DeadPoetic, IE crashing!

skywalker45skywalker45 Bloomington, IN. USA
edited November 2006 in Spyware & Virus Removal
DeadPoetic,

Please post your Hijack This log in the next reply.

Comments

  • DeadPoeticDeadPoetic
    edited October 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 6:04:51 PM, on 10/9/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\ups.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Common Files\{B081CD3D-0574-1033-0314-021102010001}\Update.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\mspaint.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
    O4 - Startup: desktop(2).ini
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: desktop(2).ini
    O4 - Global Startup: Kaspersky Anti-Hacker(2)(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O4 - Global Startup: Kaspersky Anti-Hacker(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Louis Vargas\Start Menu\Programs\IMVU\Run IMVU.lnk
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://heislegendx.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151353940671
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Could you please do me a favor. Could you visit Jotti's and upload the following file/files for analysis. Please post back with the results from Jotti's:

    C:\Program Files\Common Files\{B081CD3D-0574-1033-0314-021102010001}\Update.exe
  • DeadPoeticDeadPoetic
    edited October 2006
    I've also been getting this virusaz5.jpg is it bad?
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    OK. Upload that file to Jotti's then we'll do a different kind of scan on your machine.
  • DeadPoeticDeadPoetic
    edited October 2006
    File: Update.exe
    Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
    MD5 9061ff7f08797a3a71799b7390f216c1
    Packers detected: -
    Scanner results
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found nothing
    ClamAV Found nothing
    Dr.Web Found nothing
    F-Prot Antivirus Found nothing
    Fortinet Found nothing
    Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.Softomate.u
    NOD32 Found nothing
    Norman Virus Control Found nothing
    UNA Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    OK. Follow the instructions below:

    Make sure that you can see hidden files and folders: (Windows XP).
    • Click "Start".
    • Click "My Computer".
    • Select the "Tools" menu and click "Folder Options".
    • Select the "View" tab.
    • Under the "Hidden files and folders" heading, select "Show hidden files and folders".
    • Uncheck the "Hide protected operating system files (recommended)" option.
    • Click "Yes" to confirm.
    • Uncheck the "Hide file extensions for known file types".
    • Click "OK".

    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.

    Use Windows Explorer to delete the following:

    C:\Program Files\Common Files\{B081CD3D-0574-1033-0314-021102010001}<---This folder.

    Reboot into normal mode and post a fresh Hijack This log. Once we've done this I'll have you run a Housecall scan.
  • DeadPoeticDeadPoetic
    edited October 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 12:10:29 AM, on 10/10/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\ups.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
    O4 - Startup: desktop(2).ini
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: desktop(2).ini
    O4 - Global Startup: Kaspersky Anti-Hacker(2)(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O4 - Global Startup: Kaspersky Anti-Hacker(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Louis Vargas\Start Menu\Programs\IMVU\Run IMVU.lnk
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://heislegendx.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151353940671
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    The intrusion alert you are receiving is for the slammer worm. This worm normally infects only PC's running MS SQL server so it could be a false positive. How is IE running now?

    Could you visit the site below (with Firefox) and run a Trend Micro Housecall scan. Post back the results into this thread. Allow the scan to delete whatever it finds:

    http://housecall65.trendmicro.com/

    Be sure to post back the results of the Housecall scan.
  • DeadPoeticDeadPoetic
    edited October 2006
    i was in the middle of doing the scan on firefox and it closed both windows i had up.
  • DeadPoeticDeadPoetic
    edited October 2006
    wth...i'm trying to run the scan on both browsers and it crashes.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    We've been seeing that a lot lately with the housecall scan. I'm not sure what's causing it. I'll think on this awhile and we'll probably do another scan just to be safe. Is IE still closing by itself? We may try rolling back to the other version of Java to see if it crashes there as well. I'll be back on later.
  • DeadPoeticDeadPoetic
    edited October 2006
    Hey skywalker...IE is running good so far..Umm i've been getting this blue screen from time to time.. i dont know why but here what it says..

    Error caused by a device driver

    Thank you for sending an error report to Microsoft.

