Sign In
Create Account
2
Recently I have been infected by rouge anti virus software. Security Pro and Windows Police Pro. I have deleted the files and run the steps on beepingcomputer and 2-spyware websites to remove Security Pro and Windows Police Pro. I finally got MBAM to install after running it in safe mode but it periodically is removed. I was told to post the logs on here in order to get help. I hope you guys can help me out!
Malwarebytes Log:
Malwarebytes' Anti-Malware 1.41
Database version: 3015
Windows 5.1.2600 Service Pack 3 (Safe Mode)
10/22/2009 10:54:06 PM
mbam-log-2009-10-22 (22-54-06).txt
Scan type: Full Scan (C:\|D:\|V:\|)
Objects scanned: 259843
Time elapsed: 1 hour(s), 11 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP526\A0088024.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP527\A0089451.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094022.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094023.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094024.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
HijackThis Log:
Malwarebytes' Anti-Malware 1.41
Database version: 3015
Windows 5.1.2600 Service Pack 3 (Safe Mode)
10/22/2009 10:54:06 PM
mbam-log-2009-10-22 (22-54-06).txt
Scan type: Full Scan (C:\|D:\|V:\|)
Objects scanned: 259843
Time elapsed: 1 hour(s), 11 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP526\A0088024.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP527\A0089451.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094022.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094023.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094024.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
If you guys could look at this for me it would be greatly appreciated. Its been like 4 days since my computer behaved normally!
-
This topic is locked
Back to top
#2
Posted 23 October 2009 - 04:01 AM
-
- Members
-
- 4 posts
New Member
AlexanderJT, on Oct 22 2009, 11:58 PM, said:
Recently I have been infected by rouge anti virus software. Security Pro and Windows Police Pro. I have deleted the files and run the steps on beepingcomputer and 2-spyware websites to remove Security Pro and Windows Police Pro. I finally got MBAM to install after running it in safe mode but it periodically is removed. I was told to post the logs on here in order to get help. I hope you guys can help me out!
Malwarebytes Log:
Malwarebytes' Anti-Malware 1.41
Database version: 3015
Windows 5.1.2600 Service Pack 3 (Safe Mode)
10/22/2009 10:54:06 PM
mbam-log-2009-10-22 (22-54-06).txt
Scan type: Full Scan (C:\|D:\|V:\|)
Objects scanned: 259843
Time elapsed: 1 hour(s), 11 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP526\A0088024.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP527\A0089451.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094022.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094023.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094024.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
HijackThis Log:
Malwarebytes' Anti-Malware 1.41
Database version: 3015
Windows 5.1.2600 Service Pack 3 (Safe Mode)
10/22/2009 10:54:06 PM
mbam-log-2009-10-22 (22-54-06).txt
Scan type: Full Scan (C:\|D:\|V:\|)
Objects scanned: 259843
Time elapsed: 1 hour(s), 11 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP526\A0088024.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP527\A0089451.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094022.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094023.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094024.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
If you guys could look at this for me it would be greatly appreciated. Its been like 4 days since my computer behaved normally!
Malwarebytes Log:
Malwarebytes' Anti-Malware 1.41
Database version: 3015
Windows 5.1.2600 Service Pack 3 (Safe Mode)
10/22/2009 10:54:06 PM
mbam-log-2009-10-22 (22-54-06).txt
Scan type: Full Scan (C:\|D:\|V:\|)
Objects scanned: 259843
Time elapsed: 1 hour(s), 11 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP526\A0088024.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP527\A0089451.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094022.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094023.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094024.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
HijackThis Log:
Malwarebytes' Anti-Malware 1.41
Database version: 3015
Windows 5.1.2600 Service Pack 3 (Safe Mode)
10/22/2009 10:54:06 PM
mbam-log-2009-10-22 (22-54-06).txt
Scan type: Full Scan (C:\|D:\|V:\|)
Objects scanned: 259843
Time elapsed: 1 hour(s), 11 minute(s), 39 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP526\A0088024.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP527\A0089451.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094022.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094023.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56C962A6-4C54-4057-822C-D86CD7D0B01B}\RP533\A0094024.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
If you guys could look at this for me it would be greatly appreciated. Its been like 4 days since my computer behaved normally!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:25:16 PM, on 10/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lxdicoms.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9a06bc0b-2d92-4c80-9a53-874b0bd96a70} - viveveno.dll (file missing)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {EC68066D-295A-47A9-8190-9D895B085690} - C:\WINDOWS\system32\jkkKeDWN.dll (file missing)
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"
O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1159386707859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1233106320593
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: c:\windows\system32\vivipedo.dll c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll c:\windows\system32\yuhisona.dll c:\windows\system32\wenunuve.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: fusekuzed - {e5d8ee8d-645a-4976-a246-ecf49c89da15} - c:\windows\system32\vivipedo.dll (file missing)
O21 - SSODL: diduyirez - {9c2449c7-70f9-47d9-b30a-8c3684b51f81} - c:\windows\system32\wenunuve.dll (file missing)
O21 - SSODL: tunupugin - {d81a8d44-6fc8-4317-afe2-e06c7e7b6307} - c:\windows\system32\yuhisona.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {e5d8ee8d-645a-4976-a246-ecf49c89da15} - c:\windows\system32\vivipedo.dll (file missing)
O22 - SharedTaskScheduler: gahurihor - {9c2449c7-70f9-47d9-b30a-8c3684b51f81} - c:\windows\system32\wenunuve.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {d81a8d44-6fc8-4317-afe2-e06c7e7b6307} - c:\windows\system32\yuhisona.dll (file missing)
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1ca51c9d15c6490) (gupdate1ca51c9d15c6490) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdiserv.exe
O23 - Service: lxdi_device - - C:\WINDOWS\system32\lxdicoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
--
End of file - 9402 bytes
#3
Posted 27 October 2009 - 06:10 AM
-
- Experts
-
- 1,227 posts
Elite Member
- Gender:Male
- Location:Finland
- Interests:Floorball, football, music, computers..
Hi,
Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
- When done, DDS will open two (2) logs:
- DDS.txt
- Attach.txt
- DDS.txt
- Save both reports to your desktop. Post them back to your topic.
