really slow computer

freshmeatfreshmeat
edited July 2007 in Spyware & Virus Removal
hey thanks for looking

my computer has been really slow for a while i scanned it with spybot and kaspersky.

heres my HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 3:45:04 AM, on 6/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\Program Files\AIM6\aim6.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Common Files\AOL\1146710535\ee\AOLSoftware.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
C:\Program Files\Lexmark 2400 Series\ezprint.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Folding@Home\winFAH.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Folding@Home\FahCore_78.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\ITE\Smart Guardian\ITESmart.exe
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146710535\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Folding@Home 5.03.lnk = ?
O4 - Startup: Registration Ghost Recon Advanced Warfighter.LNK = C:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\Support\Register\RegistrationReminder.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1145281192718
O16 - DPF: {6697AFA6-1CD3-462E-AC0A-363EF8BCD102} (SyScan2 Control) - http://www.evga.com/Support/SyScan/SyScan.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145313758812
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0673EA42-9760-429D-8ACB-D6EDBEE39A0F}: NameServer = 68.238.112.12,68.238.96.12
O17 - HKLM\System\CS1\Services\Tcpip\..\{0673EA42-9760-429D-8ACB-D6EDBEE39A0F}: NameServer = 68.238.112.12,68.238.96.12
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe

and my kaspersky: C:\Documents and Settings\Juan Barboza\Desktop\kaspersky.html

thanks for the help

Comments

  • Baabiouz
    edited July 2007
    Hi!

    Your log looks clean :)

    Let's run ATF-Cleaner and AVG Anti-Spyware:


    Please do the following...

    1. Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
    This program is for XP and Windows 2000 only!

    Double-click ATF Cleaner.exe to open it.

    Under Main select the following:
    • Windows Temp
    • Current User Temp
    • All Users Temp
    • Temporary Internet Files
    • Prefetch
    • Java Cache
    *The other boxes are optional*
    Then click the Empty Selected button.

    Click Exit on the Main menu to close the program.
      Lauch AVG Anti-Spyware 7.5
      [*]On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Click on Change state next to Automatic updates. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
      [*]Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
      [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
      If you are having problems with the updater, you can use this link to manually update ewido.
      AVG Anti-Spyware manual updates.
      Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

      Reboot your computer in Safe Mode.
      • If the computer is running, shut down Windows, and then turn off the power.
      • Wait 30 seconds, and then turn the computer on.
      • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
      • Ensure that the Safe Mode option is selected.
      • Press Enter. The computer then begins to start in Safe mode.
      • Login on your usual account.
      Once in Safe Mode:

      Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
      • Click on Scanner on the toolbar.
      • Click on the Settings tab.
        • Under How to act?
          • Click on Recommended Action and choose Quarantine from the popup menu.
        • Under How to scan?
          • All checkboxes should be ticked.
        • Under Possibly unwanted software:
          • All checkboxes should be ticked.
        • Under Reports:
          • Select Automatically generate report after every scan and uncheck Only if threats were found.
        • Under What to scan?
          • Select Scan every file.
      • Click on the Scan tab.
      • Click on Complete System Scan to start the scan process.
      • Let the program scan the machine.
      • When the scan has finished, follow the instructions below.
        IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
        • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
        • At the bottom of the window click on the Apply all Actions button. (3)
          scanavgjk2.jpg
      • When done, click the Save Scan Report button. (4)
        • Click the Save Report as button.
        • Save the report to your Desktop.
      • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
      Reboot back into Normal Mode, and post a new HJT log, along with the AVG Anti-Spyware log.
    • freshmeatfreshmeat
      edited July 2007
      alright i scaned my computer with avg and aparently there was no infections, so here my hjt log just in case