    Error report summary

    Error type : Windows stop error (A message appears on a blue screen with error code information)
    Solution available? : No (see Next steps)
    What does this error mean? : Windows has encountered an error from which it cannot recover and needs to restart
    Cause : Unknown device driver
    Computer symptoms : A message appears on a blue screen with error code information (for example: e.g. 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED)
    Additional steps for you to take : Important: Please continue to send error reports so analysts at Microsoft can study and try to correct the problem as quickly as possible

    Information about this error

    You received this message because a device driver installed on your computer caused the Windows operating system to stop unexpectedly. This type of error is referred to as a "stop error." A stop error requires you to restart your computer.

    Next steps

    We have analyzed your error report and at this time are unable to determine the exact cause of the error. However, Microsoft will continue to analyze this error report to try to determine the specific cause of the error. If we are able to find the cause and correct it, and you encounter the same problem, you will receive an updated response that includes instructions for resolving the problem.

    Article ID : 10
    Last Review : December 21, 2005
    Revision : 2.0
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Have you installed any new hardware lately or upgraded any type of device driver or software? These stop errors normally occur when a device driver malfunctions that causes Windows to become unstable. Typically they are not related to malware. I could point you in the direction of the Windows help forum if you would like. Can you tell me if you are performing any specific operations when this error occurs? We could use the event viewer to try to get a better idea of where the problem is occurring.
  • DeadPoeticDeadPoetic
    edited October 2006
    well i really dont know..and i normally run my daily things..like firefox,msn live,windows media player and all of a sudden that happens..it doesnt happen on a day to day basic..just normally sometimes. how can i find out what device i have recently installed because this has been happenning for few months now.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Give me some time to research the particular stop error that you posted above and I'll try to help determine what device driver might be causing this. If it's been happening for a few months you might need to think real hard about any changes you may have made, but there are also some programs we can run that can help us. I'll post back tomorrow.
    :)
  • skywalker45skywalker45 Bloomington, IN. USA
    edited November 2006
    Bump.
    :)

    Please post your Hijack This log DeadPoetic.
  • DeadPoeticDeadPoetic
    edited November 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 4:51:07 PM, on 11/4/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\ups.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    O4 - Startup: desktop(2).ini
    O4 - Global Startup: desktop(2).ini
    O4 - Global Startup: Kaspersky Anti-Hacker(2)(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O4 - Global Startup: Kaspersky Anti-Hacker(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Louis Vargas\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://heislegendx.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151353940671
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited November 2006
    Hi DeadPoetic! I would like you to run a program that will let me see what files have been created on your PC in the last few months. Plus it will fix some problems automatically if it detects them.

    Please follow the below instructions:
    • Download this file - combofix.exe
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log for you. Post that log in your next reply. If the log does not open automatically it can be found in C:\combofix.txt

      Note: Do not mouseclick combofix's window while it's running. That may cause it to stall
  • DeadPoeticDeadPoetic
    edited November 2006
    what you mean by "Note: Do not mouseclick combofix's window while it's running. That may cause it to stall" ?
  • DeadPoeticDeadPoetic
    edited November 2006
    i clicked the link and it took me to run to install so i did and it said Internet explorer - security warning. the publisher could not verified. are you sure you want to run this software. name : combofix.exe publisher: unknown publisher so i pressed run and some black window came out and few lil icons appeared on my desktop and then this blue window showed and then it wasnt there no more.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited November 2006
    It's OK. This is normal. It just means your security settings for Internet Explorer are set high. This is a good thing. You should be able to find the log from ComboFix at this location:

    C:\ComboFix.txt

    Right off the root directory. Post that here in your next reply and let me know if you have any problems.
  • DeadPoeticDeadPoetic
    edited November 2006
    Oh ok but i dont see in my Local disk (C:) and i tried to do it again and it wont work this time. am i doing something wrong? :banghead:
  • skywalker45skywalker45 Bloomington, IN. USA
    edited November 2006
    Please delete the file you currently have and try to download it again and run it. It's possible the file got corrupted in the download process. Download ComboFix.exe from my previous post and run it and post the log it generates.
  • DeadPoeticDeadPoetic
    edited November 2006
    Louis Vargas - 06-11-07 11:41:52.82 Service Pack 2
    ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Louis Vargas\Desktop"

