WiredWX Hobby Weather ToolsLog in

 


Nobody seems to know how to help me!

4 posters

descriptionNobody seems to know how to help me! EmptyNobody seems to know how to help me!

more_horiz
I'm such a noob at this, but I'm trying to get rid of something on my computer. Redtube.com says Rustok-N is attacking the site from my computer. I've run everything anyone's told me to and I apparently still have the stupid virus. I think I got it from neopets when I disabled Ad-Block. Anyway, I don't mind so much that it's there it doesn't seem to do that much damage and it seems impossible to get rid of, however, now I can't update ANYTHING or download from microsoft! Please help me, I've tried everything!
Here's some programs I've run....

Malwarebytes
AVG
Spybot
Combofix
Avast
Avira
AdAware
Advanced System Care

Please help me with this, anyone! I live on my computer and I'd really like to get it back in good shape! Thanks

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Hello xxdarkwolfrosexx, welcome to GeekPolice.

Please read this: http://www.geekpolice.net/-t3821.htm

And post your HijackThis log here.

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Please download the current version of HijackThis from HERE

  • Double click and run the installer.
  • It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  • After installing, you should get the user agreement, press accept and Hijack This will run.
  • Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.

descriptionNobody seems to know how to help me! EmptyThanks guys, here's the log

more_horiz
Ok, I ran Hijackthis and got this log....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:20:42 PM, on 5/26/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cepstral\bin\CepstralLicSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LxrSII1s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\wltray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dynex G Desktop Card Adapter\DynexWCUI.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Rayne\Desktop\hijackgpthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTorr.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTorr.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTorr.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager] C:\WINDOWS\system32\wltray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Dynex Wireless Networking Utility.lnk = ?
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: SOFTWARE -
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Cepstral License Server - Cepstral, LLC - C:\Program Files\Cepstral\bin\CepstralLicSrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 5977 bytes

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
I'm not so sure about running malware bytes again, last time it fried my internet and took forever to get it running again Sad tearing

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Please download WinSock Fix and save it to yor desktop:

http://files.snapfiles.com/localdl834/WinsockxpFix.exe

Now run Malwarebytes and post the log back here, should you lose your internet connectivity run Winsock fix to repair your internet connection.

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Well it only found the security thingys that I disabled. Here's the log.

Malwarebytes' Anti-Malware 1.37
Database version: 2182
Windows 5.1.2600 Service Pack 2

5/27/2009 6:12:18 PM
mbam-log-2009-05-27 (18-12-12).txt

Scan type: Quick Scan
Objects scanned: 88792
Time elapsed: 7 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz

  • Download combofix from here
    Link 1
    Link 2
1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:

Nobody seems to know how to help me! CF_download_FF

Nobody seems to know how to help me! CF_download_rename

3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.
See HERE for how to disable your AV..

  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

descriptionNobody seems to know how to help me! EmptyHere's combofix

more_horiz
Here's the first part of the combo-fix log

ComboFix 09-05-26.05 - Rayne 05/28/2009 1:36.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.351.105 [GMT -7:00]
Running from: c:\documents and settings\Rayne\Desktop\Combo-Fix.exe
AV: avast! antivirus 4.8.1335 [VPS 090527-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-28 )))))))))))))))))))))))))))))))
.