      Logfile of HijackThis v1.99.1
      Scan saved at 4:10:32 PM, on 7/4/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16473)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\WINDOWS\system32\spupdsvc.exe
      C:\WINDOWS\System32\svchost.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
      C:\WINDOWS\system32\spnpinst.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\system32\Sysocmgr.exe
      C:\Program Files\ITE\Smart Guardian\ITESmart.exe
      C:\Program Files\Motherboard Monitor 5\MBM5.EXE
      C:\Program Files\Common Files\AOL\1146710535\ee\AOLSoftware.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
      C:\Program Files\Lexmark 2400 Series\ezprint.exe
      C:\Program Files\AGEIA Technologies\TrayIcon.exe
      C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Windows Media Player\WMPNSCFG.exe
      C:\Documents and Settings\Juan Barboza\My Documents\iSproggler-1.0.1\iSproggler\iSproggler.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      C:\Program Files\Last.fm\LastFMHelper.exe
      C:\Program Files\Folding@Home\winFAH.exe
      C:\WINDOWS\system32\lxcrcoms.exe
      C:\Program Files\Xfire\Xfire.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
      C:\Program Files\Folding@Home\FahCore_78.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Hijack This\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
      O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
      O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\ITE\Smart Guardian\ITESmart.exe
      O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
      O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146710535\ee\AOLSoftware.exe
      O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
      O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
      O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
      O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
      O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
      O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
      O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
      O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKCU\..\Run: [iSproggler] "C:\Documents and Settings\Juan Barboza\My Documents\iSproggler-1.0.1\iSproggler\iSproggler.exe"
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Startup: Folding@Home 5.03.lnk = ?
      O4 - Startup: Registration Ghost Recon Advanced Warfighter.LNK = C:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\Support\Register\RegistrationReminder.exe
      O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
      O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1145281192718
      O16 - DPF: {6697AFA6-1CD3-462E-AC0A-363EF8BCD102} (SyScan2 Control) - http://www.evga.com/Support/SyScan/SyScan.cab
      O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/sysreqlab2.cab
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145313758812
      O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{0673EA42-9760-429D-8ACB-D6EDBEE39A0F}: NameServer = 68.238.112.12,68.238.96.12
      O17 - HKLM\System\CS1\Services\Tcpip\..\{0673EA42-9760-429D-8ACB-D6EDBEE39A0F}: NameServer = 68.238.112.12,68.238.96.12
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
      O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
      O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
      O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
      O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
      O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
      O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe



      thanks
    • Baabiouz
      edited July 2007
      Hi!

      Okay, so your comp looks clean, but let's run Dss:

      Please download Deckard's System Scanner to your Desktop


      * Close all applications and windows.
      * Double-click on Dss.exe to run it, and follow the prompts.
      * The scan may take a minute. When the scan is complete, a text file will open Main.txt and extra.txt

      Please post Main.txt and Extra.txt
    • freshmeatfreshmeat
      edited July 2007
      alright so i downloaded the scanner and when i try to run it i get an error saying:

      Line 0 (file "C:\Documents and Settings\Juan Barboza\Desktop\dss.exe")
      Local $res = $objSR.Enable("")
      Local $res = $objSR.Enalbe("")^ERROR

      Error: The requested action with this object has failed.


      i tried redownloading the file but it still doesnt work :/
    • Baabiouz
      edited July 2007
      hi!

      Please, try combofix:
      Please download Combofix to your desktop.
      Doubleclick combo.exe to launch the application.
      Follow the prompts that will be displayed on the screen.
      Don't click on the window while the fix is running, because that will cause your system to hang.
      When finished, it should produce a log, combofix.txt.
      Post this log in your next reply together with a new hijackthislog.
    • freshmeatfreshmeat
      edited July 2007
      hey, alright i think i got the right log

      "Juan Barboza" - 2007-07-08 4:52:45 - ComboFix 07-07-07.3 - Service Pack 2


      ((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 )))))))))))))))))))))))))))))))