    (((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\Program Files\Common Files\misc002
    C:\Program Files\Inetget2


    ((((((((((((((((((((((((((((((( Files Created from 2006-10-07 to 2006-11-07 ))))))))))))))))))))))))))))))))))


    2006-10-10 12:18 76,560 --a
    C:\WINDOWS\system32\drivers\tmcomm.sys


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


    2006-11-07 11:42
    d
    C:\Program Files\Common Files
    2006-11-06 20:44
    d
    C:\Program Files\Windows Live Safety Center
    2006-11-05 20:26
    d
    C:\Program Files\Hijackthis
    2006-11-05 16:19
    d
    C:\Program Files\Mozilla Firefox
    2006-11-05 00:54
    d
    C:\Program Files\MSN Messenger
    2006-11-02 17:06
    d
    C:\Documents and Settings\Louis Vargas\Application Data\dvdcss
    2006-10-24 13:24
    d
    C:\Program Files\Common Files\Adobe
    2006-10-18 19:05
    d
    C:\Program Files\Google
    2006-10-17 23:37
    d
    C:\Program Files\LimeWire
    2006-10-16 14:09
    d
    C:\Program Files\Online Services
    2006-10-14 19:06
    d
    C:\Documents and Settings\Louis Vargas\Application Data\IMVU
    2006-10-11 18:16
    d
    C:\Documents and Settings\Louis Vargas\Application Data\Adobe
    2006-10-10 16:04
    d
    C:\Documents and Settings\Louis Vargas\Application Data\AdobeUM
    2006-10-10 12:38
    d
    C:\Program Files\Internet Explorer
    2006-10-07 13:36
    d
    C:\Program Files\Common Files\Microsoft Shared
    2006-10-07 12:35
    d
    C:\Program Files\Java
    2006-10-06 10:53
    d
    C:\Program Files\Grisoft
    2006-10-05 22:31 115947 --a
    C:\WINDOWS\system32\mny.exe
    2006-10-04 21:30
    d
    C:\Documents and Settings\Louis Vargas\Application Data\Lavasoft
    2006-10-04 18:53
    d
    C:\Program Files\Common Files\Java
    2006-10-04 11:34 59536 --a
    C:\WINDOWS\system32\drivers\klin.sys
    2006-10-04 11:33 61072 --a
    C:\WINDOWS\system32\drivers\klick.sys
    2006-09-30 17:56 138862 --a
    C:\WINDOWS\mny.exe
    2006-09-27 13:06
    d
    C:\Documents and Settings\Louis Vargas\Application Data\MSNInstaller
    2006-09-19 12:16
    d
    C:\Program Files\Common Files\Services
    2006-09-16 18:59
    d
    C:\Program Files\NetMeeting
    2006-09-15 00:56
    d
    C:\Program Files\Windows Media Player
    2006-09-15 00:56
    d
    C:\Program Files\Windows Media Connect 2
    2006-09-13 19:18
    d
    C:\Program Files\AIM
    2006-09-07 16:33
    d
    C:\Documents and Settings\Louis Vargas\Application Data\Mozilla
    2006-09-07 09:05
    d--h
    C:\Program Files\InstallShield Installation Information
    2006-09-05 09:01 1212928 --a
    C:\WINDOWS\system32\Incinerator.dll
    2006-08-24 21:42 8704 --a
    C:\WINDOWS\system32\wdfmgr.exe
    2006-08-24 21:42 8704 --a
    C:\WINDOWS\system32\uwdf.exe
    2006-08-24 21:30 99840 --a
    C:\WINDOWS\system32\wmpshell.dll
    2006-08-24 21:30 990208 --a
    C:\WINDOWS\system32\drmv2clt.dll
    2006-08-24 21:30 937984 --a
    C:\WINDOWS\system32\wmnetmgr.dll
    2006-08-24 21:30 8337920 --a
    C:\WINDOWS\system32\wmploc.dll
    2006-08-24 21:30 790016
    C:\WINDOWS\system32\WMVSENCD.dll
    2006-08-24 21:30 757248 --a
    C:\WINDOWS\system32\WMADMOD.dll
    2006-08-24 21:30 7168 --a
    C:\WINDOWS\system32\asferror.dll
    2006-08-24 21:30 656896
    C:\WINDOWS\system32\WMVXENCD.dll
    2006-08-24 21:30 63488 --a
    C:\WINDOWS\system32\wpdmtpus.dll
    2006-08-24 21:30 629760 --a
    C:\WINDOWS\system32\wpd_ci.dll
    2006-08-24 21:30 611840
    C:\WINDOWS\system32\wmpmde.dll
    2006-08-24 21:30 603648 --a
    C:\WINDOWS\system32\WMSPDMOD.dll
    2006-08-24 21:30 537600 --a
    C:\WINDOWS\system32\blackbox.dll
    2006-08-24 21:30 532992
    C:\WINDOWS\system32\wmdrmsdk.dll
    2006-08-24 21:30 428032 --a
    C:\WINDOWS\system32\wmdrmdev.dll
    2006-08-24 21:30 414208 --a
    C:\WINDOWS\system32\msscp.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\wmvdmoe2.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\wmvdmod.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\WMVADVE.DLL