2009-05-27 00:07 . 2009-05-27 00:07 -------- dc----w c:\program files\JavaFX
2009-05-26 23:58 . 2009-05-26 23:58 -------- dc----w c:\program files\Sun
2009-05-26 22:53 . 2009-05-26 23:50 -------- dc----w c:\documents and settings\Rayne\.SunDownloadManager
2009-05-26 06:43 . 2009-05-26 06:43 -------- dc----w c:\documents and settings\Rayne\Application Data\Thinstall
2009-05-26 05:32 . 2006-12-08 19:02 251672 -c--a-w c:\windows\system32\xactengine2_5.dll
2009-05-26 05:32 . 2006-11-29 20:06 3426072 -c--a-w c:\windows\system32\d3dx9_32.dll
2009-05-26 05:32 . 2006-11-15 18:38 15128 -c--a-w c:\windows\system32\x3daudio1_1.dll
2009-05-26 05:32 . 2006-09-28 23:05 237848 -c--a-w c:\windows\system32\xactengine2_4.dll
2009-05-26 05:32 . 2006-07-28 16:30 236824 -c--a-w c:\windows\system32\xactengine2_3.dll
2009-05-26 05:32 . 2006-07-28 16:30 62744 -c--a-w c:\windows\system32\xinput1_2.dll
2009-05-21 07:59 . 2009-02-05 20:06 23152 -c--a-w c:\windows\system32\drivers\aswRdr.sys
2009-05-21 07:59 . 2009-02-05 20:06 51376 -c--a-w c:\windows\system32\drivers\aswTdi.sys
2009-05-21 07:59 . 2009-02-05 20:05 26944 -c--a-w c:\windows\system32\drivers\aavmker4.sys
2009-05-21 07:59 . 2009-02-05 20:04 97480 -c--a-w c:\windows\system32\AvastSS.scr
2009-05-21 07:59 . 2009-02-05 20:07 114768 -c--a-w c:\windows\system32\drivers\aswSP.sys
2009-05-21 07:59 . 2009-02-05 20:07 20560 -c--a-w c:\windows\system32\drivers\aswFsBlk.sys
2009-05-21 07:59 . 2009-02-05 20:08 93296 -c--a-w c:\windows\system32\drivers\aswmon.sys
2009-05-21 07:59 . 2009-02-05 20:08 94032 -c--a-w c:\windows\system32\drivers\aswmon2.sys
2009-05-21 07:58 . 2009-02-05 20:11 1256296 -c--a-w c:\windows\system32\aswBoot.exe
2009-05-21 07:58 . 2009-05-21 07:58 -------- dc----w c:\program files\Alwil Software
2009-05-21 07:06 . 2007-03-06 17:12 86016 -c--a-w c:\windows\system32\preflib.dll
2009-05-21 07:06 . 2006-09-01 04:14 1089536 -c--a-w c:\windows\system32\libeay32.dll
2009-05-20 06:10 . 2009-05-21 08:07 117760 -c--a-w c:\documents and settings\Rayne\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-05-20 06:10 . 2009-05-20 06:10 -------- dc----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-20 06:09 . 2009-05-20 06:09 65024 -c--a-r c:\documents and settings\Rayne\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
2009-05-20 06:09 . 2009-05-20 06:09 18944 -c--a-r c:\documents and settings\Rayne\Application Data\Microsoft\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
2009-05-20 06:09 . 2009-05-20 06:09 -------- dc----w c:\program files\SUPERAntiSpyware
2009-05-20 06:09 . 2009-05-20 06:09 -------- dc----w c:\documents and settings\Rayne\Application Data\SUPERAntiSpyware.com
2009-05-20 01:39 . 2009-05-20 01:39 -------- dc----w C:\LOOXIS
2009-05-19 18:10 . 2009-05-19 18:10 -------- dc----w c:\program files\Common Files\Wise Installation Wizard
2009-05-19 17:06 . 2009-05-26 20:19 19096 -c--a-w c:\windows\system32\drivers\mbam.sys
2009-05-19 17:06 . 2009-05-26 20:20 40160 -c--a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-19 05:15 . 2009-05-21 07:06 -------- dc----w c:\program files\Dynex G Desktop Card Adapter
2009-05-18 17:55 . 2009-05-18 17:55 -------- dc----w c:\documents and settings\Rayne\Application Data\Malwarebytes
2009-05-18 17:55 . 2009-05-18 17:55 -------- dc----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-18 09:28 . 2009-03-24 23:08 55640 -c--a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-18 08:29 . 2009-05-28 00:56 -------- dc----w c:\program files\Malwarebytes' Anti-Malware
2009-05-18 07:56 . 2009-05-18 07:59 60174 -c--a-w c:\windows\unins001.dat
2009-05-18 07:56 . 2009-05-18 07:59 702297 -c--a-w c:\windows\unins001.exe
