|
|
MaggieI
new user
Reg'd: Fri
Posts: 22
Loc: Perthshire, Scotland
|
|
I have been having regular blue screens recently all pointing to system files.Although I appear to have got on top of these, I still find the chkdsk utility running on startup and events from ntfs stating the volume is dirty.This has been happening for 10 days or so although not every day.I have run sfc /scannow and WD Diagnostics as well as the full gamut of chkdsk options, therefore I would be grateful if someone could check my HijackThis log.Thanks in advance.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:32 PM, on 13/10/09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\ClocX\ClocX.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Documents and Settings\Margaret\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/custo...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66008
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66008
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/custo...fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66008
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = %3clocal%3e:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O1 - Hosts: ]
O1 - Hosts: ]
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\PROGRA~1\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [ClocX] "C:\Program Files\ClocX\ClocX.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [eBayToolbar] "C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe"
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Margaret\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)
O9 - Extra 'Tools' menuitem: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.timecomputers.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: *.live.com
O15 - Trusted Zone: *.msn.com
O15 - Trusted Zone: *.passport.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/19211ac381d03f5f6815/netzip/RdxIE601.cab
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\570\G2AWinLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\570\g2aservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
--
End of file - 10228 bytes
|
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 31986
Loc: belfast
|
|
Rerun HJT,and put a checkmark beside these :-
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/custo...fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/custo...fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = %3clocal%3e:80
O1 - Hosts: ]
O1 - Hosts: ]
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/19211ac381d03f5f6815/netzip/RdxIE601.cab
now close all windows and browsers and click FIX CHECKED
then :-
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
--------------------
IF I HAVE SAVED YOU MONEY, PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST MALWARE.
 
When the only tool you own is a hammer, every problem begins to look like a nail. 
|
MaggieI
new user
Reg'd: Fri
Posts: 22
Loc: Perthshire, Scotland
|
|
Sorry for the slow reply and thank you very much for your time.I will do as you suggest and let you know how it goes.
|
MaggieI
new user
Reg'd: Fri
Posts: 22
Loc: Perthshire, Scotland
|
|
Have run ComboFix.Here are my logs for it and Hijack This-
ComboFix 09-10-16.01 - Margaret 16/10/09 17:33.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.479.113 [GMT 1:00]
Running from: c:\documents and settings\Margaret\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Margaret\Application Data\inst.exe
c:\recycled\Dc3
c:\windows\Installer\10c224e.msi
c:\windows\Installer\141a6ba.msi
c:\windows\Installer\1acbd48.msi
c:\windows\Installer\29b9e.msi
c:\windows\Installer\2f541b.msp
c:\windows\Installer\375d60c.msi
c:\windows\Installer\41df4.msi
c:\windows\Installer\4cc6b.msp
c:\windows\Installer\4cc71.msp
c:\windows\Installer\5ebb67.msp
c:\windows\Installer\6e2767.msp
c:\windows\Installer\74bb34.msi
c:\windows\Installer\76b037.msi
c:\windows\Installer\92849.msi
c:\windows\Installer\960e57.msp
c:\windows\Installer\cb0f69.msi
c:\windows\Installer\e4528.msi
c:\windows\Installer\WMEncoder.msi
c:\windows\patch.exe
c:\windows\system32\Data
c:\windows\system32\ipflr.dll
c:\windows\system32\Process.exe
c:\windows\system32\zip32.dll
.
((((((((((((((((((((((((( Files Created from 2009-09-16 to 2009-10-16 )))))))))))))))))))))))))))))))
.
