Computer Stutter

[grassman22]

Hello,

Lately my computer seems to stutter with no apparent reason. AVG scan found nothing. SB found Right Media Browser, wich I removed, but every scan I do I see it again.

As far as I can remember, the stutter began immediately after another Computer in my network (the one who is connected to the modem) was replaced with a new one. I saw zone alarm is blocking file transfer to it's IP, so I allowed it (moving that IP to the trusted zone) assuming that was what made the system stutter, but the stutter continued.

Enyway, here is my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:25:44, on 28/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {54B02808-B60E-44CD-A72D-9865117E4E62} - (no file)
O2 - BHO: AGFormHelperObj Class - {6620E618-1AB9-4EB2-ACA4-CBBE9066DBE6} - C:\PROGRA~1\agat\AGForm\AGFORM~1.DLL
O3 - Toolbar: AGForms - {ed2e7de7-07db-4941-a06d-f780b93ba730} - C:\Program Files\agat\AGForm\AGForms.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260535957859
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://tango.huji.ac.il/sre/ICSScanner.cab
O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://tango.huji.ac.il/SNX/CSHELL/extender.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6911 bytes


Thnx,

Grassman22

 

[peku006]

Hello and :welcome: to Safer Networking

My name is peku006 and I will be helping you to remove any infection(s) that you may have.
I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

Please observe these rules while we work:

• If you don't know or understand something please don't hesitate to ask
• Please DO NOT run any other tools or scans whilst I am helping you.
• It is important that you reply to this thread. Do not start a new topic.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• Absence of symptoms does not mean that everything is clear.

1 - download and run RSIT

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)

2 - Status Check
Please reply with

1.the logs from RSIT (log.txt ,info.txt)

Thanks peku006

 

[grassman22]

Hi,

Here is the log.txt. Didn't get the info.txt.


Logfile of random's system information tool 1.06 (written by random/random)
Run by Doron at 2010-01-04 12:32:01
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 63 GB (84%) free of 75 GB
Total RAM: 1022 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:32:21, on 04/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Documents and Settings\Doron\שולחן העבודה\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Doron.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {54B02808-B60E-44CD-A72D-9865117E4E62} - (no file)
O2 - BHO: AGFormHelperObj Class - {6620E618-1AB9-4EB2-ACA4-CBBE9066DBE6} - C:\PROGRA~1\agat\AGForm\AGFORM~1.DLL
O3 - Toolbar: AGForms - {ed2e7de7-07db-4941-a06d-f780b93ba730} - C:\Program Files\agat\AGForm\AGForms.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260535957859
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://tango.huji.ac.il/sre/ICSScanner.cab
O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://tango.huji.ac.il/SNX/CSHELL/extender.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6961 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-12-13 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54B02808-B60E-44CD-A72D-9865117E4E62}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6620E618-1AB9-4EB2-ACA4-CBBE9066DBE6}]
AGFormHelperObj Class - C:\PROGRA~1\agat\AGForm\AGFORM~1.DLL [2008-07-17 76144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{ed2e7de7-07db-4941-a06d-f780b93ba730} - AGForms - C:\Program Files\agat\AGForm\AGForms.dll [2009-09-17 440688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-09-22 14854144]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-04-22 5898240]
"nwiz"=nwiz.exe /install []
"SW20"=C:\WINDOWS\system32\sw20.exe [2005-06-30 200704]
"SW24"=C:\WINDOWS\system32\sw24.exe [2005-07-04 69632]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-04-22 86016]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-12-13 2043160]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2009-02-16 981384]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2004-10-08 221184]
"RemoteControl"=C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [2003-12-08 32768]
"InCD"=C:\Program Files\Ahead\InCD\InCD.exe [2005-07-08 1397760]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-05-11 49152]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-11-10 417792]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\תפריט התחלה\תוכניות\הפעלה
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2009-08-26 11952]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=16895

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgnsx.exe"="C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15393111-9c5c-11de-85c5-0013d3e4f10b}]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b536e80-f7ae-11de-8670-54f51b592d0a}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn


======List of files/folders created in the last 1 months======

2009-12-28 21:14:54 ----A---- C:\WINDOWS\NCLogConfig.ini
2009-12-28 12:01:37 ----D---- C:\Program Files\GOV.IL
2009-12-28 12:01:37 ----D---- C:\Program Files\agat
2009-12-22 17:18:25 ----D---- C:\Documents and Settings\Doron\Application Data\Apple Computer
2009-12-22 17:15:37 ----D---- C:\Program Files\QuickTime
2009-12-22 17:15:36 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-12-22 17:15:17 ----D---- C:\Program Files\Common Files\Apple
2009-12-22 17:15:06 ----D---- C:\Program Files\Apple Software Update
2009-12-22 17:15:05 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-12-10 17:59:40 ----D---- C:\Documents and Settings\All Users\Application Data\HP
2009-12-10 17:59:22 ----D---- C:\Program Files\Common Files\HP
2009-12-10 17:58:04 ----D---- C:\Program Files\Hewlett-Packard
2009-12-10 17:57:11 ----D---- C:\Program Files\Common Files\Hewlett-Packard
2009-12-10 17:55:40 ----A---- C:\WINDOWS\system32\HPZisn12.dll
2009-12-10 17:55:40 ----A---- C:\WINDOWS\system32\HPZipt12.dll
2009-12-10 17:55:40 ----A---- C:\WINDOWS\system32\HPZipr12.dll
2009-12-10 17:55:40 ----A---- C:\WINDOWS\system32\HPZipm12.exe
2009-12-10 17:55:40 ----A---- C:\WINDOWS\system32\HPZinw12.exe
2009-12-10 17:55:39 ----A---- C:\WINDOWS\system32\HPZidr12.dll
2009-12-10 17:54:11 ----D---- C:\Program Files\HP
2009-12-10 17:51:29 ----HD---- C:\Config.Msi
2009-12-10 17:48:51 ----D---- C:\Documents and Settings\Doron\Application Data\HP
2009-12-10 15:21:24 ----A---- C:\WINDOWS\lgfwup.ini
2009-12-10 15:21:20 ----N---- C:\WINDOWS\system32\Vb6stkit.dll
2009-12-10 15:21:20 ----N---- C:\WINDOWS\system32\VB6KO.DLL
2009-12-10 15:13:52 ----A---- C:\WINDOWS\system32\TwnLib20.dll
2009-12-10 15:13:46 ----N---- C:\WINDOWS\system32\ImagXRA7.dll
2009-12-10 15:13:46 ----N---- C:\WINDOWS\system32\ImagXR7.dll
2009-12-10 15:13:46 ----N---- C:\WINDOWS\system32\ImagXpr7.dll
2009-12-10 15:13:46 ----N---- C:\WINDOWS\system32\ImagX7.dll
2009-12-10 15:13:41 ----A---- C:\WINDOWS\system32\NeroCheck.exe
2009-12-10 15:13:07 ----N---- C:\WINDOWS\NuNinst.exe
2009-12-10 15:13:03 ----D---- C:\Program Files\Common Files\Ahead
2009-12-10 15:13:01 ----D---- C:\WINDOWS\InCD
2009-12-10 15:13:01 ----D---- C:\Program Files\Ahead
2009-12-10 15:12:44 ----D---- C:\Documents and Settings\All Users\Application Data\CyberLink
2009-12-10 15:12:03 ----D---- C:\Program Files\CyberLink
2009-12-10 15:11:50 ----D---- C:\MyWorks
2009-12-10 15:11:42 ----A---- C:\Program Files\Uninstall_CDS.exe
2009-12-10 15:11:37 ----D---- C:\Program Files\CyberLink DVD Solution