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\WMVADVD.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\wmsdmoe2.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\wmsdmod.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\wdfapi.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\MPG4DMOD.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\MP4SDMOD.dll
    2006-08-24 21:30 4096 --a
    C:\WINDOWS\system32\MP43DMOD.dll
    2006-08-24 21:30 37376 --a
    C:\WINDOWS\system32\wmdmps.dll
    2006-08-24 21:30 35840 --a
    C:\WINDOWS\system32\wpdconns.dll
    2006-08-24 21:30 349184 --a
    C:\WINDOWS\system32\wpdsp.dll
    2006-08-24 21:30 347648 --a
    C:\WINDOWS\system32\wmdrmnet.dll
    2006-08-24 21:30 33792 --a
    C:\WINDOWS\system32\wmdmlog.dll
    2006-08-24 21:30 320512 --a
    C:\WINDOWS\system32\mswmdm.dll
    2006-08-24 21:30 316928
    C:\WINDOWS\system32\MP4SDECD.dll
    2006-08-24 21:30 314368 --a
    C:\WINDOWS\system32\wmpdxm.dll
    2006-08-24 21:30 305152
    C:\WINDOWS\system32\MSDelta.dll
    2006-08-24 21:30 295424 --a
    C:\WINDOWS\system32\wmpeffects.dll
    2006-08-24 21:30 284160
    C:\WINDOWS\system32\PortableDeviceApi.dll
    2006-08-24 21:30 276480 --a
    C:\WINDOWS\system32\audiodev.dll
    2006-08-24 21:30 27648 --a
    C:\WINDOWS\system32\mspmsnsv.dll
    2006-08-24 21:30 259072
    C:\WINDOWS\system32\MPG4DECD.dll
    2006-08-24 21:30 2589184
    C:\WINDOWS\system32\WpdShext.dll
    2006-08-24 21:30 258560
    C:\WINDOWS\system32\MP43DECD.dll
    2006-08-24 21:30 2450944 --a
    C:\WINDOWS\system32\wmvcore.dll
    2006-08-24 21:30 242176 --a
    C:\WINDOWS\system32\wmpasf.dll
    2006-08-24 21:30 228352 --a
    C:\WINDOWS\system32\cewmdm.dll
    2006-08-24 21:30 227328 --a
    C:\WINDOWS\system32\wmerror.dll
    2006-08-24 21:30 222208 --a
    C:\WINDOWS\system32\wmasf.dll
    2006-08-24 21:30 211968
    C:\WINDOWS\system32\MFPLAT.dll
    2006-08-24 21:30 210432 --a
    C:\WINDOWS\system32\qasf.dll
    2006-08-24 21:30 204800 --a
    C:\WINDOWS\system32\wmpsrcwp.dll
    2006-08-24 21:30 198144
    C:\WINDOWS\system32\PortableDeviceWMDRM.dll
    2006-08-24 21:30 179712 --a
    C:\WINDOWS\system32\msnetobj.dll
    2006-08-24 21:30 175104 --a
    C:\WINDOWS\system32\mspmsp.dll
    2006-08-24 21:30 166912
    C:\WINDOWS\system32\PortableDeviceTypes.dll
    2006-08-24 21:30 1660416 --a
    C:\WINDOWS\system32\wmpencen.dll
    2006-08-24 21:30 157184 --a
    C:\WINDOWS\system32\wmidx.dll
    2006-08-24 21:30 154624 --a
    C:\WINDOWS\system32\wpdmtp.dll
    2006-08-24 21:30 1539584
    C:\WINDOWS\system32\WMVDECOD.dll
    2006-08-24 21:30 1532416
    C:\WINDOWS\system32\WMVENCOD.dll
    2006-08-24 21:30 1392128
    C:\WINDOWS\system32\WMVSDECD.dll
    2006-08-24 21:30 133120
    C:\WINDOWS\system32\WPDShServiceObj.dll
    2006-08-24 21:30 1327616 --a
    C:\WINDOWS\system32\WMSPDMOE.dll
    2006-08-24 21:30 132096
    C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
    2006-08-24 21:30 130048
    C:\WINDOWS\system32\wmpps.dll
    2006-08-24 21:30 11264 --a
    C:\WINDOWS\system32\LAPRXY.dll
    2006-08-24 21:30 1118208 --a
    C:\WINDOWS\system32\WMADMOE.dll
    2006-08-24 21:30 101888
    C:\WINDOWS\system32\PortableDeviceClassExtension.dll
    2006-08-24 19:31 100864 --a
    C:\WINDOWS\system32\logagent.exe
    2006-08-24 19:27 249344
    C:\WINDOWS\system32\drmupgds.exe
    2006-08-24 19:26 95288
    C:\WINDOWS\system32\WUDFCoinstaller.dll
    2006-08-24 19:26 17408
    C:\WINDOWS\system32\wpdshextautoplay.exe
    2006-08-24 18:19 316416
    C:\WINDOWS\system32\WUDFx.dll
    2006-08-24 18:19 145920
    C:\WINDOWS\system32\WudfHost.exe
    2006-08-24 18:18 56320
    C:\WINDOWS\system32\WudfSvc.dll
    2006-08-24 18:18 168448
    C:\WINDOWS\system32\WudfPlatform.dll
    2006-08-11 19:14 22752 --a
    C:\WINDOWS\system32\spupdsvc.exe


