------- d-----w- c:\program files\Open Clouds
2012-07-09 14:12:22 414744 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\FSUIPC4.DLL
2012-07-09 14:04:21 599552 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\A2A_Feel.dll
2012-07-09 14:04:21 135168 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\modules\AccuFeelMenu.dll
2012-07-09 14:04:20 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\feel\UNWISE.EXE
2012-07-09 14:00:57 -------- d-----w- c:\windows\Flight1 Citation Mustang
2012-07-09 13:59:07 -------- d-----w- c:\program files\IconA5
2012-07-09 13:50:55 -------- d-----w- c:\program files\Wings of POWER II WWII FIGHTERS
2012-07-09 13:46:16 45568 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\spitfire\tools\Spitfire Input Configurator.exe
2012-07-09 13:46:04 697344 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wop3_spitfire\panel\A2A_Spit.dll
2012-07-09 13:46:02 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\spitfire\UNWISE.EXE
2012-07-09 13:42:53 217088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\a2a_piperj3\panel\A2A_PiperJ3s.dll
2012-07-09 13:42:53 139264 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\a2a_piperj3\panel\A2A_PiperSound.dll
2012-07-09 13:42:52 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\piperj3\UNWISE.EXE
2012-07-09 13:41:08 41472 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\b377\tools\B377 Input Configurator.exe
2012-07-09 13:40:46 617984 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wos_b377\panel\b377sv2.dll
2012-07-09 13:36:28 204800 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wos_b377\panel\B377s.dll
2012-07-09 13:36:27 153088 ----a-w- c:\windows\UNWISE.EXE
2012-07-09 13:35:10 57344 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\shared\A2A_Service.dll
2012-07-09 13:35:10 47104 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\b17\tools\B-17 Input Configurator.exe
2012-07-09 13:35:10 144384 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\shared\A2AserviceInstaller.exe
2012-07-09 13:34:54 397312 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wop2_b17g\panel\A2A_B17Sound.dll
2012-07-09 13:34:54 303616 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\simobjects\airplanes\wop2_b17g\panel\WoP3_B17s.dll
2012-07-09 13:34:46 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\a2a\b17\UNWISE.EXE
2012-07-09 13:34:23 153088 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\UNWISE.EXE
2012-07-09 13:34:22 -------- d-----w- c:\program files\Wings of POWER II
2012-07-09 13:27:40 82590 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\Uninstal Carenado C208B Super Cargomaster Expansion Pack HD.exe
2012-07-09 13:26:38 54311 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uninstall_C90B.exe
2012-07-09 13:19:58 53555 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uninstallC337.exe
2012-07-09 13:18:40 54272 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uninstallT210M.exe
2012-07-09 13:11:55 580608 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\uk2000 scenery\uk2000 vfr scenery volume3\uninstall.exe
2012-07-09 13:10:21 286720 ----a-w- c:\windows\iun506.exe
2012-07-09 12:45:08 47616 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\orbx\scripts\ftxcentral\work\FTXConfigurator.exe
2012-07-09 12:43:18 83373 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\addon scenery\scenery\Uninstal.exe
2012-07-09 11:18:01 77139 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\Uninstal.exe
2012-07-09 11:10:53 1212928 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\gauges\rxpGNS.dll
2012-07-09 11:10:52 929792 ----a-w- c:\program files\microsoft games\microsoft flight simulator x\gauges\rxpDrop.dll
2012-07-09 11:10:50 -------- d-----w- c:\program files\Reality XP
2012-07-09 11:10:35 -------- d-----w- c:\documents and settings\all users\application data\Reality XP
2012-07-09 11:09:17 -------- d-----w- c:\program files\Garmin
2012-07-09 11:08:28 32768 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2012-07-09 11:08:28 225280 ----a-w- c:\program files\common files\installshield\iscript\IScript.dll
2012-07-09 11:08:28 176128 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2012-07-09 11:08:27 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2012-07-09 11:08:27 212992 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ILog.dll
2012-07-09 06:26:27 -------- d-----w- c:\program files\MSXML 4.0
2012-07-09 05:46:01 -------- d-----w- c:\program files\Microsoft Games
.
==================== Find3M ====================
.