======List of files/folders modified in the last 1 months======

2010-01-04 12:32:20 ----D---- C:\WINDOWS\Prefetch
2010-01-04 12:20:18 ----D---- C:\WINDOWS\Internet Logs
2010-01-04 12:07:42 ----D---- C:\WINDOWS\Temp
2010-01-04 00:42:22 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-03 11:56:53 ----D---- C:\WINDOWS\system32\Lang
2010-01-02 16:53:35 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-02 16:53:29 ----D---- C:\WINDOWS
2009-12-30 12:14:52 ----D---- C:\WINDOWS\system32
2009-12-30 12:14:51 ----D---- C:\Program Files\Crazy Browser
2009-12-28 14:27:06 ----D---- C:\WINDOWS\ERDNT
2009-12-28 13:45:41 ----HD---- C:\$AVG8.VAULT$
2009-12-28 13:42:32 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-28 12:03:24 ----SHD---- C:\WINDOWS\Installer
2009-12-28 12:01:37 ----RD---- C:\Program Files
2009-12-23 17:56:57 ----SD---- C:\Documents and Settings\Doron\Application Data\Microsoft
2009-12-22 17:15:20 ----D---- C:\WINDOWS\WinSxS
2009-12-22 17:15:17 ----D---- C:\Program Files\Common Files
2009-12-21 01:50:45 ----D---- C:\WINDOWS\Debug
2009-12-11 14:52:51 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-11 14:52:46 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-12-10 17:59:47 ----A---- C:\WINDOWS\win.ini
2009-12-10 17:57:35 ----D---- C:\WINDOWS\twain_32
2009-12-10 17:56:47 ----D---- C:\WINDOWS\system32\drivers
2009-12-10 17:55:59 ----HD---- C:\WINDOWS\inf
2009-12-10 15:25:50 ----HD---- C:\Program Files\InstallShield Installation Information

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-08-26 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-08-26 27784]
R1 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2009-08-26 108552]
R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2005-07-08 29696]
R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2005-07-08 28672]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 39936]
R1 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2009-02-16 353672]
R3 CamDrL;Logitech QuickCam Pro 3000(CamDrl); C:\WINDOWS\system32\DRIVERS\Camdrl.sys [2004-10-08 326656]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2005-09-01 176640]
R3 HDAudBus;אװ װךח ׀הח UAA י Microsoft גׁױט High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-09-23 3966976]
R3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2004-10-08 22016]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-09-18 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-04-22 3095680]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-12-05 10368]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VNA;Check Point Virtual Network Adapter; C:\WINDOWS\system32\DRIVERS\vna.sys [2007-06-10 110160]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2005-07-08 99584]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-08-26 908056]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-08-26 297752]
R2 cpextender;Check Point SSL Network Extender; C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe [2007-06-10 331870]
R2 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2005-07-08 871424]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-04-22 127043]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 vsmon;TrueVector Internet Monitor; C:\WINDOWS\system32\ZoneLabs\vsmon.exe [2009-02-16 2402184]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-09-29 69632]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-11-01 72704]
S3 getPlusHelper;getPlus(R) Helper; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------


Thnx,

Grassman22

 

[peku006]

Hi Grassman22

info.txt. should be here

C:\rsit\ info.txt

Thanks peku006

 

[grassman22]

Hi,

Here is the info.txt:

info.txt logfile of random's system information tool 1.06 2009-09-07 00:22:57

======Uninstall list======

-->C:\WINDOWS\system32\msiuins.exe
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
AVG Free 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Crazy Browser version 3.0.0 RC2-->"C:\Program Files\Crazy Browser\unins000.exe"
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel(R) PRO Network Connections Drivers-->Prounstl.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Panda USB Vaccine 1.0.0.50a-->"C:\Program Files\Panda USB Vaccine\unins000.exe"
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
VC 9.0 Runtime-->MsiExec.exe /I{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
ZoneAlarm-->C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
עדכון אבטחה עבור Windows Media Player‏ (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows Media Player‏ (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB923561)‎-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB938464-v2)‎-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB946648)‎-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB950762)‎-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB950974)‎-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB951066)‎-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB951376-v2)‎-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB951748)‎-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB952004)‎-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB952954)‎-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB954459)‎-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB954600)‎-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB955069)‎-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB956572)‎-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB956744)‎-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB956802)‎-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB956803)‎-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB957097)‎-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB958644)‎-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB958687)‎-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB959426)‎-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB960225)‎-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB960803)‎-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB960859)‎-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB961371-v2)‎-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB961501)‎-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB968537)‎-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB970238)‎-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB971557)‎-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB971633)‎-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB971657)‎-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB972260)‎-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB973346)‎-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB973354)‎-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB973507)‎-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
עדכון אבטחה עבור Windows XP (KB973869)‎-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
עדכון עבור Windows XP (KB951978)‎-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
עדכון עבור Windows XP (KB967715)‎-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
עדכון עבור Windows XP (KB968389)‎-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
עדכון עבור Windows XP (KB973815)‎-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
תיקון חם עבור Windows XP (KB952287)‎-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
תיקון חם עבור Windows XP (KB970653-v3)‎-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"

======Security center information======

AV: AVG Anti-Virus Free
FW: ZoneAlarm Firewall

======System event log======

Computer Name: DORON
Event Code: 7000
Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.