2009-05-18 07:51 . 2009-05-18 07:51 702297 -c--a-w c:\windows\unins000.exe
2009-05-18 07:51 . 2009-05-18 07:51 11647 -c--a-w c:\windows\unins000.dat
2009-05-17 09:12 . 2009-05-17 09:17 -------- dc----w c:\program files\Voice Changer 4.0 Diamond
2009-05-17 07:02 . 2009-05-19 04:54 -------- dc----w c:\documents and settings\All Users\Application Data\avg8
2009-05-16 18:33 . 2009-05-16 18:33 -------- dc----w c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2009-05-16 17:43 . 2009-05-18 06:52 -------- dc----w c:\program files\Spyware Terminator
2009-05-16 17:18 . 2009-05-18 06:52 -------- dc----w c:\program files\Google
2009-05-16 09:01 . 2009-05-16 09:00 102664 -c--a-w c:\windows\system32\drivers\tmcomm.sys
2009-05-16 09:00 . 2009-05-16 17:40 -------- dc----w c:\documents and settings\Rayne\.housecall6.6
2009-05-16 08:59 . 2009-05-16 08:59 -------- dc----w c:\windows\Sun
2009-05-16 08:55 . 2009-05-16 08:55 410984 -c--a-w c:\windows\system32\deploytk.dll
2009-05-16 08:55 . 2009-05-26 23:54 -------- dc----w c:\program files\Java
2009-05-16 08:54 . 2009-05-16 08:54 152576 -c--a-w c:\documents and settings\Rayne\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-14 07:26 . 2009-05-14 07:26 758272 -c--a-w c:\windows\system32\kcpp.dll
2009-05-12 04:30 . 2009-05-12 04:30 -------- dc----w c:\documents and settings\LocalService\Application Data\Yahoo!
2009-05-12 04:17 . 2009-05-12 04:17 -------- dc----w c:\program files\Singular Inversions
2009-05-09 03:53 . 2009-05-25 23:32 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-09 03:49 . 2009-05-25 23:32 -------- dc----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-07 17:38 . 2007-02-21 09:11 68888 -c--a-w c:\windows\system32\xinput1_3.dll
2009-05-07 17:38 . 2008-10-30 18:57 3851784 -c--a-w c:\windows\system32\d3dx9_39.dll
2009-05-06 14:04 . 2009-05-06 14:04 -------- dc----w c:\documents and settings\Rayne\Application Data\Neopets Toolbar
2009-05-06 14:03 . 2009-05-06 14:03 -------- dc----w c:\documents and settings\Rayne\Local Settings\Application Data\Neopets
2009-05-04 04:30 . 2009-05-04 04:46 -------- dc----w c:\program files\Negi Mascotts
2009-05-04 04:10 . 2009-05-17 08:59 -------- dc----w c:\program files\DesuBuddy
2009-05-02 10:05 . 2009-05-02 10:19 -------- dc----w c:\program files\Eclipse 1.2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-21 07:52 . 2009-04-25 07:37 -------- dc----w c:\documents and settings\Rayne\Application Data\BitTorrent
2009-05-21 06:54 . 2008-07-19 00:17 -------- dc----w c:\program files\AVG
2009-05-21 06:53 . 2009-04-25 07:37 -------- dc----w c:\documents and settings\Rayne\Application Data\DNA
2009-05-21 06:53 . 2008-09-05 22:37 -------- dc--a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-18 17:30 . 2008-05-15 20:24 -------- dc----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-17 08:02 . 2009-03-09 00:24 -------- dc----w c:\documents and settings\All Users\Application Data\Smith Micro
2009-05-16 18:30 . 2008-08-15 12:11 -------- dc----w c:\program files\Common Files\Adobe
2009-05-16 08:07 . 2009-04-08 01:11 -------- dc----w c:\program files\Spybot - Search & Destroy
2009-05-12 04:17 . 2005-06-06 01:13 -------- dc-h--w c:\program files\InstallShield Installation Information
2009-05-07 18:58 . 2009-04-25 07:50 -------- dc----w c:\program files\MagicISO
2009-04-30 16:31 . 2009-03-08 01:00 -------- dc----w c:\program files\Windows Media Connect 2
2009-04-27 23:55 . 2008-05-08 20:00 145752 -c--a-w c:\documents and settings\Rayne\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-27 23:51 . 2009-04-27 23:51 45056 -c--a-r c:\documents and settings\Rayne\Application Data\Microsoft\Installer\{57A382F5-9E34-4201-8564-A25724AC8BAF}\NewShortcut2_57A382F59E3442018564A25724AC8BAF.exe