      2007-07-08 04:50 51,200 --a
      C:\WINDOWS\nircmd.exe
      2007-07-06 17:05 <DIR> d
      C:\Deckard
      2007-07-04 16:13 <DIR> d
      C:\WINDOWS\system32\ActiveScan
      2007-07-04 11:41 <DIR> d
      C:\DOCUME~1\JUANBA~1\APPLIC~1\Lavasoft
      2007-07-04 11:40 <DIR> d
      C:\Program Files\Lavasoft
      2007-06-29 18:18 <DIR> d
      C:\Program Files\Mp3tag
      2007-06-29 18:18 <DIR> d
      C:\DOCUME~1\JUANBA~1\APPLIC~1\Mp3tag
      2007-06-28 22:36 <DIR> d
      C:\Program Files\Last.fm
      2007-06-28 22:34 <DIR> d
      C:\DOCUME~1\JUANBA~1\APPLIC~1\iSproggler
      2007-06-28 22:31 <DIR> d
      C:\Program Files\iLyrics
      2007-06-28 03:33 <DIR> d
      C:\Hijack This
      2007-06-27 19:26 <DIR> d
      C:\WINDOWS\system32\Kaspersky Lab
      2007-06-27 19:26 <DIR> d
      C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
      2007-06-27 19:14 73,728 --a
      C:\WINDOWS\system32\GkSui18.EXE
      2007-06-27 19:14 69,632 --a
      C:\WINDOWS\system32\Copy of GkSui18.EXE
      2007-06-27 19:14 <DIR> d
      C:\Program Files\Folding@Home
      2007-06-27 16:14 <DIR> d
      C:\Program Files\SpywareBlaster
      2007-06-27 16:12 10,872 --a
      C:\WINDOWS\system32\drivers\AvgAsCln.sys
      2007-06-27 16:04 <DIR> d
      C:\DOCUME~1\ADMINI~1\APPLIC~1\acccore
      2007-06-26 23:19 2,829 --a
      C:\WINDOWS\War3Unin.pif
      2007-06-26 23:19 14,827 --a
      C:\WINDOWS\War3Unin.dat
      2007-06-26 23:19 126,976 --a
      C:\WINDOWS\War3Unin.exe
      2007-06-22 14:59 <DIR> d
      C:\DOCUME~1\Naruto\APPLIC~1\Winamp
      2007-06-20 22:06 21,504 --a
      C:\WINDOWS\system32\hidserv.dll
      2007-06-20 22:04 59,264 --a
      C:\WINDOWS\system32\drivers\USBAUDIO.sys
      2007-06-20 11:32 <DIR> d
      C:\DOCUME~1\JUANBA~1\.housecall6.6
      2007-06-11 23:41 <DIR> d
      C:\Program Files\SystemRequirementsLab
      2007-06-11 23:39 <DIR> d
      C:\DOCUME~1\JUANBA~1\APPLIC~1\SystemRequirementsLab