Record Number: 211
Source Name: Service Control Manager
Time Written: 20090826203407.000000+180
Event Type: error
User:

Computer Name: DORON
Event Code: 7000
Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.


Record Number: 210
Source Name: Service Control Manager
Time Written: 20090826203407.000000+180
Event Type: error
User:

Computer Name: DORON
Event Code: 7000
Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.


Record Number: 83
Source Name: Service Control Manager
Time Written: 20090823171227.000000+180
Event Type: error
User:

Computer Name: DORON
Event Code: 7000
Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.


Record Number: 82
Source Name: Service Control Manager
Time Written: 20090823171227.000000+180
Event Type: error
User:

Computer Name: DORON
Event Code: 16
Message: ‏‏לא ניתן להתחבר: ל- Windows אין אפשרות להתחבר לשירות העדכונים האוטומטיים ולכן אין אפשרות להוריד ולהתקין עדכונים בהתאם ללוח הזמנים שנקבע. Windows ימשיך לבצע נסיונות ליצור חיבור.

Record Number: 69
Source Name: Windows Update Agent
Time Written: 20090823162641.000000+180
Event Type: error
User:

=====Application event log=====

Computer Name: DORON
Event Code: 1005
Message: ‏‏המוצר של Windows עדיין לא הופעל עם Microsoft. השתמש באשף הפעלת המוצר תוך 27 ימים.


Record Number: 42
Source Name: Windows Product Activation
Time Written: 20090823162551.000000+180
Event Type: warning
User:

Computer Name: DORON
Event Code: 60
Message: ‏‏ל- WMI ADAP לא היתה אפשרות לעבד את ספריות הביצועים: 0x80041001

Record Number: 36
Source Name: WinMgmt
Time Written: 20090820141441.000000+180
Event Type: warning
User:

Computer Name: DORON
Event Code: 60
Message: ‏‏ל- WMI ADAP לא היתה אפשרות לעבד את ספריות הביצועים: 0x80041001

Record Number: 28
Source Name: WinMgmt
Time Written: 20090820025733.000000+180
Event Type: warning
User:

Computer Name: DORON
Event Code: 1005
Message: ‏‏המוצר של Windows עדיין לא הופעל עם Microsoft. השתמש באשף הפעלת המוצר תוך 30 ימים.


Record Number: 24
Source Name: Windows Product Activation
Time Written: 20090820025458.000000+180
Event Type: warning
User:

Computer Name: DORON
Event Code: 63
Message: ‏‏ספק, HiPerfCooker_v1, נרשם בטווח השמות WMI‏, Root\WMI, לשימוש בחשבון LocalSystem. חשבון זה הוא מורשה והספק עשוי לגרום להפרת אבטחה אם הוא לא יתחזה כהלכה לבקשות משתמשים.

Record Number: 11
Source Name: WinMgmt
Time Written: 20090820024707.000000+180
Event Type: warning
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0404
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"tvdumpflags"=8

-----------------EOF-----------------


Thnx,

Grassman22

 

[peku006]

Hi Grassman22

I have a problem with these , Can you translate they for me


======System event log======

Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.

Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.

Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.

Message: The MSICPL service failed to start due to the following error:
‏‏למערכת אין אפשרות לאתר את הקובץ שצוין.


Message: ‏‏לא ניתן להתחבר: ל- Windows אין אפשרות להתחבר לשירות העדכונים האוטומטיים ולכן אין אפשרות להוריד ולהתקין עדכונים בהתאם ללוח הזמנים שנקבע. Windows ימשיך לבצע נסיונות ליצור חיבור.

=====Application event log=====


Message: ‏‏המוצר של Windows עדיין לא הופעל עם Microsoft. השתמש באשף הפעלת המוצר תוך 27 ימים.