2009-04-27 23:51 . 2009-04-27 23:51 40960 -c--a-r c:\documents and settings\Rayne\Application Data\Microsoft\Installer\{57A382F5-9E34-4201-8564-A25724AC8BAF}\NewShortcut4_57A382F59E3442018564A25724AC8BAF.exe
2009-04-27 23:51 . 2009-04-27 23:51 40960 -c--a-r c:\documents and settings\Rayne\Application Data\Microsoft\Installer\{57A382F5-9E34-4201-8564-A25724AC8BAF}\NewShortcut3_57A382F59E3442018564A25724AC8BAF.exe
2009-04-27 23:51 . 2009-04-27 23:51 40960 -c--a-r c:\documents and settings\Rayne\Application Data\Microsoft\Installer\{57A382F5-9E34-4201-8564-A25724AC8BAF}\NewShortcut1_57A382F59E3442018564A25724AC8BAF.exe
2009-04-27 23:51 . 2009-04-27 23:51 -------- dc----w c:\program files\Microsoft Windows Script
2009-04-27 23:51 . 2009-04-27 23:51 -------- dc----w c:\program files\Haptek
2009-04-27 23:49 . 2009-04-27 23:49 -------- dc----w c:\program files\Zabaware
2009-04-27 14:16 . 2009-04-27 14:16 -------- dc----w c:\documents and settings\Rayne\Application Data\Enterbrain
2009-04-27 14:14 . 2009-04-27 14:14 -------- dc----w c:\program files\Common Files\Enterbrain
2009-04-27 14:14 . 2009-04-27 14:14 -------- dc----w c:\program files\Enterbrain
2009-04-26 17:18 . 2009-04-26 15:04 -------- dc----w c:\program files\TextAloud
2009-04-26 15:32 . 2009-04-26 15:32 -------- dc----w c:\program files\Common Files\INCA Shared
2009-04-26 15:19 . 2009-04-26 15:19 -------- dc----w c:\program files\NeoSpeech
2009-04-26 05:22 . 2009-04-26 05:07 -------- dc----w c:\documents and settings\Rayne\Application Data\DAEMON Tools Lite
2009-04-26 05:19 . 2009-04-26 05:19 -------- dc----w c:\documents and settings\Rayne\Application Data\DAEMON Tools Pro
2009-04-26 05:19 . 2009-04-26 05:19 -------- dc----w c:\documents and settings\Rayne\Application Data\DAEMON Tools
2009-04-26 05:18 . 2009-04-26 05:18 -------- dc----w c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-04-26 05:07 . 2008-08-26 02:53 717296 -c--a-w c:\windows\system32\drivers\sptd.sys
2009-04-25 09:35 . 2009-04-25 09:35 -------- dc----w c:\documents and settings\Rayne\Application Data\Uniblue
2009-04-25 09:33 . 2009-04-25 09:32 -------- dc-h--w c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-04-25 09:33 . 2009-04-25 09:33 -------- dc----w c:\program files\Uniblue
2009-04-25 08:57 . 2009-04-25 08:57 -------- dc----w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-04-25 08:56 . 2009-04-25 07:37 -------- dc----w c:\program files\DNA
2009-04-25 07:37 . 2009-04-25 07:37 -------- dc----w c:\program files\BitTorrent
2009-04-22 02:49 . 2009-04-22 02:49 1496576 -c-h--w c:\windows\system32\wodfamop.dll
2009-04-21 07:34 . 2009-04-21 07:26 -------- dc----w c:\program files\PhotoFiltre
2009-04-21 04:00 . 2009-03-01 21:26 -------- dc----w c:\documents and settings\Rayne\Application Data\aAvgApi
2009-04-21 04:00 . 2008-08-19 20:02 -------- dc----w c:\documents and settings\Rayne\Application Data\Any Video Converter
2009-04-21 04:00 . 2009-02-28 01:00 -------- dc----w c:\program files\TorrentMan
2009-04-21 04:00 . 2009-01-22 23:02 -------- dc----w c:\program files\Rings of the Magi
2009-04-14 01:07 . 2009-03-08 08:53 -------- dc----w c:\documents and settings\Rayne\Application Data\GetRightToGo
2009-04-12 07:32 . 2009-04-12 06:14 -------- dc----w c:\program files\IObit
2009-04-12 07:29 . 2009-04-12 06:14 -------- dc----w c:\documents and settings\Rayne\Application Data\IObit
2009-04-04 19:58 . 2008-07-24 03:12 -------- dc----w c:\program files\psx emulation cheater
2009-04-04 05:51 . 2008-07-01 22:12 -------- dc----w c:\documents and settings\All Users\Application Data\InstallShield
2009-03-11 05:58 . 2009-03-11 05:58 0 -c--a-w c:\windows\system32\drivers\ScreamingBAudio.sys
.