      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

      2007-07-08 08:51:13
      d
      w C:\DOCUME~1\JUANBA~1\APPLIC~1\Xfire
      2007-07-08 08:51:03
      d
      w C:\DOCUME~1\JUANBA~1\APPLIC~1\Azureus
      2007-07-08 08:35:56
      d-s---w C:\Program Files\Xfire
      2007-07-06 08:54:33
      d
      w C:\Program Files\Windows Defender
      2007-07-06 08:50:42
      d
      w C:\Program Files\SmartFTP Client 2.0
      2007-07-06 08:50:14
      d
      w C:\Program Files\QuickTime
      2007-07-06 08:49:43
      d
      w C:\Program Files\PowerISO
      2007-07-06 08:47:53
      d
      w C:\Program Files\MSN Messenger
      2007-07-06 08:47:35
      d
      w C:\Program Files\Motherboard Monitor 5
      2007-07-06 08:46:37
      d
      w C:\Program Files\Messenger
      2007-07-06 08:46:35
      d
      w C:\Program Files\MagicISO
      2007-07-06 08:46:32
      d
      w C:\Program Files\LimeWire
      2007-07-06 08:46:27
      d
      w C:\Program Files\Lexmark Toolbar
      2007-07-06 08:46:23
      d
      w C:\Program Files\Lexmark Fax Solutions
      2007-07-06 08:46:20
      d
      w C:\Program Files\Lexmark 2400 Series
      2007-07-06 08:45:06
      d
      w C:\Program Files\iTunes
      2007-07-06 08:43:30
      d
      w C:\Program Files\Google
      2007-07-06 08:41:21
      d
      w C:\Program Files\Azureus
      2007-07-06 08:40:48
      d
      w C:\Program Files\Apple Software Update
      2007-07-06 08:40:45
      d
      w C:\Program Files\AIM6
      2007-07-06 08:39:55
      d
      w C:\Program Files\AGEIA Technologies
      2007-07-06 05:10:50
      d
      w C:\Program Files\mIRC
      2007-07-05 22:47:12 22,584 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
      2007-07-05 22:45:44 99,904 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
      2007-07-04 15:39:42
      d
      w C:\Program Files\Common Files\Wise Installation Wizard
      2007-06-30 02:04:02
      d
      w C:\Program Files\lx_cats
      2007-06-27 19:26:55
      d
      w C:\Program Files\Winamp
      2007-06-26 11:02:20 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat
      2007-06-12 23:00:54 203,024 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
      2007-06-12 23:00:50 36,112 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
      2007-06-12 22:52:00 1,126,328 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
      2007-06-07 04:27:12
      d
      w C:\DOCUME~1\JUANBA~1\APPLIC~1\Viewpoint
      2007-06-07 02:32:41
      d
      w C:\Program Files\Viewpoint
      2007-06-04 23:13:13
      d
      w C:\DOCUME~1\JUANBA~1\APPLIC~1\LimeWire
      2007-06-03 06:38:55
      d
      w C:\DOCUME~1\JUANBA~1\APPLIC~1\Winamp
      2007-05-31 07:49:13
      d
      w C:\Program Files\iPod
      2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
      2007-05-12 20:34:45
      d--h--w C:\Program Files\InstallShield Installation Information
      2007-05-12 20:10:12
      d
      w C:\Program Files\Sierra
      2007-05-11 05:58:44 63,040 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
      2007-05-11 02:47:14
      d
      w C:\Program Files\Common Files\Blizzard Entertainment
      2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
      2007-04-25 07:38:13 98,304 ----a-w C:\WINDOWS\system32\qttask.exe
      2007-04-19 17:26:00 794,624 ----a-w C:\WINDOWS\system32\nvcplui.exe
      2007-04-19 17:26:00 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
      2007-04-19 17:26:00 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
      2007-04-19 17:26:00 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
      2007-04-19 17:26:00 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
      2007-04-19 17:26:00 311,296 ----a-w C:\WINDOWS\system32\nvexpbar.dll
      2007-04-19 17:26:00 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
      2007-04-19 17:26:00 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
      2007-04-19 17:26:00 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
      2007-04-19 17:26:00 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
      2007-04-19 17:26:00 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
      2007-04-19 17:26:00 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
      2007-04-19 17:26:00 1,011,712 ----a-w C:\WINDOWS\system32\nvcpluir.dll
      2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
      2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
      2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
      2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
      2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
      2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
      2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
      2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
      2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
      2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
      2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll


      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


      *Note* empty entries & legit default entries are not shown

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
      2006-12-18 04:16 59032 --a
      C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}]
      2006-01-25 10:51 184320 -ra
      C:\Program Files\Lexmark Toolbar\toolband.dll

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
      2005-05-31 01:04 853672 --a
      C:\PROGRA~1\SPYBOT~1\SDHelper.dll

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
      2007-03-14 03:43 501400 --a
      C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
      2007-01-20 00:55 2403392 -ra
      c:\program files\google\googletoolbar3.dll

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "@=" []
      "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" [2005-03-18 12:50]
      "nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
      "SmartGuardian"="C:\Program Files\ITE\Smart Guardian\ITESmart.exe" [2005-05-02 09:14]
      "MBM 5"="C:\Program Files\Motherboard Monitor 5\MBM5.EXE" [2004-06-12 09:40]
      "HostManager"="C:\Program Files\Common Files\AOL\1146710535\ee\AOLSoftware.exe" [2006-05-09 20:24]
      "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 12:59]
      "lxcrmon.exe"="C:\Program Files\Lexmark 2400 Series\lxcrmon.exe" [2006-01-22 13:45]
      "EzPrint"="C:\Program Files\Lexmark 2400 Series\ezprint.exe" [2006-02-07 01:10]
      "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2006-02-02 04:11]
      "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
      "AGEIA PhysX SysTray"="C:\Program Files\AGEIA Technologies\TrayIcon.exe" [2006-03-20 15:43]
      "pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-01-23 15:26]
      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-05-26 12:45]
      "NvMediaCenter"="NvMCTray.dll" [2006-06-01 17:22 C:\WINDOWS\system32\nvmctray.dll]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56]
      "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]
      "iSproggler"="C:\Documents and Settings\Juan Barboza\My Documents\iSproggler-1.0.1\iSproggler\iSproggler.exe" [2007-04-09 17:34]
      "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]

      [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
      "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
      "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 08:29]

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
      "MSMSGS"="C:\Program Files\Messenger\MSMSGS.EXE" /background
      "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
      "swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
      "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
      "PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE
      "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
      "SoundMan"=SOUNDMAN.EXE
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
      "WinampAgent"=C:\Program Files\Winamp\winampa.exe
      "Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe"


      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e0fbf04-ce10-11da-80b8-806d6172696f}]
      AutoRun\command- D:\setup.exe


      Contents of the 'Scheduled Tasks' folder
      2007-07-01 18:03:06 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

      **************************************************************************

      catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-07-08 05:02:47
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      Completion time: 2007-07-08 5:03:56

      --- E O F ---


      and my HJT

      Logfile of HijackThis v1.99.1
      Scan saved at 6:11:18 AM, on 7/8/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16473)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
      C:\WINDOWS\system32\PnkBstrA.exe
      C:\WINDOWS\system32\spupdsvc.exe
      C:\WINDOWS\System32\svchost.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\system32\spnpinst.exe
      C:\WINDOWS\system32\Sysocmgr.exe
      C:\Program Files\Motherboard Monitor 5\MBM5.EXE
      C:\Program Files\Common Files\AOL\1146710535\ee\AOLSoftware.exe
      C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
      C:\Program Files\Lexmark 2400 Series\ezprint.exe
      C:\Program Files\AGEIA Technologies\TrayIcon.exe
      C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Windows Media Player\WMPNSCFG.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\lxcrcoms.exe
      C:\Program Files\Last.fm\LastFMHelper.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
      C:\Program Files\Last.fm\LastFM.exe
      C:\WINDOWS\explorer.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Hijack This\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
      O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
      O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [SmartGuardian] C:\Program Files\ITE\Smart Guardian\ITESmart.exe
      O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
      O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1146710535\ee\AOLSoftware.exe
      O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
      O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"
      O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"
      O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
      O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
      O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
      O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKCU\..\Run: [iSproggler] "C:\Documents and Settings\Juan Barboza\My Documents\iSproggler-1.0.1\iSproggler\iSproggler.exe"
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Startup: Folding@Home 5.03.lnk = ?
      O4 - Startup: Registration Ghost Recon Advanced Warfighter.LNK = C:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\Support\Register\RegistrationReminder.exe
      O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O11 - Options group: [INTERNATIONAL] International*
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
      O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
      O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1145281192718
      O16 - DPF: {6697AFA6-1CD3-462E-AC0A-363EF8BCD102} (SyScan2 Control) - http://www.evga.com/Support/SyScan/SyScan.cab
      O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/sysreqlab2.cab
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145313758812
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{0673EA42-9760-429D-8ACB-D6EDBEE39A0F}: NameServer = 68.238.112.12,68.238.96.12
      O17 - HKLM\System\CS1\Services\Tcpip\..\{0673EA42-9760-429D-8ACB-D6EDBEE39A0F}: NameServer = 68.238.112.12,68.238.96.12
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
      O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
      O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
      O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
      O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
      O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
      O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
      O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
    • freshmeatfreshmeat
      edited July 2007
      thanks for the help btw
    • Baabiouz
      edited July 2007
      Np.