Message: ‏‏ל- WMI ADAP לא היתה אפשרות לעבד את ספריות הביצועים: 0x80041001

Message: ‏‏ל- WMI ADAP לא היתה אפשרות לעבד את ספריות הביצועים: 0x80041001

Message: ‏‏המוצר של Windows עדיין לא הופעל עם Microsoft. השתמש באשף הפעלת המוצר תוך 30 ימים.

Message: ‏‏ספק, HiPerfCooker_v1, נרשם בטווח השמות WMI‏, Root\WMI, לשימוש בחשבון LocalSystem. חשבון זה הוא מורשה והספק עשוי לגרום להפרת אבטחה אם הוא לא יתחזה כהלכה לבקשות משתמשים.

Thanks peku006

 

[grassman22]

Hi,

I found the equivalent event meassages in english:

======System event log======

Message: The MSICPL service failed to start due to the following error:
The system cannot find the file specified.

Message: The MSICPL service failed to start due to the following error:
The system cannot find the file specified.

Message: The MSICPL service failed to start due to the following error:
The system cannot find the file specified.

Message: The MSICPL service failed to start due to the following error:
The system cannot find the file specified.


Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

=====Application event log=====


Message: Your Windows product has not been activated with Microsoft yet. Please use the Product Activation Wizard within 27 days.

Message: wmi adap was unable to process the performance libraries: 0x80041001.

Message: wmi adap was unable to process the performance libraries: 0x80041001.

Message: Your Windows product has not been activated with Microsoft yet. Please use the Product Activation Wizard within 30 days.

Message: A provider, HiPerfCooker_v1, has been registered in the
WMI namespace Root\WMI to use the local system account.
This account is privileged and the provider may cause a
security violation if it does not correctly impersonate
user requests.


Thnx,

Grassman22

 

[peku006]

Hi Grassman22

Message: Your Windows product has not been activated with Microsoft yet. Please use the Product Activation Wizard within 30 days.

Why you have not activated your Windows ?
Is this your "own personal computer" ?

Thanks peku006

 

[grassman22]

Hi,

I did activate it, after I reinstalled Windows back in the summer. It's my computer and it's a legal copy of Windows I bought with it.

Thnx,

Grassman22

 

[peku006]

Hi Grassman22
OK

1 - Run Malwarebytes' Anti-Malware

• Open Malwarebytes' Anti-Malware
• Select the Update tab
• Click Check for Updates
• After the update have been completed, Select the Scanner tab.
  On the Scanner tab:
  1. Make sure the "Perform full scan" option is selected.
  2. Then click on the Scan button.
  3. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  4. The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  5. When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  6. Click OK to close the message box and continue with the removal process.
  Back at the main Scanner screen:
• Click on the Show Results button to see a list of any malware that was found.
• Check all items except items in the C:\System Volume Information folder... then click on Remove Selected.
  We will take care of the System Volume Information items later.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

2 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

3 - Status Check
Please reply with

1. the Malwarebytes' Anti-Malware Log
2. a fresh HijackThis log

Thanks peku006

 

[grassman22]

Hi,

Here are the logs:

Malwarebytes' Anti-Malware 1.43
Database version: 3495
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

05/01/2010 12:17:48
mbam-log-2010-01-05 (12-17-48).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 178520
Time elapsed: 38 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:20:44, on 05/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {54B02808-B60E-44CD-A72D-9865117E4E62} - (no file)
O2 - BHO: AGFormHelperObj Class - {6620E618-1AB9-4EB2-ACA4-CBBE9066DBE6} - C:\PROGRA~1\agat\AGForm\AGFORM~1.DLL
O3 - Toolbar: AGForms - {ed2e7de7-07db-4941-a06d-f780b93ba730} - C:\Program Files\agat\AGForm\AGForms.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260535957859
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://tango.huji.ac.il/sre/ICSScanner.cab
O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://tango.huji.ac.il/SNX/CSHELL/extender.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 7123 bytes


Thnx,

Grassman22

 

[peku006]

Hi Grassman22

all logs are ok

1 - Clean temp files

• Please download TFC to your desktop
• Save any unsaved work. TFC will close all open application windows.
• Double-click TFC.exe to run the program.
• If prompted, click Yes to reboot.

NOTE: Save your work.TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

2 - Eset online scannner

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• Please go here then click on:
  
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
  
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
  
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

3 - Status Check
Please reply with

1. the Eset online scannner report


Thanks peku006

 

[grassman22]

Hi,

The reboot after the TFC cleanup got stuck, so I pressed restart.

I accidentally erased ESET before saving the log file but I saw in the report that it didn't find enything.

What can I do next?

Thnx,

Grassman22

 

[peku006]

Hi grassman22

not find any malware.....

Let's have a look at Windows Event Viewer. It might give us a clue as to what is causing these issues

Go to Start > Run - type in eventvwr <Press Enter>

You will see Application, Security & System listed in the left pane.

• In the left pane click on Application.
• Click the gray title "Type" at the top of the source name column in the right pane to sort by type name
• Look for "Error" & double-click on the most recent 10, and evaluate the event description for any indication of the cause of the problem.
• Make note of the Description, EventID and Source of these Event Properties.
• From the right pane, doubleclick on the line where it says error & you should get a window like the example below:
  
• 
• In the upper right corner of this picture, you should see 2 arrows. One is pointing up & the other, pointing down.
• There is another button below the 2 arrows. Click once on it. (this will copy some information to clipboard)
• Open notepad & paste the info in there. This will copy the event information to the clipboard. Paste the information for each event here

Thanks peku006

 

[grassman22]

Hi,

This is what I found:

‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Error
‏‏קטגוריית אירוע: (100)
‏‏מזהה אירוע: 1000
‏‏תאריך: 31/12/2009
‏‏שעה: 19:17:46
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏תקלה ביישום drwtsn32.exe, גירסה 5.1.2600.0, תקלה במודול dbghelp.dll, גירסה 5.1.2600.5512, כתובת התקלה 0x0001295d‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 64 72 77 ure drw
0018: 74 73 6e 33 32 2e 65 78 tsn32.ex
0020: 65 20 35 2e 31 2e 32 36 e 5.1.26
0028: 30 30 2e 30 20 69 6e 20 00.0 in
0030: 64 62 67 68 65 6c 70 2e dbghelp.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 35 35 31 2600.551
0048: 32 20 61 74 20 6f 66 66 2 at off
0050: 73 65 74 20 30 30 30 31 set 0001
0058: 32 39 35 64 295d


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Error
‏‏קטגוריית אירוע: ללא
‏‏מזהה אירוע: 1000
‏‏תאריך: 31/12/2009
‏‏שעה: 19:17:08
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏תקלה ביישום explorer.exe, גירסה 6.0.2900.5512, תקלה במודול comctl32.dll, גירסה 6.0.2900.5512, כתובת התקלה 0x0004dbd9‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 65 78 70 ure exp
0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
0028: 30 30 2e 35 35 31 32 20 00.5512
0030: 69 6e 20 63 6f 6d 63 74 in comct
0038: 6c 33 32 2e 64 6c 6c 20 l32.dll
0040: 36 2e 30 2e 32 39 30 30 6.0.2900
0048: 2e 35 35 31 32 20 61 74 .5512 at
0050: 20 6f 66 66 73 65 74 20 offset
0058: 30 30 30 34 64 62 64 39 0004dbd9
0060: 0d 0a ..


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Error
‏‏קטגוריית אירוע: ללא
‏‏מזהה אירוע: 1000
‏‏תאריך: 18/12/2009
‏‏שעה: 19:17:10
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏תקלה ביישום crazy browser.exe, גירסה 3.0.0.0, תקלה במודול wmvcore.dll, גירסה 10.0.0.3802, כתובת התקלה 0x0000cd02‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 63 72 61 ure cra
0018: 7a 79 20 62 72 6f 77 73 zy brows
0020: 65 72 2e 65 78 65 20 33 er.exe 3
0028: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0030: 6e 20 77 6d 76 63 6f 72 n wmvcor
0038: 65 2e 64 6c 6c 20 31 30 e.dll 10
0040: 2e 30 2e 30 2e 33 38 30 .0.0.380
0048: 32 20 61 74 20 6f 66 66 2 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 63 64 30 32 0d 0a cd02..


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Error
‏‏קטגוריית אירוע: ללא
‏‏מזהה אירוע: 1000
‏‏תאריך: 18/12/2009
‏‏שעה: 18:44:42
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏תקלה ביישום crazy browser.exe, גירסה 3.0.0.0, תקלה במודול quartz.dll, גירסה 6.5.2600.5822, כתובת התקלה 0x0003af9e‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 63 72 61 ure cra
0018: 7a 79 20 62 72 6f 77 73 zy brows
0020: 65 72 2e 65 78 65 20 33 er.exe 3
0028: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0030: 6e 20 71 75 61 72 74 7a n quartz
0038: 2e 64 6c 6c 20 36 2e 35 .dll 6.5
0040: 2e 32 36 30 30 2e 35 38 .2600.58
0048: 32 32 20 61 74 20 6f 66 22 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 33 61 66 39 65 0d 0a 3af9e..


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Hang
‏‏קטגוריית אירוע: (101)
‏‏מזהה אירוע: 1002
‏‏תאריך: 21/11/2009
‏‏שעה: 22:46:09
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏יישום לא מגיב Crazy Browser.exe, גירסה 3.0.0.0, מודול חוסר תגובה hungapp, גירסה 0.0.0.0, כתובת חוסר תגובה 0x00000000‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 43 72 61 7a 79 20 Crazy
0018: 42 72 6f 77 73 65 72 2e Browser.
0020: 65 78 65 20 33 2e 30 2e exe 3.0.
0028: 30 2e 30 20 69 6e 20 68 0.0 in h
0030: 75 6e 67 61 70 70 20 30 ungapp 0
0038: 2e 30 2e 30 2e 30 20 61 .0.0.0 a
0040: 74 20 6f 66 66 73 65 74 t offset
0048: 20 30 30 30 30 30 30 30 0000000
0050: 30 0


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Hang
‏‏קטגוריית אירוע: (101)
‏‏מזהה אירוע: 1002
‏‏תאריך: 21/11/2009
‏‏שעה: 22:46:07
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏יישום לא מגיב Crazy Browser.exe, גירסה 3.0.0.0, מודול חוסר תגובה hungapp, גירסה 0.0.0.0, כתובת חוסר תגובה 0x00000000‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 43 72 61 7a 79 20 Crazy
0018: 42 72 6f 77 73 65 72 2e Browser.
0020: 65 78 65 20 33 2e 30 2e exe 3.0.
0028: 30 2e 30 20 69 6e 20 68 0.0 in h
0030: 75 6e 67 61 70 70 20 30 ungapp 0
0038: 2e 30 2e 30 2e 30 20 61 .0.0.0 a
0040: 74 20 6f 66 66 73 65 74 t offset
0048: 20 30 30 30 30 30 30 30 0000000
0050: 30 0


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Hang
‏‏קטגוריית אירוע: (101)
‏‏מזהה אירוע: 1002
‏‏תאריך: 18/11/2009
‏‏שעה: 14:14:31
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏יישום לא מגיב Crazy Browser.exe, גירסה 3.0.0.0, מודול חוסר תגובה hungapp, גירסה 0.0.0.0, כתובת חוסר תגובה 0x00000000‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 43 72 61 7a 79 20 Crazy
0018: 42 72 6f 77 73 65 72 2e Browser.
0020: 65 78 65 20 33 2e 30 2e exe 3.0.
0028: 30 2e 30 20 69 6e 20 68 0.0 in h
0030: 75 6e 67 61 70 70 20 30 ungapp 0
0038: 2e 30 2e 30 2e 30 20 61 .0.0.0 a
0040: 74 20 6f 66 66 73 65 74 t offset
0048: 20 30 30 30 30 30 30 30 0000000
0050: 30 0


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Hang
‏‏קטגוריית אירוע: (101)
‏‏מזהה אירוע: 1002
‏‏תאריך: 18/11/2009
‏‏שעה: 14:14:29
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏יישום לא מגיב Crazy Browser.exe, גירסה 3.0.0.0, מודול חוסר תגובה hungapp, גירסה 0.0.0.0, כתובת חוסר תגובה 0x00000000‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 43 72 61 7a 79 20 Crazy
0018: 42 72 6f 77 73 65 72 2e Browser.
0020: 65 78 65 20 33 2e 30 2e exe 3.0.
0028: 30 2e 30 20 69 6e 20 68 0.0 in h
0030: 75 6e 67 61 70 70 20 30 ungapp 0
0038: 2e 30 2e 30 2e 30 20 61 .0.0.0 a
0040: 74 20 6f 66 66 73 65 74 t offset
0048: 20 30 30 30 30 30 30 30 0000000
0050: 30 0