Microsoft MVP Consumer Security 2008 2009 2010 2011
ASAP & UNITE member since 2006
ASAP & UNITE member since 2006
#4
Posted 27 October 2009 - 04:11 PM
-
- Members
-
- 4 posts
New Member
DDS (Ver_09-10-26.01) - NTFSx86
Run by Alexander at 12:07:32.01 on Tue 10/27/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1343 [GMT -4:00]
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\lxdicoms.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Alexander\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {9a06bc0b-2d92-4c80-9a53-874b0bd96a70} - viveveno.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {ec68066d-295a-47a9-8190-9d895b085690} - c:\windows\system32\jkkKeDWN.dll
TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\RegistryBooster.exe /S
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [AdobeBridge]
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [lxdimon.exe] "c:\program files\lexmark 3500-4500 series\lxdimon.exe"
mRun: [lxdiamon] "c:\program files\lexmark 3500-4500 series\lxdiamon.exe"
mRun: [FaxCenterServer] "c:\program files\\lexmark fax solutions\fm3032.exe" /s
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159386707859
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1233106320593
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\windows\system32\vivipedo.dllc:\windows\system32\yuhisona.dll c:\windows\system32\wenunuve.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: fusekuzed - {e5d8ee8d-645a-4976-a246-ecf49c89da15} - c:\windows\system32\vivipedo.dll
SSODL: diduyirez - {9c2449c7-70f9-47d9-b30a-8c3684b51f81} - c:\windows\system32\wenunuve.dll
SSODL: tunupugin - {d81a8d44-6fc8-4317-afe2-e06c7e7b6307} - c:\windows\system32\yuhisona.dll
STS: kupuhivus: {e5d8ee8d-645a-4976-a246-ecf49c89da15} - c:\windows\system32\vivipedo.dll
STS: gahurihor: {9c2449c7-70f9-47d9-b30a-8c3684b51f81} - c:\windows\system32\wenunuve.dll
STS: kupuhivus: {d81a8d44-6fc8-4317-afe2-e06c7e7b6307} - c:\windows\system32\yuhisona.dll
STS: FencesShlExt Class: {1984dd45-52cf-49cd-ab77-18f378fea264} - c:\program files\stardock\fences\FencesMenu.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\jkkKeDWN
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\alexan~1\applic~1\mozilla\firefox\profiles\qkicw7rt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-10-20 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-10-20 360584]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-23 108289]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-10-20 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-10-20 285392]
R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]
R3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\drivers\l251x86.sys [1980-1-1 29696]
S2 gupdate1ca51c9d15c6490;Google Update Service (gupdate1ca51c9d15c6490);c:\program files\google\update\GoogleUpdate.exe [2009-10-20 133104]
S2 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdiserv.exe [2008-1-6 99248]
=============== Created Last 30 ================
2009-10-25 20:15:03 0 d-----w- c:\docume~1\alexan~1\applic~1\Stardock
2009-10-25 20:15:00 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
2009-10-25 20:14:59 0 d-----w- c:\program files\Stardock
2009-10-24 18:07:29 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-24 18:07:28 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-23 16:34:59 2713 --sh--w- c:\windows\system32\zeguyoni.dll
2009-10-23 16:34:58 2713 --sh--w- c:\windows\system32\wuleketo.dll
2009-10-23 16:34:58 2713 --sh--w- c:\windows\system32\lejiwafe.exe
2009-10-23 15:17:00 0 d-----w- c:\program files\Avira
2009-10-23 15:17:00 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2009-10-23 04:34:53 2713 --sh--w- c:\windows\system32\tuneyevi.exe
2009-10-23 03:13:17 0 d-----w- c:\program files\Trend Micro
2009-10-23 02:57:11 0 d-----w- c:\windows\system32\%PersonalRootCertificateFolder%
2009-10-22 20:33:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-22 19:00:47 319456 ----a-w- c:\windows\system32\difxapi.dll
2009-10-22 15:38:09 0 d-----w- c:\docume~1\alexan~1\applic~1\Malwarebytes
2009-10-22 15:38:01 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-22 15:19:23 38224 ----a-w- c:\windows\system32\drivers\is-20AVB.tmp
2009-10-22 14:01:09 2713 --sh--w- c:\windows\system32\limepuye.dll
2009-10-22 14:01:09 2713 --sh--w- c:\windows\system32\kakekuze.dll
2009-10-20 04:50:02 0 d--h--w- C:\$AVG
2009-10-20 04:49:48 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-10-20 04:49:47 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-10-20 04:49:42 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-10-20 04:49:34 0 d-----w- c:\windows\system32\drivers\Avg
2009-10-20 04:49:31 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-10-20 04:49:09 0 d-----w- c:\program files\AVG
2009-10-20 04:49:04 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
2009-10-20 04:25:33 0 d-----w- c:\program files\common files\PC Tools
2009-10-20 03:46:56 0 d-----w- c:\program files\common files\Symantec Shared
2009-10-20 03:46:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Symantec
2009-10-20 03:46:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Norton
2009-10-20 03:46:04 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
2009-10-20 03:42:57 0 d-s---w- C:\ComboFix
2009-10-20 01:52:42 0 d-----w- c:\windows\system32\Adobe
2009-10-20 01:16:39 0 dc-h--w- c:\windows\ie8
2009-10-19 18:02:02 92 ----a-w- c:\windows\system32\wwp.htm
2009-10-19 11:56:35 0 d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2009-10-19 06:36:26 0 d-----w- c:\windows\pss
2009-10-19 06:27:47 0 d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2009-10-19 06:27:47 0 d-----w- c:\docume~1\alexan~1\applic~1\DAEMON Tools Lite
