Results 1 to 10 of 14

Thread: Rootalyzer log

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Junior Member
    Join Date
    Mar 2008
    Location
    Perth Australia
    Posts
    15

    Default Rootalyzer log

    I hope I am using the right part of the forum.
    A friend of mine has spent quite some time unable to access the Internet. After me placing a number of posts on DAL, following their suggestions and so on, I suggested that this has been going on for long enough and she was paying for Intenet access and not getting to use it; it was time to give it to a shop to get to the bottom of the matter.
    This she duly did and the report she gave me that the tech had found "root viruses" and that these kept replicating. I will get clearer information when I see her this evening but it sounds like rootkits.
    I have had Rootkit Revealer and Rootalzer for months, never installed them until now because I wasn't sure how seriously to take the threat. Today I installed Rootalzer and ran a scan.
    The results follow;
    // info: Rootkit removal help file
    // copyright: (c) 2008-2009 Safer-Networking Ltd. All rights reserved.

    :: RootAlyzer Results
    File:"Unknown ADS","C:\WINDOWS:6EA946C6C8605E2A:$DATA"
    RegyKey:"No admin in ACL","HKEY_LOCAL_MACHINE","\SOFTWARE\Classes\CLSID\","{ff86718b-4a16-42d9-9e49-daa8f1230815}"
    And I await any advice/suggestions that helpers can offer.

  2. #2
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
    "BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
    All advice given is taken at your own risk.
    Please make sure you have read this information so we are on the same page.

    You must have read and followed the "Before you Post" instructions.

    G'Day mate, I believe I can help but it may require time and work. Keep in mind the time difference also, I am on the west coast of Florida, USA.

    Let's start by reading and following the "Before you Post" instructions I posted a link to above. If there is no internet access, bring HijackThis to the infected computer via removable media and post the log that results from the scan.

    Please DO NOT ENABLE Spybot S&D TeaTimer while we work together.

    Post also an uninstall list: Open Hijackthis.
    Click the "Open the Misc Tools" section Button.
    Click the "Open Uninstall Manager" Button.
    Click the "Save list..." Button.
    Save it to your desktop. Copy and paste the contents into your reply.
    Image: http://img.bleepingcomputer.com/tuto...nstall-man.jpg

    Cheers...Phil
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  3. #3
    Junior Member
    Join Date
    Mar 2008
    Location
    Perth Australia
    Posts
    15

    Default Rootalyzer log

    Hi Phil,
    Here is the HijackThis uninstall log you asked for.
    @BIOS B06.0721.01
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    2007 Microsoft Office Suite Service Pack 2 (SP2)
    ABBYY FineReader 9.0 Professional Edition
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe Dreamweaver CS3
    Adobe Dreamweaver CS3
    Adobe ExtendScript Toolkit 2
    Adobe Extension Manager CS3
    Adobe Flash Player Plugin
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe Linguistics CS3
    Adobe PDF Library Files
    Adobe Photoshop 7.0
    Adobe Photoshop CS3
    Adobe Photoshop CS3
    Adobe Reader 8.1.2
    Adobe Setup
    Adobe Setup
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe WinSoft Linguistics Plugin
    Adobe XMP Panels CS3
    AnyDVD
    ATI - Software Uninstall Utility
    ATI Display Driver
    ATI HYDRAVISION
    Canon LBP3000
    Canon MP Navigator 3.0
    Canon MP160
    Canon Utilities Easy-PhotoPrint
    CloneDVD 4.3.0.3
    COMODO Internet Security
    ConvertXtoDVD 3.3.4.106e
    Cool Edit Pro 2.0
    Critical Update for Windows Media Player 11 (KB959772)
    CyberLink PhotoNow
    CyberLink PowerDirector
    dBpoweramp [ID Tag Update] Codec
    dBpoweramp [Multi Encoder] Codec
    dBpoweramp [Tag From Filename] Codec
    dBpoweramp DSP Effects
    dBpoweramp FLAC Codec
    dBpoweramp m4a Codec
    dBpoweramp Monkeys Audio Codec
    dBpoweramp Music Converter
    dBpoweramp Ogg Vorbis Codec
    dBpoweramp Windows Media Audio 10 Codec
    DriverAgent by eSupport.com
    DVD Decrypter (Remove Only)
    DVD Shrink 3.2
    Easy-WebPrint
    Eraser 5.86
    ERUNT 1.1j
    Free Download Manager 3.0
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB961118)
    InterVideo DeviceService
    IP Filter Updater 0.3
    LiveUpdate 3.2 (Symantec Corporation)
    Macromedia Dreamweaver MX
    Macromedia Extension Manager
    Macromedia Fireworks MX
    Macromedia Flash MX
    MAGIX Audio Cleaning Lab 15 deluxe Trial 10.0.2.0 (UK)
    MAGIX Screenshare 4.3.6.1987 (UK)
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 3.5 SP1
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Math Add-in for Word 2007
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel 2007 Get Started Tab
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Mozilla Firefox (3.0.11)
    Mozilla Thunderbird (2.0.0.22)
    MPEG Video Wizard DVD 4.0.4.112 (12/2008)
    MSXML 4.0 SP2 (KB954430)
    MSXML 6.0 Parser (KB925673)
    Nero OEM
    Nero Suite
    Ogg Codecs 0.81.15562
    PDF Settings
    QuarkXPress 4.0
    QuickTime
    Realtek AC'97 Audio
    Realtek High Definition Audio Driver
    Revo Uninstaller 1.80
    ScanSoft OmniPage SE 4.0
    Security Update for Windows Internet Explorer 8 (KB969897)
    Security Update for Windows Media Encoder (KB954156)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB970238)
    SmartSound Quicktracks Plugin
    Software Informer 1.0 BETA
    Spybot - Search & Destroy
    Symantec AntiVirus
    TMPGEnc DVD Author 3 with DivX Authoring
    TMPGEnc Plus 2.5
    Ulead DVD MovieFactory 5
    Ulead VideoStudio 11 SE DVD
    Unlocker 1.8.7
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB971930)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    VeryPDF PDF2Word v3.0
    VLC media player 0.9.9
    Westnet Usage Grabber 7.3
    Windows Internet Explorer 8
    Windows Media Encoder 9 Series
    Windows Media Encoder 9 Series
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows Presentation Foundation
    Windows XP Service Pack 3
    WinFast DTV2000 H Driver
    WinFast PVR2
    WinRAR archiver