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Error
‏‏קטגוריית אירוע: ללא
‏‏מזהה אירוע: 1000
‏‏תאריך: 01/11/2009
‏‏שעה: 23:20:27
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏תקלה ביישום mobsync.exe, גירסה 5.1.2600.5512, תקלה במודול mshtml.dll, גירסה 6.0.2900.5848, כתובת התקלה 0x00069413‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6d 6f 62 ure mob
0018: 73 79 6e 63 2e 65 78 65 sync.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 6d 73 68 74 6d 6c n mshtml
0038: 2e 64 6c 6c 20 36 2e 30 .dll 6.0
0040: 2e 32 39 30 30 2e 35 38 .2900.58
0048: 34 38 20 61 74 20 6f 66 48 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 36 39 34 31 33 0d 0a 69413..


‏‏סוג אירוע: ‏‏שגיאה
‏‏מקור אירוע: Application Error
‏‏קטגוריית אירוע: ללא
‏‏מזהה אירוע: 1000
‏‏תאריך: 30/08/2009
‏‏שעה: 15:03:49
‏‏משתמש: ‏‏לא זמין
‏‏מחשב: DORON
‏‏תיאור:
‏‏תקלה ביישום crazy browser.exe, גירסה 3.0.0.0, תקלה במודול mshtml.dll, גירסה 6.0.2900.2180, כתובת התקלה 0x001f57fa‏.‏‏

לקבלת מידע נוסף, עיין במרכז העזרה והתמיכה ב- http://go.microsoft.com/fwlink/events.asp.
‏‏נתונים:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 63 72 61 ure cra
0018: 7a 79 20 62 72 6f 77 73 zy brows
0020: 65 72 2e 65 78 65 20 33 er.exe 3
0028: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0030: 6e 20 6d 73 68 74 6d 6c n mshtml
0038: 2e 64 6c 6c 20 36 2e 30 .dll 6.0
0040: 2e 32 39 30 30 2e 32 31 .2900.21
0048: 38 30 20 61 74 20 6f 66 80 at of
0050: 66 73 65 74 20 30 30 31 fset 001
0058: 66 35 37 66 61 0d 0a f57fa..



Thnx,

Grassman22

 

[peku006]

Hi Grassman22

At this stage your machine looks to be clean of malware, so the problems you are experiencing are not likely to be malware related. I think the best and fastest solution for you is to post on a PC troubleshooting forum like the Browsers, Internet & email forum at WhatTheTech. They specialize in handling problems like this so you are certain to get expert assistance and a speedy resolution is very likely.

I'm sorry that I could not be of more help to you, and I wish you the best of luck with solving your computer problems. If you have any questions or require any other assistance please let me know.

peku006

 

[grassman22]

Hi,

Ok I thank you very much for your time and assistance.

Will try at the forum you recommended.

Grassman22

 

[peku006]

Hi Grassman22

Your log now appears to be clean. Congratulations! :yahoo:

Download OTC by Old Timer and save it to your Desktop.

• Double-click OTC.exe
• Click the CleanUp! button
• Select Yes when the Begin cleanup Process? Prompt appears
• If you are prompted to Reboot during the cleanup, select Yes
• The tool will delete itself once it finishes, if not delete it by yourself

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP
This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.
• Reboot.

Turn ON System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

This will remove all restore points except the new one you just created.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Here are some things that I think are worth having a look at if you don't already know a bout them:.

Spybot Search and Destroy
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

FireTrust SiteHound
You can find information and download it from here

MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.


Happy safe surfing! :bigthumb:

peku006

 

[grassman22]

Hi,

Thnx again for all the help and tips. I just want to ask about something that I noticed that maybe can give us a clue about the problem. In Task Manager>Proceses I fround that an application called vsmon.exe is grabbing more than 19,000KB of VM. Avgrsx.exe also grabs a similer amount. From what I found on the web, I understand it is not normal. Do you know enything on how to fix this?

Thnx,

Grassman22

 

[peku006]

Hi Grassman22

I do not know why they use so much Ram

maybe you find something help on these pages

ZoneAlarm User Community.

AVG Forum

peku006