      Combofix log is ok.
      Let's delete two folders:
      ______________
      Please set your system to show all files.
      Click Start, open My Computer, select the Tools menu and click Folder Options.
      Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
      Uncheck: Hide file extensions for known file types
      Uncheck the Hide protected operating system files (recommended) option.
      Click Yes to confirm.

      Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these folders (if present):

      C:\DOCUME~1\JUANBA~1\APPLIC~1\Viewpoint
      C:\Program Files\Viewpoint


      Please set your system to hide all hidden files.
      Click Start, open My Computer, select the Tools menu and click Folder Options.
      Select the View Tab. Under the Hidden files and folders heading, uncheck Show hidden files and folders.
      Check: Hide file extensions for known file types
      Check the Hide protected operating system files (recommended) option.
      Click Yes to confirm.
      ______________

      Boot your computer
      ______________

      Download Dr.Web CureIt to the desktop:
      ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
      • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
      • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
        This is only a short scan.
      • Once the short scan has finished, Click Options > Change settings
      • Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
      • Back at the main window, mark the drives that you want to scan.
      • Select all drives. A red dot shows which drives have been chosen.
      • Click the green arrow at the right, and the scan will start.
      • Click 'Yes to all' i at the right, and the scan will start.
      • Click 'Yes to all' if it asks if you want to cure/move the file.
      • When the scan has finished, look if you can click next icon next to the files found:
        check.gif
        If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
        move.gifat the right, and the scan will start.
        his will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
      • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
      • Save the report to your desktop. The report will be called DrWeb.csv
      • Close Dr.Web Cureit.
      • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
      • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply
    • freshmeatfreshmeat
      edited July 2007
      hi heres what drweb found
      mirc.exe;C:\Program Files\mIRC;Program.mIRC.617;Incurable.Moved.;

      thx, and sorry it took so long
    • Baabiouz
      edited July 2007
      Hi!
      Okay, i think your computer is clean now. Do you have problems?
    • freshmeatfreshmeat
      edited July 2007
      nope its running fine now, thanks man
    • Baabiouz
      edited July 2007
      :)

      Log looks clean...great job!

      Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
      1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point.

        You can find instructions on how to enable and reenable system restore here:

        Managing Windows Millenium System Restore

        or

        Windows XP System Restore Guide

        Renable system restore with instructions from tutorial above

      2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
        1. From within Internet Explorer click on the Tools menu and then click on Options.
        2. Click once on the Security tab
        3. Click once on the Internet icon so it becomes highlighted.
        4. Click once on the Custom Level button.
          1. Change the Download signed ActiveX controls to Prompt
          2. Change the Download unsigned ActiveX controls to Disable
          3. Change the Initialize and script ActiveX controls not marked as safe to Disable
          4. Change the Installation of desktop items to Prompt
          5. Change the Launching programs and files in an IFRAME to Prompt
          6. Change the Navigate sub-frames across different domains to Prompt
          7. When all these settings have been made, click on the OK button.
          8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
        5. Next press the Apply button and then the OK to exit the Internet Properties page.
      3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

        See this link for a listing of some online & their stand-alone antivirus programs:

        Virus, Spyware, and Malware Protection and Removal Resources

      4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

      5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

        For a tutorial on Firewalls and a listing of some available ones see the link below:

        Understanding and Using Firewalls

      6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

      7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

        A tutorial on installing & using this product can be found here:

        Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

      8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

        A tutorial on installing & using this product can be found here:

        Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

      9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

        A tutorial on installing & using this product can be found here:

        Using SpywareBlaster to protect your computer from Spyware and Malware

      10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
      Follow this list and your potential for being infected again will reduce dramatically.

      Glad I was able to help.
    • Baabiouz
      edited July 2007
      Glad I could be of assistance! The help you received here was free. Please read through some of these Prevention Tips that Short-Media offers.

      This topic is now closed. If you wish it reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

      Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.

      If you are not the user who started this thread, you must start a new Thread instead :)

      Would you also be interested to join Short-Media (Team #93) with the Folding@Home Project? More information available here
    Sign In or Register to comment.