2009-10-13 21:55 . 2009-10-13 21:55 -------- d-----w- c:\program files\Trend Micro
2009-10-02 11:53 . 2009-10-02 11:54 -------- d-----w- c:\program files\Defraggler
2009-09-29 14:32 . 2009-09-29 14:40 70280 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter.sys
2009-09-29 14:32 . 2009-08-14 11:44 32552 ----a-w- c:\windows\system32\drivers\pctNdis-DNS.sys
2009-09-29 14:32 . 2009-07-29 08:54 46592 ----a-w- c:\windows\system32\drivers\pctNdis.sys
2009-09-29 13:53 . 2009-09-29 13:53 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-29 13:33 . 2008-10-31 06:09 270888 ----a-r- c:\windows\system32\drivers\SbFw.sys
2009-09-29 13:33 . 2008-06-21 03:54 65576 ----a-w- c:\windows\system32\drivers\SbFwIm.sys
2009-09-24 15:00 . 2009-10-04 14:14 -------- d-----w- C:\$AVG8.VAULT$
2009-09-24 14:40 . 2009-09-24 14:40 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-09-24 14:40 . 2009-09-24 14:40 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-09-24 14:40 . 2009-10-16 14:04 -------- d-----w- c:\windows\system32\drivers\Avg
2009-09-24 14:40 . 2009-09-24 14:40 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-09-24 14:40 . 2009-09-24 14:40 -------- d-----w- c:\program files\AVG
2009-09-24 14:40 . 2009-09-24 14:40 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-20 14:55 . 2009-10-16 16:26 -------- d-----w- c:\documents and settings\Margaret\Application Data\Orbit
2009-09-20 14:55 . 2009-09-20 14:56 -------- d-----w- c:\program files\Orbitdownloader
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-16 14:13 . 2007-06-22 23:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-14 21:18 . 2004-12-14 17:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-14 16:32 . 2008-08-22 19:23 2285056 ----a-w- c:\windows\system32\TUKernel.exe
2009-10-13 21:14 . 2009-07-15 19:03 -------- d-----w- c:\documents and settings\Margaret\Application Data\ZipGenius
2009-10-13 21:14 . 2009-02-03 16:45 -------- d-----w- c:\documents and settings\Margaret\Application Data\XnView
2009-10-06 11:46 . 2007-09-07 15:26 -------- d-----w- c:\program files\Replay AV 8
2009-10-02 14:49 . 2007-08-08 15:52 -------- d-----w- c:\program files\Ashampoo
2009-10-01 07:43 . 2008-08-28 22:40 -------- d-----w- c:\program files\PC Tools Firewall Plus
2009-09-29 14:40 . 2009-01-23 16:10 115088 ----a-w- c:\windows\system32\drivers\pctplfw.sys
2009-09-29 14:40 . 2009-09-29 14:40 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat
2009-09-29 14:40 . 2009-01-23 16:11 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-09-29 14:40 . 2009-09-29 14:40 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat
2009-09-29 14:40 . 2009-01-23 16:11 87656 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-09-29 14:38 . 2008-08-28 22:43 -------- d-----w- c:\documents and settings\Margaret\Application Data\PCToolsFirewallPlus
2009-09-29 13:37 . 2008-08-28 22:40 -------- d-----w- c:\program files\Common Files\PC Tools
2009-09-28 14:58 . 2007-09-19 19:28 -------- d-----w- c:\program files\Lexmark X1100 Series
2009-09-22 18:01 . 2008-04-29 15:17 -------- d-----w- c:\program files\Real Alternative
2009-09-22 18:01 . 2008-03-29 14:30 -------- d-----w- c:\program files\Recolored
2009-09-22 18:01 . 2005-05-17 20:32 -------- d-----w- c:\program files\Send To Toys
2009-09-22 18:01 . 2007-09-07 19:04 -------- d-----w- c:\program files\Replay Screencast
2009-09-22 18:01 . 2007-09-07 18:00 -------- d-----w- c:\program files\Replay Media Splitter
2009-09-22 18:01 . 2007-09-07 17:51 -------- d-----w- c:\program files\Replay Music 2
2009-09-22 18:01 . 2006-12-26 14:18 -------- d-----w- c:\program files\Avanquest update
2009-09-22 18:01 . 2005-07-14 16:48 -------- d-----w- c:\program files\ClocX
2009-09-19 14:19 . 2004-12-14 17:28 -------- d-----w- c:\program files\DivX
2009-09-19 14:18 . 2009-04-26 13:00 -------- d-----w- c:\program files\DSP-worx
2009-09-15 16:54 . 2009-09-15 16:54 -------- d-----w- c:\program files\Common Files\Apple
2009-09-15 16:53 . 2009-09-15 16:53 -------- d-----w- c:\program files\QuickTime
2009-09-15 16:53 . 2009-06-18 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-09-11 17:20 . 2009-06-15 17:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-11 14:18 . 2002-09-23 09:03 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 13:54 . 2009-06-15 17:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 13:53 . 2009-06-15 17:44 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-09 19:57 . 2008-03-31 22:03 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-08 22:01 . 2008-10-26 20:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-08 22:00 . 2009-09-08 22:00 -------- d-----w- c:\program files\Java
2009-09-08 19:19 . 2009-09-08 19:19 -------- d-----w- c:\program files\FLV-Media Player
2009-09-05 23:16 . 2009-03-20 21:37 -------- d-----w- c:\program files\VS Revo Group
2009-09-04 21:03 . 2002-09-23 09:03 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-02 19:38 . 2009-09-02 19:37 -------- d-----w- c:\program files\SimpleOCR
2009-08-29 08:08 . 2004-01-21 16:16 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 15:55 . 2009-07-26 21:39 -------- d-----w- c:\program files\Glary Utilities
2009-08-26 08:00 . 2002-09-23 09:04 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-24 13:05 . 2009-01-23 16:11 206256 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-08-23 20:42 . 2008-03-25 15:39 -------- d-----w- c:\program files\Easy Video Downloader