    Just to bring you up to date, the computer is generally running well, but I am having problems getting pdf attachments on web based sites to open, despite repeatedly installing and uninstalling Acrobat Reader (and Acrobat).
    The other issue is dBpoweramp Music Converter which presently only has the manual tag update function working. All conversions get a "Core Converter.exe" error message. Their forum has advised a clean install, reinstall dMC, test the CD ripper, then progressively reinstall security apps, when the CD ripper stops working that will be the security app that is the impediment. I am very reluctant to do this as one of the 4 (or 5, it is a bit of a blur) Windows reinstallations since 11 June was done with no security apps installed (while running Windows updates) and I had so many malware items that another reinstall followed where I installed the security apps before going on line, and defragged after all the updates. (dMC requires web access to contact Accurate Rip and one of the web services that provide meta data)
    An example of why I am reluctant to go on line "undressed" is when I was updating Windows on my other computer recently when a Spybot pop up told me it had just blocked Virtumonde. It had not come from Microsoft, it was just "out there" looking for traffic it could attach itself to.
    Hope the above is enlightening.
    Look forward to your reply.

  4. #4
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    G'Day Russell, thanks for the uninstall list and the feedback.

    Uninstall list: I look for malware and security issues and will not know all of your programs, but you should.
    Hackers are using out of date programs to infect folks more and more,
    Here is a small free tool that lets you know when something needs an update if you are interested:
    http://secunia.com/vulnerability_scanning/personal/ While PSI runs in the System Tray for realtime notifications, I personally prefer to turn it off in MSConfig and run it from All Programs when I want to do a check.

    Adobe Reader 8.1.2 <<< out of date and unsafe, see this:
    http://news.cnet.com/8301-1009_3-100...ml?tag=nl.e433
    http://blogs.adobe.com/psirt/2009/04...der_issue.html
    http://www.adobe.com/support/securit...apsb09-07.html
    http://www.filehippo.com/download_adobe_reader/
    (if you want a smaller program, look at this one)
    Foxit Reader 2.3 for Windows (make sure to uncheck any toolbars)
    http://www.foxitsoftware.com/pdf/rd_intro.php


    Couple of questions before proceeding, I see: COMODO Internet Security
    What security programs are being provided by Comodo?
    Symantec AntiVirus <<< reason I ask is because you did not post a HijackThis log and I can't see what security programs are in Running Processes.

    Spybot - Search & Destroy <<< are you positive this program is up to date and fully immunized:
    http://www.safer-networking.org/en/
    http://www.safer-networking.org/en/faq/index.html
    http://www.safer-networking.org/en/tutorial/index.html

    We will try to eliminate your other issues before we finish or at least get you to where you can get help with non-malware related issues.

    Malwarebytes' Anti-Malware <<< you have MBAM, let's run it next, please try to update if possible.
    7/13/2009 version 1.39 Database 2424

    No need to download since you have the program, please run it as instructed.

    Download Malwarebytes' Anti-Malware to your Desktop
    http://www.malwarebytes.org/

    http://www.besttechie.net/mbam/mbam-setup.exe <<< download

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform FULL SCAN, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
    * Please post contents of that file & a new HijackThis log in your next reply.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

    Tutorial if needed:
    http://thespykiller.co.uk/index.php/topic,5946.0.html

    Cheers
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  5. #5
    Junior Member
    Join Date
    Mar 2008
    Location
    Perth Australia
    Posts
    15