2012-08-06 03:42:09 24944 ----a-w- c:\windows\system32\drivers\GVTDrv.sys
2012-08-06 03:41:51 17488 ----a-w- c:\windows\gdrv.sys
2012-07-15 13:25:04 1074676 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-07-15 13:25:04 1074676 ----a-w- c:\windows\system32\nvdrsdb0.bin
2012-07-15 13:25:04 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-07-08 21:05:57 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2012-07-08 21:05:57 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2012-07-08 18:21:11 93640 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-07-08 18:21:10 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-07-08 18:21:09 811968 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-07-08 18:21:09 737208 ----a-w- c:\windows\system32\deployJava1.dll
2012-07-08 17:45:52 693268 ----a-w- c:\documents and settings\all users\application data\1341767658.bdinstall.bin
2012-07-08 15:22:58 315392 ----a-w- c:\windows\HideWin.exe
2012-07-08 14:52:25 81920 ----a-w- c:\windows\DUMP2f6c.tmp
2012-06-05 15:50:25 1372672 ------w- c:\windows\system32\msxml6.dll
2012-06-05 15:50:25 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-02 05:49:44 22040 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 05:49:38 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 05:49:38 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 05:49:34 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 05:49:30 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-15 10:18:00 883008 ----a-w- c:\windows\system32\nvgenco32.dll
2012-05-15 10:18:00 65536 ----a-w- c:\windows\system32\OpenCL.dll
2012-05-15 10:18:00 6012928 ----a-w- c:\windows\system32\nvcuda.dll
2012-05-15 10:18:00 4373248 ----a-w- c:\windows\system32\nv4_disp.dll
2012-05-15 10:18:00 2530624 ----a-w- c:\windows\system32\nvcuvid.dll
2012-05-15 10:18:00 2445120 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-05-15 10:18:00 2359808 ----a-w- c:\windows\system32\nvapi.dll
2012-05-15 10:18:00 18771968 ----a-w- c:\windows\system32\nvoglnt.dll
2012-05-15 10:18:00 17543168 ----a-w- c:\windows\system32\nvcompiler.dll
2012-05-15 10:18:00 14014656 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-05-15 10:18:00 1000768 ----a-w- c:\windows\system32\nvdispco32.dll
2012-05-15 09:40:26 54272 ----a-w- c:\windows\system32\nvwddi.dll
2012-05-15 09:40:02 15504192 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 09:40:02 143680 ----a-w- c:\windows\system32\nvcolor.exe
2012-05-15 09:40:01 164160 ----a-w- c:\windows\system32\nvsvc32.exe
2012-05-15 09:40:01 108352 ----a-w- c:\windows\system32\nvmctray.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x8B057030]
3 CLASSPNP[0xB8108FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\0000006c[0x8B0D1410]
5 ACPI[0xB7F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Ide\IdeDeviceP2T0L0-16[0x8B0983C8]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
user != kernel MBR !!!
.
============= FINISH: 13:36:28.62 ===============
Here is the aswMBR log:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-06 13:53:51
-----------------------------
13:53:51.437 OS Version: Windows 5.1.2600 Service Pack 3
13:53:51.437 Number of processors: 2 586 0x170A
13:53:51.437 ComputerName: PLATOSCAVE UserName: Neon
13:53:54.921 Initialize success
13:54:33.328 AVAST engine defs: 12080500
13:54:48.921 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-16
13:54:48.921 Disk 0 Vendor: Size: 0MB BusType: 0
13:54:48.921 Disk 1 \Device\Harddisk1\DR2 -> \Device\0000007a
13:54:48.921 Disk 1 Vendor: Size: 0MB BusType: 0
13:54:48.968 Disk 0 MBR read successfully
13:54:48.968 Disk 0 MBR scan
13:54:49.062 Disk 0 Windows XP default MBR code
13:54:49.062 Disk 0 MBR hidden
13:54:49.062 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 305234 MB offset 63
13:54:49.125 Disk 0 scanning C:\WINDOWS\system32\drivers
13:55:09.468 Service scanning
13:55:42.015 Modules scanning
13:55:54.000 Disk 0 trace - called modules:
13:55:54.343 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys
13:55:54.343 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b057030]
13:55:54.343 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\0000006c[0x8b0d1410]
13:55:54.343 5 ACPI.sys[b7f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-16[0x8b0983c8]
13:55:57.734 AVAST engine scan C:\WINDOWS
13:56:12.125 AVAST engine scan C:\WINDOWS\system32
14:01:45.203 AVAST engine scan C:\WINDOWS\system32\drivers
14:02:05.984 AVAST engine scan C:\Documents and Settings\Neon
14:03:03.015 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Neon\Desktop\MBR.dat"
14:03:03.015 The log file has been saved successfully to "C:\Documents and Settings\Neon\Desktop\aswMBR.txt"
14:06:04.609 AVAST engine scan C:\Documents and Settings\All Users
14:08:28.218 Scan finished successfully
14:11:36.609 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Neon\Desktop\MBR.dat"
14:11:36.609 The log file has been saved successfully to "C:\Documents and Settings\Neon\Desktop\aswMBR.txt"