2009-10-19 06:27:46 0 d-----w- c:\docume~1\alexan~1\applic~1\Xfire
2009-10-19 06:27:38 0 d-----w- c:\docume~1\alexan~1\applic~1\FaxCtr
2009-10-15 23:42:44 0 d-----w- c:\program files\GRETECH
2009-10-15 23:41:42 0 d-sh--w- c:\documents and settings\alexander\IECompatCache
2009-10-09 15:38:46 23 ----a-w- c:\windows\BlendSettings.ini
2009-10-09 01:55:29 0 d-----w- c:\program files\1M Edition
2009-10-08 16:08:36 0 d--h--w- C:\ad45-backup
2009-10-07 00:18:32 0 d-----w- c:\program files\DAEMON Tools Toolbar
2009-10-07 00:18:30 0 d-----w- c:\program files\DAEMON Tools Lite
2009-10-07 00:12:39 0 d-----w- c:\program files\DAEMON Tools Pro
==================== Find3M ====================
2009-10-07 00:07:31 722416 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-09-25 23:06:52 85169 ----a-w- c:\windows\War3Unin.dat
2009-09-25 22:20:28 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 14:18:39 136192 ------w- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 21:03:36 58880 ------w- c:\windows\system32\dllcache\msasn1.dll
2009-08-29 08:08:21 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-08-29 08:08:17 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\dllcache\strmdll.dll
2009-08-06 23:24:18 327896 ----a-w- c:\windows\system32\dllcache\wucltui.dll
2009-08-06 23:24:18 209632 ----a-w- c:\windows\system32\dllcache\wuweb.dll
2009-08-06 23:24:10 35552 ----a-w- c:\windows\system32\dllcache\wups.dll
2009-08-06 23:24:06 53472 ----a-w- c:\windows\system32\dllcache\wuauclt.exe
2009-08-06 23:24:04 96480 ----a-w- c:\windows\system32\dllcache\cdm.dll
2009-08-06 23:23:54 575704 ----a-w- c:\windows\system32\dllcache\wuapi.dll
2009-08-06 23:23:46 1929952 ----a-w- c:\windows\system32\dllcache\wuaueng.dll
2009-08-05 09:01:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 09:01:48 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-05 00:44:46 2189184 ----a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-08-04 15:13:08 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 15:13:08 2145280 ----a-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-08-04 14:20:09 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-08-04 14:20:09 2023936 ----a-w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-08-04 14:20:08 2066048 ----a-w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-07-31 19:23:10 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-19 17:59:23 52224 --sha-w- c:\windows\system32\gejekoyu.dll
2009-01-31 17:20:26 276881 --sha-w- c:\windows\system32\NWDeKkkj.ini2
2008-07-29 18:21:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008072920080730\index.dat
============= FINISH: 12:07:58.20 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-10-26.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 12/17/2007 7:28:39 PM
System Uptime: 10/27/2009 11:52:42 AM (1 hours ago)
Motherboard: ASUSTeK Computer INC. | | P5GC-MX
Processor: Intel® Core™2 Duo CPU E4500 @ 2.20GHz | LGA 775 | 2199/200mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 233 GiB total, 171.641 GiB free.
D: is CDROM ()
V: is CDROM ()
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP438: 7/31/2009 3:37:04 PM - System Checkpoint
RP439: 8/1/2009 4:26:01 PM - System Checkpoint
RP440: 8/2/2009 9:39:28 PM - System Checkpoint
RP441: 8/5/2009 4:17:08 PM - Software Distribution Service 3.0
RP442: 8/6/2009 6:45:40 PM - System Checkpoint
RP443: 8/7/2009 7:40:25 PM - System Checkpoint
RP444: 8/11/2009 3:53:45 PM - System Checkpoint
RP445: 8/12/2009 12:14:48 AM - Software Distribution Service 3.0
RP446: 8/13/2009 1:00:58 PM - System Checkpoint
RP447: 8/14/2009 11:03:22 PM - System Checkpoint
RP448: 8/17/2009 1:09:01 PM - System Checkpoint
RP449: 8/21/2009 7:16:48 PM - System Checkpoint
RP450: 8/22/2009 7:26:18 PM - System Checkpoint
RP451: 8/23/2009 8:16:30 PM - System Checkpoint
RP452: 8/23/2009 9:06:21 PM - Software Distribution Service 3.0
RP453: 8/24/2009 9:42:07 PM - System Checkpoint
RP454: 8/25/2009 11:11:56 PM - System Checkpoint
RP455: 8/26/2009 12:03:45 AM - Software Distribution Service 3.0
RP456: 8/27/2009 12:54:05 AM - System Checkpoint
RP457: 8/28/2009 10:52:25 AM - System Checkpoint
RP458: 8/29/2009 12:01:54 PM - System Checkpoint
RP459: 8/30/2009 6:35:26 PM - System Checkpoint
RP460: 9/1/2009 5:13:01 PM - System Checkpoint
RP461: 9/2/2009 6:10:28 PM - System Checkpoint
RP462: 9/3/2009 2:27:24 PM - Installed Post-itŪ Digital Notes
RP463: 9/3/2009 2:51:31 PM - Removed Post-itŪ Digital Notes
RP464: 9/3/2009 3:03:46 PM - Installed MSXML 4.0
RP465: 9/3/2009 3:03:52 PM - Installed MSXML 4.0
RP466: 9/3/2009 3:16:14 PM - Installed Alky for Applications (Windows XP)
RP467: 9/4/2009 3:42:23 PM - System Checkpoint
RP468: 9/5/2009 3:53:16 PM - System Checkpoint
RP469: 9/6/2009 5:46:44 PM - System Checkpoint
RP470: 9/7/2009 8:09:22 PM - System Checkpoint
RP471: 9/8/2009 8:56:09 PM - System Checkpoint
RP472: 9/8/2009 11:30:29 PM - Software Distribution Service 3.0
RP473: 9/10/2009 12:21:02 PM - System Checkpoint
RP474: 9/11/2009 1:57:35 PM - System Checkpoint
RP475: 9/12/2009 2:03:29 PM - System Checkpoint
RP476: 9/13/2009 2:24:55 PM - System Checkpoint
RP477: 9/15/2009 7:15:46 PM - System Checkpoint
RP478: 9/16/2009 7:54:44 PM - System Checkpoint
RP479: 9/17/2009 4:27:10 PM - Removed Project64 1.6
RP480: 9/18/2009 10:14:29 PM - System Checkpoint
RP481: 9/19/2009 10:42:58 PM - System Checkpoint
RP482: 9/21/2009 12:35:05 PM - System Checkpoint
RP483: 9/22/2009 3:02:27 PM - System Checkpoint
RP484: 9/23/2009 5:58:27 PM - System Checkpoint
RP485: 9/25/2009 4:29:44 PM - System Checkpoint
RP486: 9/26/2009 4:35:41 PM - System Checkpoint
RP487: 9/27/2009 5:14:45 PM - System Checkpoint
RP488: 9/28/2009 6:12:40 PM - System Checkpoint