    Default Rootalyzer log

    Hi Phil,
    Well that certainly kept me busy. I checked in at Windows Updates on Monday and there was nothing new, today over 200mb of stuff!
    I have updated everything that Secunia identified except for Quicktime. I got this with the Ulead software and have yet to use it. I have had Quicktime on this computer before and did not like it. Instead of downloading a song it loaded it into Quicktime and I could only listen to the song by using Quicktime. Reminds me of Real Player, tries to takeover whether you want it to or not. I have downloaded the update and will install it after creating a Restore Point, just in case. I am a little skeptical that this constitutes a security risk.
    Now to your other questions, Comodo is present as a firewall only, and I can't say I particularly like it. I was quite happy with Zone Alarm, but after mods on 2 different sites (DAL, and Mozillazine) invited me to do a search for Zone Alarm horror stories I allowed myself to be persuaded to use Comodo.
    I have updated Acrobat, I think I did try to update to version 9 which came with Air which I didn't want and seemed like bloatware. Interestingly I still cannot open pdf files from within the browser, at least with Firefox, it works with IE, so I shall be making a post on Mozillazine soon.
    As for Symantec it is for AV, but that should show in the logs I am about to dump on you. The reason I did not post a log from HijackThis is you did not ask for one, just the uninstall list.
    Spybot is up to date, I ran immunisation again and it found a small number of things to immunise, 180 I think.
    Malwarebytes is up to date, version 1.39, database 2432 and the scan showed no problems at all.
    So here are the logs:

    Malwarebytes' Anti-Malware 1.39
    Database version: 2432
    Windows 5.1.2600 Service Pack 3

    15/07/2009 12:01:19 PM
    mbam-log-2009-07-15 (12-01-19).txt

    Scan type: Full Scan (C:\|D:\|E:\|F:\|H:\|)
    Objects scanned: 292815
    Time elapsed: 1 hour(s), 21 minute(s), 58 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
    AND
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:05:45 PM, on 15/07/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
    C:\Program Files\WinFast\WFDTV\WFWIZ.exe
    C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\WINDOWS\system32\bgsvcgen.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\CNAB3RPK.EXE
    C:\Program Files\Westnet Usage Grabber\wug.exe
    C:\WINDOWS\system32\wuauclt.exe
    H:\uTorrent\uTorrent.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
    O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11 SE DVD\uvPL.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-21-1177238915-1078145449-725345543-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - HKUS\S-1-5-21-1177238915-1078145449-725345543-1004\..\Run: [fsm] (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - S-1-5-21-1177238915-1078145449-725345543-1004 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User '?')
    O4 - S-1-5-21-1177238915-1078145449-725345543-1004 Startup: Westnet Usage Grabber.lnk = C:\Program Files\Westnet Usage Grabber\wug.exe (User '?')
    O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
    O4 - Startup: Westnet Usage Grabber.lnk = C:\Program Files\Westnet Usage Grabber\wug.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
    O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
    O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
    O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1246670135203
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
    O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --
    End of file - 11059 bytes
    seems appropriate to make sure you can breathe under the all that data.
    dMC is still not seeing disks in the drive.
    I look forward to your next post.
    Cheers
    Russell
    PS Not sure if Tea Timer was running or not when I did those scans. Do you prefer coffee?

  6. #6
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,252

    Default

    Just for your information, I prefer Windows Media Player which Microsoft keeps up to date. OEM installers put junk like Real Player and Quicktime on the computer because they get paid to do it. The first thing I do out of the box is uninstall all programs I do not use or need.
    I checked in at Windows Updates on Monday and there was nothing new, today over 200mb of stuff!
    I have them setting in System Tray and have not looked yet.
    I was quite happy with Zone Alarm
    I have been using ZoneAlarm free for about eight years with minimal issues. They do try to install adware toolbars so opt out if you should try it.
    Interestingly I still cannot open pdf files from within the browser, at least with Firefox, it works with IE, so I shall be making a post on Mozillazine soon.
    Did you look at Foxit Reader 3.0 for Windows, last I remember it was about 1/10th the size of Adobe Reader. Make sure you opt of if the junk toolbars if you try that freeware.
    My suggestion would have been Mozilla Firefox support since IE is not having the issue.
    Please DO NOT ENABLE Spybot S&D TeaTimer while we work together.
    TeaTimer is running in the HJT log, reason we disable TT is it locks stuff in memory and it is near to impossible to remove stuff when it is running.

    H:\uTorrent\uTorrent.exe <<< all p2p programs must be uninstalled from the computer.
    http://forums.spybot.info/showthread.php?t=282
    If your helper detects the presence of such programs on your computer he/she will ask you to remove them. Help will be withdrawn should you not agree to their removal.
    dMC is still not seeing disks in the drive.
    What is that and what is the exact error message word for word? That information returns this:
    http://www.google.com/search?hl=en&q...&aq=f&oq=&aqi=

    Provide any information I requested and some feedback about performance and any other issues and we will go from there.

    Not related to malware, I believe some of this information may help you with performance.
    http://www.netsquirrel.com/msconfig/msconfig_xp.html
    http://users.telenet.be/bluepatchy/m...wcomputer.html
    http://www.malwareremoval.com/tutori...ningslowly.php
    http://www.bleepingcomputer.com/foru...2&#entry487112
    http://www.microsoft.com/atwork/getstarted/speed.mspx

    Thanks...Phil
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •