88 replies to this topic

[ko57]

Got one this time...
Larry, still had a time shutting down Avast, finally right clicked in task mgr then shut down through that. CFix still showed it was on-2 warnings, but proceeded. Avast is still not showing in task manager but it has not showed then reappeared before.
________________

ComboFix 12-05-10.02 - Kerry Owen 05/10/2012 7:47.4.1 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2014.1705 [GMT -5:00]
Running from: c:\documents and settings\Kerry Owen\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
c:\documents and settings\Kerry Owen\Local Settings\Application Data\assembly\tmp
c:\documents and settings\Kerry Owen\WINDOWS
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EPSONSTATUSAGENT2
-------\Service_EPSONStatusAgent2
.
.
((((((((((((((((((((((((( Files Created from 2012-04-10 to 2012-05-10 )))))))))))))))))))))))))))))))
.
.
2012-05-09 23:50 . 2012-05-09 23:51 -------- d-----w- c:\documents and settings\Patience
2012-05-09 19:17 . 2012-05-09 19:17 -------- d-----w- c:\windows\LastGood.Tmp
2012-05-09 17:25 . 2012-05-09 17:25 399264 ----a-w- c:\windows\unhide.exe
2012-05-08 22:43 . 2012-05-08 22:44 -------- d-----w- c:\documents and settings\Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-05 06:05 . 2012-04-05 06:05 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-05 06:05 . 2011-05-19 14:44 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 20:56 . 2010-09-20 05:53 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-06 23:15 . 2010-09-21 03:43 41184 ----a-w- c:\windows\avastSS.scr
2012-03-06 23:15 . 2008-09-24 18:48 201352 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-06 23:03 . 2011-03-02 20:09 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-06 23:03 . 2008-09-24 18:48 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-06 23:02 . 2008-09-24 18:48 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-03-06 23:01 . 2008-09-24 18:48 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-06 23:01 . 2008-09-24 18:48 95704 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-03-06 23:01 . 2008-09-24 18:48 89048 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-03-06 23:01 . 2008-09-24 18:48 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-03-06 22:58 . 2008-09-24 18:48 24920 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-03-01 11:01 . 2004-08-04 08:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-08-04 08:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-03-01 11:01 . 2004-08-04 08:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2004-08-04 08:00 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2004-08-04 08:00 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17 . 2004-08-04 08:00 385024 ------w- c:\windows\system32\html.iec
2009-07-17 06:07 . 2009-07-17 06:07 1228041 ----a-w- c:\program files\InstallFreeRARExtractFrog.exe
2008-10-12 20:31 . 2007-07-10 21:08 6224944 ----a-w- c:\program files\pkreader.exe
2008-10-10 13:41 . 2007-01-04 17:53 5186048 ----a-w- c:\program files\WindowsDefender.msi
2008-09-28 15:40 . 2008-09-28 15:40 1018520 ----a-w- c:\program files\fsbl.exe
2007-07-10 15:16 . 2007-07-10 15:16 158352 ----a-w- c:\program files\FixWebHancer.exe
2007-07-09 20:26 . 2007-07-09 20:26 4307808 ----a-w- c:\program files\vrle.exe
2007-02-14 18:28 . 2007-02-14 18:27 1655856 ----a-w- c:\program files\cspro367.exe
2007-01-08 20:47 . 2007-01-08 20:47 6427936 ----a-w- c:\program files\screensaverfunpack.exe
2007-01-08 19:35 . 2007-01-08 19:34 1506400 ----a-w- c:\program files\WinColorSetup.exe
2005-06-04 07:11 . 2005-06-04 07:11 6526608 ----a-w- c:\program files\MicrosoftAntiSpywareInstall.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 123536 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cpqset"="ÜæB" [X]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-09-18 290816]
"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 19968]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-09-26 185640]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-06-05 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
c:\documents and settings\Kerry Owen\Start Menu\Programs\Startup\
Mobiletel.lnk - [N/A]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON Status Monitor 3 Environment Check 2.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check 2.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Kerry Owen^Start Menu^Programs^Startup^BHODemon 2.0.lnk]
path=c:\documents and settings\Kerry Owen\Start Menu\Programs\Startup\BHODemon 2.0.lnk
backup=c:\windows\pss\BHODemon 2.0.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Kerry Owen^Start Menu^Programs^Startup^SCRABBLE Complete Registration.lnk]
path=c:\documents and settings\Kerry Owen\Start Menu\Programs\Startup\SCRABBLE Complete Registration.lnk
backup=c:\windows\pss\SCRABBLE Complete Registration.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Sonic RecordNow!"=
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"lxcemon.exe"="c:\program files\Lexmark 4300 Series\lxcemon.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Alwil Software\\Avast5\\AvastUI.exe"=
"c:\\Program Files\\Windows Lotto Pro 2000\\lotpro2000.exe"=
"c:\\Program Files\\Windows Lotto Pro 2000\\proupdt.exe"=
"c:\\Program Files\\Windows Lotto Pro 2000\\WiseUpdt.exe"=
"c:\\Program Files\\VisualRoute\\VisualRoute.exe"=
"c:\\gh\\lusetup.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Adobe\\Photoshop 5.0 LE\\photosle.exe"=
.
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/14/2008 12:07 PM 28544]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/2/2011 3:09 PM 612184]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [9/24/2008 1:48 PM 337880]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/24/2008 1:48 PM 20696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/26/2009 12:32 AM 189736]
S2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\Printer\Center\KodakSvc.exe [3/22/2007 7:04 PM 9728]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/20/2010 12:53 AM 654408]
S2 WebUpdate4;Web Update Wizard Service V4;c:\windows\system32\WebUpdateSvc4.exe [1/8/2009 4:34 AM 262360]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/5/2012 1:05 AM 253600]
S3 CH341SER;CH341SER;c:\windows\system32\drivers\CH341SER.SYS [5/14/2007 9:49 AM 35824]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/20/2010 12:53 AM 22344]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 06:05]
.
2012-05-10 c:\windows\Tasks\User_Feed_Synchronization-{A7D9F73D-0A0D-4E00-8E4A-12F300A9CE75}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:31]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = localhost:12080
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: foxsports.com\msn
Trusted Zone: meade.com\www
Trusted Zone: microsoft.com\www
Trusted Zone: msn.com\www
Trusted Zone: palmgear.com\trials
Trusted Zone: photographyreview.com\www
Trusted Zone: pogo.com\game3
Trusted Zone: wetcanvas.com\www
TCP: DhcpNameServer = 192.168.43.1
FF - ProfilePath - c:\documents and settings\Kerry Owen\Application Data\Mozilla\Firefox\Profiles\p57dvynm.default\
FF - prefs.js: browser.startup.homepage - http:msn.com
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\Alwil Software\Avast5\WebRep\FF
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Flagfox: {1018e4d6-728f-4b20-ad56-37578a4de76b} - %profile%\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF - Ext: AniWeather: {4176DFF4-4698-11DE-BEEB-45DA55D89593} - %profile%\extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593}
FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.00.13
.
- - - - ORPHANS REMOVED - - - -
.
ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file)
MSConfigStartUp-CTFMON - (no file)
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
AddRemove-{D32470A1-B10C-4059-BA53-CF0486F68EBC} - c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_190001_ff9ba27\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-10 08:07
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-781878022-3114317985-875658923-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1168)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2012-05-10 08:11:58
ComboFix-quarantined-files.txt 2012-05-10 13:11
.
Pre-Run: 37,292,036,096 bytes free
Post-Run: 37,252,333,568 bytes free
.
- - End Of File - - 0C2BC06863B718143622715DEE3B2169

[LDTate]

uInternet Settings,ProxyServer = localhost:12080

Did you set this up?
http://savemybutt.co...s-proxy-server/

Also let me know how it's running now.

[ko57]

No I did not set that up. I did not restart the pc, still in safe mode, but during Combo fix-toward or at the end of the scan, the window came up that shows pc is running in safe mode, and you click ok or yes, like after a restart. Clicked yes. A soft restart? I did get a PEV.EXE error at app. stage 49-50 of Combo Fix. I snapped a shot from my camera for that log location, Microsoft gave the 'you can send an error report' message' but I did not. Task manager still not showing Avast.

[LDTate]

Lets not worry about Avast.
Restart in Normal Mode anf run a new Combofix scan, post the results.

[ko57]

ok

[ko57]

Shut down-didn't hang, restarted. No icons, solid blue taskbar, ctrl-alt-del bring up task manager, 25 processes, tried create new task window-browse, its hanging-not responding. ctrl-alt-del to get task mgr attention, hourglass over cancel button re create new task window (not responding). Task mgr window relaxed, app window still showing not responding, hit end task, it doesn't, 0 cpu
usage.

[ko57]

Using cell phone to respond. By the way, I do appreciate all your help...

[LDTate]

Power it off and try it again

[ko57]

icons are there, more than half are regular, the others don't show picture but they are there. The tool bar was blue with start button shown and clock. while typing this went to screen saver, swiped mouse area on pc and it is now dark brown. hourglass appears over toolbar, move arrow over desktop. its ok.

[ko57]

swiped mouse area to bring back desktop and the toolbar was/is silid brown, no start button, no clock.

[ko57]

solid-sorry

[LDTate]

See if any of these help

1. Click Start, and then click Control Panel.
2. Double-click Display, click the Desktop tab, and then click Customize Desktop.
3. Select Restore Defaults


1. Click Start, and then click Control Panel.
2. Double-click Display, click the Desktop tab, and then click Customize Desktop.
then click the web tab, then under the web pages to display on your desktop
if it has "security" you uncheck this and delete



1. Right-click the desktop.
2. Point to Arrange Icons By.
3. Click Show Desktop Icons. ""



Open windows explorer (right click the Start button and click Explore)

At the top of windows explorer, click tools, folder options, click the
view tab
•check Display the contents of system folders
•check Show hidden files and folders
Click apply, click ok

Icons back?

[ko57]

Tool bar still solid brown, mouse arrow still turns to hourglass.

[LDTate]

Click Start> Run> type sfc /scannow Note the space.
(Note that there is a space between sfc and /scannow)

[ko57]

the start button like the clock disappeared, it is just a solid brown color where toolbar should be. tried clicking in area where start button should be, nothing. i tried ctrl alt del bring up task mgr-still low processes, closed window, mouse arrow still in hourglass mode, as in hanging.

[ko57]

desktop is dark, like in screen saver mode, hourglass. tried waking up-move mouse-didnt work. ctrl alt del brings up tsk mgr window, no desktop.

[LDTate]

Do you have your Windows OS CD?

[ko57]

Yes I do-Operating System cd. Also have an application and recovery Cd.

[LDTate]

We want to use the OS CD and do a repair Install

http://www.geekstogo...air-windows-xp/

[ko57]

Went to the website on pc-couldnt see whole post on phone. Fixing to start that now.