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

    *Note* empty entries are not shown

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
    "SMSystemAnalyzer"="\"C:\\Program Files\\iolo\\System Mechanic Professional 6\\SMSystemAnalyzer.exe\""
    "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "KAVPersonal50"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal\\kav.exe\" /minimize"
    "SystemGuardAlerter"="\"C:\\Program Files\\iolo\\System Mechanic Professional 6\\SystemGuardAlerter.exe\""
    "Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
    "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
    "ioloDelayModule"="C:\\Program Files\\iolo\\System Mechanic Professional 6\\delay.exe"
    "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
    65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
    "DeskHtmlVersion"=dword:00000110
    "DeskHtmlMinorVersion"=dword:00000005
    "Settings"=dword:00000001
    "GeneralFlags"=dword:00000001

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"
    "Flags"=dword:00000002
    "Position"=hex:2c,00,00,00,40,01,00,00,00,00,00,00,00,05,00,00,8e,04,00,00,00,\
    00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
    "CurrentState"=hex:04,00,00,40
    "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
    ff,ff,04,00,00,00
    "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
    00,00,01,00,00,00

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
    "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
    "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegedit"=dword:00000000

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000000

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "dontdisplaylastusername"=dword:00000000
    "legalnoticecaption"=""
    "legalnoticetext"=""
    "shutdownwithoutlogon"=dword:00000001
    "undockwithoutlogon"=dword:00000001

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
    "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

    Completion time: 06-11-07 11:43:52.03
    C:\ComboFix.txt ... 06-11-07 11:43
  • skywalker45skywalker45 Bloomington, IN. USA
    edited November 2006
    Give me awhile to look over and research this log DeadPoetic and I'll get back with you.
    :)
Sign In or Register to comment.