RP489: 9/29/2009 6:35:07 PM - System Checkpoint
RP490: 9/30/2009 7:02:14 PM - System Checkpoint
RP491: 10/2/2009 2:22:15 PM - System Checkpoint
RP492: 10/3/2009 1:34:44 PM - Removed Oblivion
RP493: 10/3/2009 1:39:20 PM - Installed Oblivion
RP494: 10/3/2009 1:39:30 PM - Installed DirectX 9.0
RP495: 10/3/2009 1:56:57 PM - Installed Oblivion - Shivering Isles
RP496: 10/3/2009 2:03:17 PM - Installed DirectX 9.0
RP497: 10/3/2009 2:05:21 PM - Removed Oblivion
RP498: 10/3/2009 2:06:48 PM - Removed Oblivion - Horse Armor Pack
RP499: 10/3/2009 2:07:07 PM - Removed Oblivion - Knights of the Nine
RP500: 10/3/2009 2:08:12 PM - Removed Oblivion - Mehrunes Razor
RP501: 10/3/2009 2:08:58 PM - Removed Oblivion - Orrery
RP502: 10/3/2009 2:09:23 PM - Removed Oblivion - Spell Tomes
RP503: 10/3/2009 2:09:42 PM - Removed Oblivion - The Fighter's Stronghold
RP504: 10/3/2009 2:10:02 PM - Removed Oblivion - Thieves Den
RP505: 10/3/2009 2:10:25 PM - Removed Oblivion - Vile Lair
RP506: 10/3/2009 2:10:48 PM - Removed Oblivion - Wizard's Tower
RP507: 10/6/2009 12:57:36 PM - System Checkpoint
RP508: 10/6/2009 7:51:34 PM - Installed Risen
RP509: 10/6/2009 8:07:31 PM - SPTD setup V1.60
RP510: 10/7/2009 2:03:27 PM - Removed Risen
RP511: 10/8/2009 2:15:12 PM - System Checkpoint
RP512: 10/8/2009 9:55:28 PM - Installed Oblivion 1M Edition.
RP513: 10/8/2009 10:11:08 PM - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
RP514: 10/8/2009 10:12:09 PM - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
RP515: 10/9/2009 11:23:33 AM - Removed Oblivion 1M Edition.
RP516: 10/9/2009 11:26:07 AM - Installed Oblivion 1M Edition.
RP517: 10/10/2009 12:45:28 PM - System Checkpoint
RP518: 10/11/2009 6:43:59 PM - System Checkpoint
RP519: 10/12/2009 7:33:33 PM - System Checkpoint
RP520: 10/13/2009 9:07:15 PM - System Checkpoint
RP521: 10/15/2009 3:00:16 AM - Software Distribution Service 3.0
RP522: 10/16/2009 6:02:35 PM - System Checkpoint
RP523: 10/18/2009 6:18:17 PM - System Checkpoint
RP524: 10/19/2009 1:39:47 AM - Installed Windows Defender
RP525: 10/19/2009 2:54:24 AM - Installed Kaspersky Anti-Virus 2010.
RP526: 10/19/2009 8:05:09 AM - Installed Java™ 6 Update 15
RP527: 10/19/2009 5:53:04 PM - Removed Microsoft Office Enterprise 2007
RP528: 10/19/2009 9:17:46 PM - Installed Windows Internet Explorer 8.
RP529: 10/19/2009 9:32:11 PM - Installed Adobe Reader 7.0.9
RP530: 10/19/2009 9:44:01 PM - Installed Java™ 6 Update 16
RP531: 10/19/2009 10:24:49 PM - Removed Documents To Go
RP532: 10/20/2009 12:49:04 AM - Installed AVG Free 9.0
RP533: 10/22/2009 12:27:28 PM - System Checkpoint
RP534: 10/22/2009 9:42:03 PM - Removed Alky for Applications (Windows XP)
RP535: 10/23/2009 11:07:56 AM - Avg8 Update
RP536: 10/23/2009 11:08:44 AM - Avg8 Update
RP537: 10/23/2009 11:16:15 AM - Avira AntiVir Personal - 10/23/2009 11:16
RP538: 10/23/2009 3:52:49 PM - Removed Kaspersky Anti-Virus 2010.
RP539: 10/24/2009 3:58:36 PM - Software Distribution Service 3.0
RP540: 10/25/2009 4:16:38 PM - Software Distribution Service 3.0
RP541: 10/26/2009 5:20:18 PM - System Checkpoint
==== Installed Programs ======================
ABBYY FineReader 6.0 Sprint
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS3
Adobe Device Central CS4
Adobe Drive CS4
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS4
Adobe InDesign CS4 Application Feature Set Files (Roman)
Adobe InDesign CS4 Common Base Files
Adobe InDesign CS4 Icon Handler
Adobe Linguistics CS3
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Reader 7.0.9
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe SGM CS4
Adobe Shockwave Player 11.5
Adobe SING CS4
Adobe Stock Photos CS3
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
AVG Free 9.0
Avira AntiVir Personal - Free Antivirus
Choice Guard
Connect
Critical Update for Windows Media Player 11 (KB959772)
DAEMON Tools Toolbar
Fences
GOM Player
Google Update Helper
Goombah Partner COM Server
Guild Wars
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946344)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB948127)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB951708)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Java™ 6 Update 16
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
kuler
Lexmark 3500-4500 Series
Lexmark Fax Solutions
Lexmark Toolbar
Linksys Wireless-G PCI Adapter
Malwarebytes' Anti-Malware
MediaShow 3.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Silverlight
Microsoft SQL Server 2008 Management Objects
Microsoft SQL Server Compact 3.5 SP1 Design Tools English
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
Mozilla Firefox (3.5.3)
MSVCRT
MSXML 4.0
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
NVIDIA Drivers
NVIDIA PhysX
Oblivion 1M Edition
Oblivion mod manager 1.1.12
PDF Settings CS4
Photoshop Camera Raw
Power2Go 4.0
PowerProducer
PowerStarter
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
SQL Server System CLR Types
Suite Shared Configuration CS4
System Requirements Lab
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Warcraft III: All Products
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Xfire (remove only)
Xilisoft Video Converter Ultimate
Zune Desktop Theme
==== Event Viewer Messages From Past Week ========
10/24/2009 2:05:21 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio AvgLdx86 AvgMfx86 avipbb Fips intelppm ssmdrv
10/22/2009 9:38:26 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 Fips intelppm kl1 klbg KLIF
10/22/2009 8:45:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
10/22/2009 8:04:36 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
10/22/2009 4:41:41 PM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 b0f6a0d4, parameter3 f78f6418, parameter4 f78f6114.
10/22/2009 2:09:57 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service.
10/22/2009 11:20:16 AM, error: Service Control Manager [7034] - The AVG Free WatchDog service terminated unexpectedly. It has done this 2 time(s).
10/22/2009 11:20:14 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
10/22/2009 11:20:12 AM, error: Service Control Manager [7034] - The WMP54Gv4SVC service terminated unexpectedly. It has done this 1 time(s).
10/22/2009 11:20:12 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
10/22/2009 11:20:12 AM, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
10/22/2009 11:12:17 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgMfx86
10/22/2009 11:11:10 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the lxdiCATSCustConnectService service to connect.
10/22/2009 11:11:10 AM, error: Service Control Manager [7000] - The WDefend service failed to start due to the following error: The system cannot find the file specified.
10/22/2009 11:11:10 AM, error: Service Control Manager [7000] - The lxdiCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/22/2009 11:11:10 AM, error: Service Control Manager [7000] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service failed to start due to the following error: The system cannot find the file specified.
10/22/2009 10:08:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
10/22/2009 1:51:46 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/22/2009 1:51:32 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio AvgLdx86 AvgMfx86 avipbb Fips intelppm kl1 klbg KLIF ssmdrv
10/20/2009 6:00:19 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
==== End Of File ===========================
Run by Alexander at 12:07:32.01 on Tue 10/27/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1343 [GMT -4:00]
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
============== Running Processes ===============
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\lxdicoms.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Alexander\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {9a06bc0b-2d92-4c80-9a53-874b0bd96a70} - viveveno.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {ec68066d-295a-47a9-8190-9d895b085690} - c:\windows\system32\jkkKeDWN.dll
TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\RegistryBooster.exe /S
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [AdobeBridge]
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [lxdimon.exe] "c:\program files\lexmark 3500-4500 series\lxdimon.exe"
mRun: [lxdiamon] "c:\program files\lexmark 3500-4500 series\lxdiamon.exe"
mRun: [FaxCenterServer] "c:\program files\\lexmark fax solutions\fm3032.exe" /s
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1159386707859
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1233106320593
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
AppInit_DLLs: c:\windows\system32\vivipedo.dllc:\windows\system32\yuhisona.dll c:\windows\system32\wenunuve.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: fusekuzed - {e5d8ee8d-645a-4976-a246-ecf49c89da15} - c:\windows\system32\vivipedo.dll
SSODL: diduyirez - {9c2449c7-70f9-47d9-b30a-8c3684b51f81} - c:\windows\system32\wenunuve.dll
SSODL: tunupugin - {d81a8d44-6fc8-4317-afe2-e06c7e7b6307} - c:\windows\system32\yuhisona.dll
STS: kupuhivus: {e5d8ee8d-645a-4976-a246-ecf49c89da15} - c:\windows\system32\vivipedo.dll
STS: gahurihor: {9c2449c7-70f9-47d9-b30a-8c3684b51f81} - c:\windows\system32\wenunuve.dll
STS: kupuhivus: {d81a8d44-6fc8-4317-afe2-e06c7e7b6307} - c:\windows\system32\yuhisona.dll
STS: FencesShlExt Class: {1984dd45-52cf-49cd-ab77-18f378fea264} - c:\program files\stardock\fences\FencesMenu.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\jkkKeDWN
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\alexan~1\applic~1\mozilla\firefox\profiles\qkicw7rt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-10-20 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-10-20 360584]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-23 108289]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2009-10-20 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2009-10-20 285392]
R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]
R3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\drivers\l251x86.sys [1980-1-1 29696]
S2 gupdate1ca51c9d15c6490;Google Update Service (gupdate1ca51c9d15c6490);c:\program files\google\update\GoogleUpdate.exe [2009-10-20 133104]
S2 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdiserv.exe [2008-1-6 99248]
=============== Created Last 30 ================
2009-10-25 20:15:03 0 d-----w- c:\docume~1\alexan~1\applic~1\Stardock
2009-10-25 20:15:00 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
2009-10-25 20:14:59 0 d-----w- c:\program files\Stardock
2009-10-24 18:07:29 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-24 18:07:28 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-23 16:34:59 2713 --sh--w- c:\windows\system32\zeguyoni.dll
2009-10-23 16:34:58 2713 --sh--w- c:\windows\system32\wuleketo.dll
2009-10-23 16:34:58 2713 --sh--w- c:\windows\system32\lejiwafe.exe
2009-10-23 15:17:00 0 d-----w- c:\program files\Avira