2009-08-22 15:07 . 2005-02-05 20:41 188872 ----a-w- c:\documents and settings\Margaret\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-21 22:50 . 2009-08-21 22:50 -------- d-----w- c:\program files\MSBuild
2009-08-21 22:50 . 2009-08-21 22:50 -------- d-----w- c:\program files\Reference Assemblies
2009-08-20 19:23 . 2009-07-15 19:02 -------- d-----w- c:\program files\ZipGenius 6
2009-08-20 18:52 . 2009-08-20 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\IMSI
2009-08-20 18:52 . 2009-08-19 17:50 -------- d-----w- c:\program files\IMSI
2009-08-19 17:49 . 2009-08-19 17:49 -------- d-----w- c:\documents and settings\Margaret\Application Data\IMSI
2009-08-06 18:24 . 2005-02-14 20:32 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 18:24 . 2005-02-14 20:32 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 18:24 . 2005-06-25 19:18 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 18:24 . 2005-02-14 21:09 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 18:24 . 2004-12-14 18:14 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 18:24 . 2002-09-23 09:02 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 18:23 . 2005-02-14 20:32 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 18:23 . 2005-06-26 13:50 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 18:23 . 2005-05-26 04:19 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 18:23 . 2004-12-14 18:14 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2002-12-12 00:14 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 18:52 . 2009-08-04 18:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 15:13 . 2002-08-29 01:04 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2002-08-29 01:04 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-07-31 19:15 . 2009-07-31 19:15 0 ----a-w- c:\windows\nsreg.dat
2007-02-19 20:07 . 2007-02-19 20:07 16 ----a-w- c:\program files\Common Files\dht342
2005-07-11 17:37 . 2005-07-11 17:37 774144 ----a-w- c:\program files\RngInterstitial.dll
2007-03-09 08:12 . 2007-03-09 08:12 27648 --sha-w- c:\windows\system32\AVSredirect.dll
2005-06-26 23:32 . 2006-05-08 19:07 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-22 06:37 . 2006-05-24 18:37 45568 --sha-r- c:\windows\system32\cygz.dll
2008-08-25 18:59 . 2008-08-25 18:59 88 --sha-r- c:\windows\system32\FAA4C1407E.sys
2008-08-25 18:59 . 2008-08-25 18:59 848 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2009-01-09 16:13 583312 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2009-01-09 16:13 583312 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2009-01-09 16:13 583312 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SansaDispatch"="c:\documents and settings\Margaret\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-06-14 79872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ClocX"="c:\program files\ClocX\ClocX.exe" [2005-01-26 270336]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"eBayToolbar"="c:\program files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2009-01-18 632048]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-09-29 2971608]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2009-01-09 669840]
"CTSysVol"="c:\program files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-07 2023704]
"VTPreset"="VTPreset.exe" - c:\windows\system32\VTPreset.exe [2004-02-24 45056]
"SbUsb AudCtrl"="sbusbdll.dll" - c:\windows\system32\sbusbdll.dll [2004-09-28 122368]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 01000000
"NoNetworkConnections"= 01000000
"NoNetConnectDisconnect"= 1 (0x1)
"nosimplestartmenu"= 0 (0x0)
"norecentdochistory"= 0 (0x0)
"maxrecentdocs"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-05-29 14:07 16680 ----a-w- c:\program files\Citrix\GoToAssist\570\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-24 14:40 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\E:\0autocheck autochk *
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [24/09/09 03:40 PM 335240]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [23/01/09 05:11 PM 229304]
R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [29/09/09 02:33 PM 270888]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [24/09/09 03:40 PM 297752]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [23/01/09 05:11 PM 87656]
R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [29/09/09 03:32 PM 32552]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [29/09/09 03:32 PM 70280]
R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [29/09/09 03:32 PM 46592]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [23/01/09 05:10 PM 115088]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [29/09/09 02:33 PM 65576]
R3 sbusb;TOSHIBA Multimedia Center Driver(Powered by Creative);c:\windows\system32\drivers\sbusb.sys [30/09/04 04:56 AM 1631104]
S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\drivers\ADM851X.SYS [19/12/03 06:44 AM 22144]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [25/06/09 10:45 PM 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [25/06/09 10:45 PM 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [25/06/09 10:45 PM 42112]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25/01/07 07:31 PM 42000]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
S3 USBCamera;DigitalCam Pro Still Camera Device;c:\windows\system32\Drivers\Bulk536.sys --> c:\windows\system32\Drivers\Bulk536.sys [?]