2009-10-23 15:17:00 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2009-10-23 04:34:53 2713 --sh--w- c:\windows\system32\tuneyevi.exe
2009-10-23 03:13:17 0 d-----w- c:\program files\Trend Micro
2009-10-23 02:57:11 0 d-----w- c:\windows\system32\%PersonalRootCertificateFolder%
2009-10-22 20:33:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-10-22 19:00:47 319456 ----a-w- c:\windows\system32\difxapi.dll
2009-10-22 15:38:09 0 d-----w- c:\docume~1\alexan~1\applic~1\Malwarebytes
2009-10-22 15:38:01 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-22 15:19:23 38224 ----a-w- c:\windows\system32\drivers\is-20AVB.tmp
2009-10-22 14:01:09 2713 --sh--w- c:\windows\system32\limepuye.dll
2009-10-22 14:01:09 2713 --sh--w- c:\windows\system32\kakekuze.dll
2009-10-20 04:50:02 0 d--h--w- C:\$AVG
2009-10-20 04:49:48 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-10-20 04:49:47 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-10-20 04:49:42 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-10-20 04:49:34 0 d-----w- c:\windows\system32\drivers\Avg
2009-10-20 04:49:31 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-10-20 04:49:09 0 d-----w- c:\program files\AVG
2009-10-20 04:49:04 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
2009-10-20 04:25:33 0 d-----w- c:\program files\common files\PC Tools
2009-10-20 03:46:56 0 d-----w- c:\program files\common files\Symantec Shared
2009-10-20 03:46:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Symantec
2009-10-20 03:46:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Norton
2009-10-20 03:46:04 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
2009-10-20 03:42:57 0 d-s---w- C:\ComboFix
2009-10-20 01:52:42 0 d-----w- c:\windows\system32\Adobe
2009-10-20 01:16:39 0 dc-h--w- c:\windows\ie8
2009-10-19 18:02:02 92 ----a-w- c:\windows\system32\wwp.htm
2009-10-19 11:56:35 0 d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2009-10-19 06:36:26 0 d-----w- c:\windows\pss
2009-10-19 06:27:47 0 d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Lite
2009-10-19 06:27:47 0 d-----w- c:\docume~1\alexan~1\applic~1\DAEMON Tools Lite
2009-10-19 06:27:46 0 d-----w- c:\docume~1\alexan~1\applic~1\Xfire
2009-10-19 06:27:38 0 d-----w- c:\docume~1\alexan~1\applic~1\FaxCtr
2009-10-15 23:42:44 0 d-----w- c:\program files\GRETECH
2009-10-15 23:41:42 0 d-sh--w- c:\documents and settings\alexander\IECompatCache
2009-10-09 15:38:46 23 ----a-w- c:\windows\BlendSettings.ini
2009-10-09 01:55:29 0 d-----w- c:\program files\1M Edition
2009-10-08 16:08:36 0 d--h--w- C:\ad45-backup
2009-10-07 00:18:32 0 d-----w- c:\program files\DAEMON Tools Toolbar
2009-10-07 00:18:30 0 d-----w- c:\program files\DAEMON Tools Lite
2009-10-07 00:12:39 0 d-----w- c:\program files\DAEMON Tools Pro
==================== Find3M ====================
2009-10-07 00:07:31 722416 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-09-25 23:06:52 85169 ----a-w- c:\windows\War3Unin.dat
2009-09-25 22:20:28 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-11 14:18:39 136192 ------w- c:\windows\system32\dllcache\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 21:03:36 58880 ------w- c:\windows\system32\dllcache\msasn1.dll
2009-08-29 08:08:21 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-08-29 08:08:17 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\dllcache\strmdll.dll
2009-08-06 23:24:18 327896 ----a-w- c:\windows\system32\dllcache\wucltui.dll
2009-08-06 23:24:18 209632 ----a-w- c:\windows\system32\dllcache\wuweb.dll
2009-08-06 23:24:10 35552 ----a-w- c:\windows\system32\dllcache\wups.dll
2009-08-06 23:24:06 53472 ----a-w- c:\windows\system32\dllcache\wuauclt.exe
2009-08-06 23:24:04 96480 ----a-w- c:\windows\system32\dllcache\cdm.dll
2009-08-06 23:23:54 575704 ----a-w- c:\windows\system32\dllcache\wuapi.dll
2009-08-06 23:23:46 1929952 ----a-w- c:\windows\system32\dllcache\wuaueng.dll
2009-08-05 09:01:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 09:01:48 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-05 00:44:46 2189184 ----a-w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-08-04 15:13:08 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 15:13:08 2145280 ----a-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-08-04 14:20:09 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-08-04 14:20:09 2023936 ----a-w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-08-04 14:20:08 2066048 ----a-w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-07-31 19:23:10 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-19 17:59:23 52224 --sha-w- c:\windows\system32\gejekoyu.dll
2009-01-31 17:20:26 276881 --sha-w- c:\windows\system32\NWDeKkkj.ini2
2008-07-29 18:21:39 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008072920080730\index.dat
============= FINISH: 12:07:58.20 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-10-26.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 12/17/2007 7:28:39 PM
System Uptime: 10/27/2009 11:52:42 AM (1 hours ago)
Motherboard: ASUSTeK Computer INC. | | P5GC-MX
Processor: Intel® Core™2 Duo CPU E4500 @ 2.20GHz | LGA 775 | 2199/200mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 233 GiB total, 171.641 GiB free.