S3 viafilter;VIA USB Filter;c:\windows\system32\Drivers\viausb1.sys --> c:\windows\system32\Drivers\viausb1.sys [?]
S4 gupdate1c98b9047e2eb58;Google Update Service (gupdate1c98b9047e2eb58);c:\program files\Google\Update\GoogleUpdate.exe [10/02/09 04:00 PM 133104]
--- Other Services/Drivers In Memory ---
*Deregistered* - uphcleanhlp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2009-10-16 c:\windows\Tasks\User_Feed_Synchronization-{C1F72F47-B4AB-4FAB-860E-D14DB13A30CF}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 04:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Settings,ProxyOverride = 127.0.0.1;<local>
IE:
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: eBay Search - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
IE: { - c:\program files\Messenger\msmsgs.exe
IE: {{8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO
Trusted Zone: hotmail.com
Trusted Zone: live.com
Trusted Zone: microsoft.com
Trusted Zone: motive.com\pbttbc.bt
Trusted Zone: msn.com
Trusted Zone: passport.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
SafeBoot-aawservice
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-16 17:44
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
SansaDispatch = c:\documents and settings\Margaret\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?latform=&is-debug=&rom-version=&part-number=&product-name=&content-class=common_content&?ili
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-406358168-3226082595-1510670577-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1448)
c:\program files\Citrix\GoToAssist\570\G2AWinLogon.dll
- - - - - - - > 'lsass.exe'(1504)
c:\windows\system32\relog_ap.dll
.
Completion time: 2009-10-16 17:49
ComboFix-quarantined-files.txt 2009-10-16 16:49
Pre-Run: 36,754,890,240 bytes free
Post-Run: 36,772,982,784 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /FASTDETECT /TUTag=8D8H3T /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition (TuneUp Backup)" /FASTDETECT /TUTag=8D8H3T-BAK
295 --- E O F --- 2009-10-14 16:15
and next-
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:54:43 PM, on 16/10/09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66008
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66008
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/custo...fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\PROGRA~1\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [ClocX] "C:\Program Files\ClocX\ClocX.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [eBayToolbar] "C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe"
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Toshiba\TOSHIBA Multimedia Center\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Margaret\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)
O9 - Extra 'Tools' menuitem: MS-KB - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.timecomputers.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: *.live.com
O15 - Trusted Zone: *.msn.com
O15 - Trusted Zone: *.passport.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\570\G2AWinLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\570\g2aservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
--
End of file - 8301 bytes
Please note the reference to Comodo Firewall - this has not been on my system for months!Appreciating your assistance,
Margaret
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 31986
Loc: belfast
|
|
there must be some of the comodo files still about, hopefully the cleanup will remove them.
that looks clean now, just some tidying up to do.
combofix cleanup.
Time for some housekeeping
- Click START then RUN
- Now type Combofix /u in the runbox and click OK
[list] 
When shown the disclaimer, Select "2"[/list]
The above procedure will:
- Delete the following:[list]
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.[/list]
Then :-
Download and scan with CCleaner - CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation.
IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbar-free or Slim versions instead of the Standard Build.
- Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"
Then select "Cookies"
Move any cookies you wish to retain, e.g. login cookies, in the left-hand window to the right-hand window by highlighting them and clicking the right arrow in the centre.
- Then select the items you wish to clean up.
In the Windows Tab:
• Clean all entries in the "Internet Explorer" section.
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.
In the Applications Tab:
• Clean all entries in the Mozilla Firefox Section.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.
- Click the "Run Cleaner" button.
- A pop up box will appear advising this process will permanently delete files from your system.
- Click "OK" and it will scan and clean your system.
- Click "exit" when done.
then DEFRAG your C:\ drive.
to help speed up your system.
then let us know how the computer is running.
HOW DID I GET INFECTED
--------------------
IF I HAVE SAVED YOU MONEY, PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST MALWARE.
When the only tool you own is a hammer, every problem begins to look like a nail.
|
MaggieI
new user
Reg'd: Fri
Posts: 22
Loc: Perthshire, Scotland
|
|
Dear Bricat,
Computer continued to run well after the clean-up yesterday.However within 5 minutes of starting up today I had a blue screen :-
Memory_Management 0x0000001a caused by Ntfs.sys (address Ntfs.sys+254c8) according to BlueScreenView.
Could this be a RAM problem - I only have 512Mb on this pc.Also in EventViewer the accompanying message appears -
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 17/10/09
Time: 02:18:19 PM
User: N/A
Computer: DRACULA
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module wscsvc.dll, version 5.1.2600.5512, fault address 0x00009803.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 77 73 63 73 76 63 n wscsvc
0038: 2e 64 6c 6c 20 35 2e 31 .dll 5.1
0040: 2e 32 36 30 30 2e 35 35 .2600.55
0048: 31 32 20 61 74 20 6f 66 12 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 30 39 38 30 33 09803
Then this in System Events -
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7032
Date: 17/10/09
Time: 02:21:32 PM
User: N/A
Computer: DRACULA
Description:
The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error:
An instance of the service is already running.
I notice Chkdsk has been scheduled to run again at next boot.
As always, I'd really appreciate your help..
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 31986
Loc: belfast
|
|
I'm not really an expert in this area, but it looks to me like a memory fault,
you have 512mb ram
is this 2 x 256mb sticks ?
if it is, try removing one of the sticks, if you still get the blue screen swap the sticks over.
this should tell you if one of the sticks is faulty.
--------------------
IF I HAVE SAVED YOU MONEY, PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST MALWARE.
When the only tool you own is a hammer, every problem begins to look like a nail.
|
MaggieI
new user
Reg'd: Fri
Posts: 22
Loc: Perthshire, Scotland
|
|
I might give Memtest a run and see if it comes up with anything.Yes, it is 2x256 sticks.I've just had a series of event id1003s from System Error.It's like you can easily overload the system now.I'll let you know how I get on, but may be in a few days - family duty calls! Thanks in the meantime,
Margaret
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 31986
Loc: belfast
|
|
good luck, let us know how you go.
--------------------
IF I HAVE SAVED YOU MONEY, PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST MALWARE.
When the only tool you own is a hammer, every problem begins to look like a nail.
|
MaggieI
new user
Reg'd: Fri
Posts: 22
Loc: Perthshire, Scotland
|
|
Hi Bricat,
just to let you know that the ntfs problem has definitely been cleared up and thanks very much for that.I did have another bsod yesterday but I believe I have tracked down the errant driver that's been causing that and all is running well today.
While I was clearing up and checking for the comodo entries, I noticed several entries in the registry for "Legacy Drivers" for security software I have tried previously.Am I right in assuming these are safe to remove (or in fact, that it is preferable to remove them)?
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 31986
Loc: belfast
|
|
If the drivers aren't causing any problems i would leave them as they are, sometimes the drivers are connected to more than one program.
glad everything is sorted.
--------------------
IF I HAVE SAVED YOU MONEY, PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST MALWARE.
When the only tool you own is a hammer, every problem begins to look like a nail.
|
MaggieI
new user
Reg'd: Fri
Posts: 22
Loc: Perthshire, Scotland
|
|
Thanks for the advice and again for your help,
Margaret
|
bricat
HijackThis Helper
Reg'd: Wed
Posts: 31986
Loc: belfast
|
|
Happy to help, and thank you for the Donation, it is much appreciated.
--------------------
IF I HAVE SAVED YOU MONEY, PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST MALWARE.
When the only tool you own is a hammer, every problem begins to look like a nail.
|
|
|
Previous
Index
Next
Threaded
Edit
Reply
Quote