D: is CDROM ()
V: is CDROM ()
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP438: 7/31/2009 3:37:04 PM - System Checkpoint
RP439: 8/1/2009 4:26:01 PM - System Checkpoint
RP440: 8/2/2009 9:39:28 PM - System Checkpoint
RP441: 8/5/2009 4:17:08 PM - Software Distribution Service 3.0
RP442: 8/6/2009 6:45:40 PM - System Checkpoint
RP443: 8/7/2009 7:40:25 PM - System Checkpoint
RP444: 8/11/2009 3:53:45 PM - System Checkpoint
RP445: 8/12/2009 12:14:48 AM - Software Distribution Service 3.0
RP446: 8/13/2009 1:00:58 PM - System Checkpoint
RP447: 8/14/2009 11:03:22 PM - System Checkpoint
RP448: 8/17/2009 1:09:01 PM - System Checkpoint
RP449: 8/21/2009 7:16:48 PM - System Checkpoint
RP450: 8/22/2009 7:26:18 PM - System Checkpoint
RP451: 8/23/2009 8:16:30 PM - System Checkpoint
RP452: 8/23/2009 9:06:21 PM - Software Distribution Service 3.0
RP453: 8/24/2009 9:42:07 PM - System Checkpoint
RP454: 8/25/2009 11:11:56 PM - System Checkpoint
RP455: 8/26/2009 12:03:45 AM - Software Distribution Service 3.0
RP456: 8/27/2009 12:54:05 AM - System Checkpoint
RP457: 8/28/2009 10:52:25 AM - System Checkpoint
RP458: 8/29/2009 12:01:54 PM - System Checkpoint
RP459: 8/30/2009 6:35:26 PM - System Checkpoint
RP460: 9/1/2009 5:13:01 PM - System Checkpoint
RP461: 9/2/2009 6:10:28 PM - System Checkpoint
RP462: 9/3/2009 2:27:24 PM - Installed Post-itŪ Digital Notes
RP463: 9/3/2009 2:51:31 PM - Removed Post-itŪ Digital Notes
RP464: 9/3/2009 3:03:46 PM - Installed MSXML 4.0
RP465: 9/3/2009 3:03:52 PM - Installed MSXML 4.0
RP466: 9/3/2009 3:16:14 PM - Installed Alky for Applications (Windows XP)
RP467: 9/4/2009 3:42:23 PM - System Checkpoint
RP468: 9/5/2009 3:53:16 PM - System Checkpoint
RP469: 9/6/2009 5:46:44 PM - System Checkpoint
RP470: 9/7/2009 8:09:22 PM - System Checkpoint
RP471: 9/8/2009 8:56:09 PM - System Checkpoint
RP472: 9/8/2009 11:30:29 PM - Software Distribution Service 3.0
RP473: 9/10/2009 12:21:02 PM - System Checkpoint
RP474: 9/11/2009 1:57:35 PM - System Checkpoint
RP475: 9/12/2009 2:03:29 PM - System Checkpoint
RP476: 9/13/2009 2:24:55 PM - System Checkpoint
RP477: 9/15/2009 7:15:46 PM - System Checkpoint
RP478: 9/16/2009 7:54:44 PM - System Checkpoint
RP479: 9/17/2009 4:27:10 PM - Removed Project64 1.6
RP480: 9/18/2009 10:14:29 PM - System Checkpoint
RP481: 9/19/2009 10:42:58 PM - System Checkpoint
RP482: 9/21/2009 12:35:05 PM - System Checkpoint
RP483: 9/22/2009 3:02:27 PM - System Checkpoint
RP484: 9/23/2009 5:58:27 PM - System Checkpoint
RP485: 9/25/2009 4:29:44 PM - System Checkpoint
RP486: 9/26/2009 4:35:41 PM - System Checkpoint
RP487: 9/27/2009 5:14:45 PM - System Checkpoint
RP488: 9/28/2009 6:12:40 PM - System Checkpoint
RP489: 9/29/2009 6:35:07 PM - System Checkpoint
RP490: 9/30/2009 7:02:14 PM - System Checkpoint
RP491: 10/2/2009 2:22:15 PM - System Checkpoint
RP492: 10/3/2009 1:34:44 PM - Removed Oblivion
RP493: 10/3/2009 1:39:20 PM - Installed Oblivion
RP494: 10/3/2009 1:39:30 PM - Installed DirectX 9.0
RP495: 10/3/2009 1:56:57 PM - Installed Oblivion - Shivering Isles
RP496: 10/3/2009 2:03:17 PM - Installed DirectX 9.0
RP497: 10/3/2009 2:05:21 PM - Removed Oblivion
RP498: 10/3/2009 2:06:48 PM - Removed Oblivion - Horse Armor Pack
RP499: 10/3/2009 2:07:07 PM - Removed Oblivion - Knights of the Nine
RP500: 10/3/2009 2:08:12 PM - Removed Oblivion - Mehrunes Razor
RP501: 10/3/2009 2:08:58 PM - Removed Oblivion - Orrery
RP502: 10/3/2009 2:09:23 PM - Removed Oblivion - Spell Tomes
RP503: 10/3/2009 2:09:42 PM - Removed Oblivion - The Fighter's Stronghold
RP504: 10/3/2009 2:10:02 PM - Removed Oblivion - Thieves Den
RP505: 10/3/2009 2:10:25 PM - Removed Oblivion - Vile Lair
RP506: 10/3/2009 2:10:48 PM - Removed Oblivion - Wizard's Tower
RP507: 10/6/2009 12:57:36 PM - System Checkpoint
RP508: 10/6/2009 7:51:34 PM - Installed Risen
RP509: 10/6/2009 8:07:31 PM - SPTD setup V1.60
RP510: 10/7/2009 2:03:27 PM - Removed Risen
RP511: 10/8/2009 2:15:12 PM - System Checkpoint
RP512: 10/8/2009 9:55:28 PM - Installed Oblivion 1M Edition.
RP513: 10/8/2009 10:11:08 PM - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
RP514: 10/8/2009 10:12:09 PM - Removed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
RP515: 10/9/2009 11:23:33 AM - Removed Oblivion 1M Edition.
RP516: 10/9/2009 11:26:07 AM - Installed Oblivion 1M Edition.
RP517: 10/10/2009 12:45:28 PM - System Checkpoint
RP518: 10/11/2009 6:43:59 PM - System Checkpoint
RP519: 10/12/2009 7:33:33 PM - System Checkpoint
RP520: 10/13/2009 9:07:15 PM - System Checkpoint
RP521: 10/15/2009 3:00:16 AM - Software Distribution Service 3.0
RP522: 10/16/2009 6:02:35 PM - System Checkpoint
RP523: 10/18/2009 6:18:17 PM - System Checkpoint
RP524: 10/19/2009 1:39:47 AM - Installed Windows Defender
RP525: 10/19/2009 2:54:24 AM - Installed Kaspersky Anti-Virus 2010.
RP526: 10/19/2009 8:05:09 AM - Installed Java™ 6 Update 15
RP527: 10/19/2009 5:53:04 PM - Removed Microsoft Office Enterprise 2007
RP528: 10/19/2009 9:17:46 PM - Installed Windows Internet Explorer 8.
RP529: 10/19/2009 9:32:11 PM - Installed Adobe Reader 7.0.9
RP530: 10/19/2009 9:44:01 PM - Installed Java™ 6 Update 16
RP531: 10/19/2009 10:24:49 PM - Removed Documents To Go
RP532: 10/20/2009 12:49:04 AM - Installed AVG Free 9.0
RP533: 10/22/2009 12:27:28 PM - System Checkpoint
RP534: 10/22/2009 9:42:03 PM - Removed Alky for Applications (Windows XP)
RP535: 10/23/2009 11:07:56 AM - Avg8 Update
RP536: 10/23/2009 11:08:44 AM - Avg8 Update
RP537: 10/23/2009 11:16:15 AM - Avira AntiVir Personal - 10/23/2009 11:16
RP538: 10/23/2009 3:52:49 PM - Removed Kaspersky Anti-Virus 2010.
RP539: 10/24/2009 3:58:36 PM - Software Distribution Service 3.0
RP540: 10/25/2009 4:16:38 PM - Software Distribution Service 3.0
RP541: 10/26/2009 5:20:18 PM - System Checkpoint
==== Installed Programs ======================
ABBYY FineReader 6.0 Sprint
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS3
Adobe Device Central CS4
Adobe Drive CS4
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS4
Adobe InDesign CS4 Application Feature Set Files (Roman)
Adobe InDesign CS4 Common Base Files
Adobe InDesign CS4 Icon Handler
Adobe Linguistics CS3
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Reader 7.0.9
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe SGM CS4
Adobe Shockwave Player 11.5
Adobe SING CS4
Adobe Stock Photos CS3
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
AVG Free 9.0
Avira AntiVir Personal - Free Antivirus
Choice Guard
Connect
Critical Update for Windows Media Player 11 (KB959772)
DAEMON Tools Toolbar
Fences
GOM Player
Google Update Helper
Goombah Partner COM Server
Guild Wars
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946344)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB948127)
Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB951708)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Java™ 6 Update 16
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
kuler
Lexmark 3500-4500 Series
Lexmark Fax Solutions
Lexmark Toolbar
Linksys Wireless-G PCI Adapter
Malwarebytes' Anti-Malware
MediaShow 3.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Silverlight
Microsoft SQL Server 2008 Management Objects
Microsoft SQL Server Compact 3.5 SP1 Design Tools English
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
Mozilla Firefox (3.5.3)
MSVCRT
MSXML 4.0
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
NVIDIA Drivers
NVIDIA PhysX
Oblivion 1M Edition
Oblivion mod manager 1.1.12
PDF Settings CS4
Photoshop Camera Raw
Power2Go 4.0
PowerProducer
PowerStarter
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
SQL Server System CLR Types
Suite Shared Configuration CS4
System Requirements Lab
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Warcraft III: All Products
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Xfire (remove only)
Xilisoft Video Converter Ultimate
Zune Desktop Theme
==== Event Viewer Messages From Past Week ========
10/24/2009 2:05:21 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio AvgLdx86 AvgMfx86 avipbb Fips intelppm ssmdrv
10/22/2009 9:38:26 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 Fips intelppm kl1 klbg KLIF
10/22/2009 8:45:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
10/22/2009 8:04:36 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
10/22/2009 4:41:41 PM, error: System Error [1003] - Error code 1000007e, parameter1 c0000005, parameter2 b0f6a0d4, parameter3 f78f6418, parameter4 f78f6114.
10/22/2009 2:09:57 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service.
10/22/2009 11:20:16 AM, error: Service Control Manager [7034] - The AVG Free WatchDog service terminated unexpectedly. It has done this 2 time(s).
10/22/2009 11:20:14 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
10/22/2009 11:20:12 AM, error: Service Control Manager [7034] - The WMP54Gv4SVC service terminated unexpectedly. It has done this 1 time(s).
10/22/2009 11:20:12 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
10/22/2009 11:20:12 AM, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
10/22/2009 11:12:17 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgMfx86
10/22/2009 11:11:10 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the lxdiCATSCustConnectService service to connect.
10/22/2009 11:11:10 AM, error: Service Control Manager [7000] - The WDefend service failed to start due to the following error: The system cannot find the file specified.
10/22/2009 11:11:10 AM, error: Service Control Manager [7000] - The lxdiCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/22/2009 11:11:10 AM, error: Service Control Manager [7000] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service failed to start due to the following error: The system cannot find the file specified.
10/22/2009 10:08:38 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
10/22/2009 1:51:46 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
10/22/2009 1:51:32 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avgio AvgLdx86 AvgMfx86 avipbb Fips intelppm kl1 klbg KLIF ssmdrv
10/20/2009 6:00:19 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
==== End Of File ===========================
Attached Files
-
Attach.txt 18.88K
8 downloads
-
DDS.txt 16.29K
41 downloads
#5
Posted 27 October 2009 - 04:14 PM
-
- Experts
-
- 1,227 posts
Elite Member
- Gender:Male
- Location:Finland
- Interests:Floorball, football, music, computers..
Hi,
You seem to have both AVG and Antivir installed there. Decide which one to keep. It's recommended to have one antivirus installed in one system only.
Please visit this webpage for download links, and instructions for running ComboFix tool:
http://www.bleepingc...to-use-combofix
Please ensure you read this guide carefully first.
Please continue as follows:
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New dds.txt log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
You seem to have both AVG and Antivir installed there. Decide which one to keep. It's recommended to have one antivirus installed in one system only.
Please visit this webpage for download links, and instructions for running ComboFix tool:
http://www.bleepingc...to-use-combofix
Please ensure you read this guide carefully first.
Please continue as follows:
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
- Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New dds.txt log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
Microsoft MVP Consumer Security 2008 2009 2010 2011
ASAP & UNITE member since 2006
ASAP & UNITE member since 2006
#6
Posted 04 November 2009 - 08:49 PM
-
- Administrators
-
- 22,559 posts
Forum Deity
- Gender:Male
- Location:US
Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.
Other members who need assistance please start your own topic in a new thread. Thanks!
The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.
Other members who need assistance please start your own topic in a new thread. Thanks!
The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.
1 user(s) are reading this topic
0 members, 1 guests, 0 anonymous users