------- Sigcheck -------

[-] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\SD_OLD\Download\e9500597a78495f397efb821e37bf356\svchost.exe
[-] 2004-08-04 09:44 14336 BA98327E90022DBD6EE76490E0622E2E c:\windows\system32\svchost.exe
.

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
((((((((((((((((((((((((((((( SnapShot@2009-05-21_06.24.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-28 08:30 . 2009-05-28 08:30 16384 c:\windows\temp\Perflib_Perfdata_ec.dat
+ 2009-05-28 08:30 . 2009-05-28 08:30 16384 c:\windows\temp\Perflib_Perfdata_5e0.dat
+ 2009-05-26 05:31 . 2005-12-06 01:07 61136 c:\windows\system32\xinput9_1_0.dll
+ 2009-05-26 05:32 . 2006-03-31 19:39 62672 c:\windows\system32\xinput1_1.dll
+ 2009-05-26 05:31 . 2006-02-03 15:41 14032 c:\windows\system32\x3daudio1_0.dll
+ 2009-05-21 06:57 . 2006-12-01 15:45 20480 c:\windows\system32\wltrysvc.exe
+ 2009-05-21 06:57 . 2006-12-01 15:45 44032 c:\windows\system32\wltrynt.dll
+ 2002-12-31 12:00 . 2009-05-21 07:07 63334 c:\windows\system32\perfc009.dat
- 2002-12-31 12:00 . 2009-05-19 23:31 63334 c:\windows\system32\perfc009.dat
+ 2009-05-21 06:57 . 2006-12-01 15:45 33664 c:\windows\system32\drivers\bcmwlnpf.sys
+ 2009-05-21 06:57 . 2005-02-02 01:18 17992 c:\windows\system32\drivers\bcm42rly.sys
+ 2009-05-21 06:57 . 2006-12-01 15:45 69632 c:\windows\system32\bcmwlpkt.dll
+ 2009-05-21 06:57 . 2006-12-01 15:45 81920 c:\windows\system32\bcmwliss.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 12800 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 53248 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2009-05-27 00:08 . 2009-05-27 00:08 10134 c:\windows\Installer\{7396F7C8-EDD8-4473-BF6A-2CE4996716E1}\SystemFolder_msiexec.exe
+ 2009-05-26 05:32 . 2009-05-26 05:32 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2009-05-26 05:32 . 2006-05-31 14:24 230168 c:\windows\system32\xactengine2_2.dll
+ 2009-05-26 05:32 . 2006-03-31 19:39 229584 c:\windows\system32\xactengine2_1.dll
+ 2009-05-26 05:31 . 2006-02-03 15:42 230096 c:\windows\system32\xactengine2_0.dll
+ 2009-05-21 07:06 . 2006-11-30 23:53 610816 c:\windows\system32\ReinstallBackups\0013\DriverFiles\BCMWL5.SYS
+ 2002-12-31 12:00 . 2009-05-21 07:07 403858 c:\windows\system32\perfh009.dat
- 2002-12-31 12:00 . 2009-05-19 23:31 403858 c:\windows\system32\perfh009.dat
+ 2009-05-21 06:57 . 2006-11-30 23:53 610816 c:\windows\system32\drivers\BCMWL5.SYS
+ 2009-05-21 06:57 . 2006-12-01 15:45 184320 c:\windows\system32\bcmwlu00.exe
+ 2009-05-21 06:57 . 2006-12-01 15:45 700416 c:\windows\system32\BCMLogon.dll
+ 2009-05-21 06:57 . 2007-03-06 17:14 765952 c:\windows\system32\bcm1xsup.dll
+ 2009-05-26 05:32 . 2006-03-31 18:27 578560 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2006-02-03 14:40 578560 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2005-12-06 00:20 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2005-09-28 21:11 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2005-07-23 00:21 577024 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2005-05-26 22:15 576000 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2005-03-19 00:23 567296 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2005-02-06 02:32 563712 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 223232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 178176 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 364544 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 159232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 145920 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
+ 2009-05-26 05:32 . 2005-03-18 23:23 473600 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2009-05-21 06:57 . 2007-03-02 18:20 1282048 c:\windows\system32\wltray.exe
+ 2009-05-21 06:57 . 2006-12-01 15:45 2129920 c:\windows\system32\WLBCGCBPRO731.DLL
+ 2009-05-26 05:31 . 2006-03-31 19:40 2388176 c:\windows\system32\d3dx9_30.dll
+ 2009-05-26 05:31 . 2006-02-03 15:43 2332368 c:\windows\system32\d3dx9_29.dll
+ 2009-05-26 05:31 . 2005-12-06 01:09 2323664 c:\windows\system32\d3dx9_28.dll
+ 2009-05-26 05:31 . 2005-07-23 02:59 2319568 c:\windows\system32\d3dx9_27.dll
+ 2009-05-26 05:31 . 2005-03-19 00:19 2337488 c:\windows\system32\d3dx9_25.dll
+ 2009-05-26 05:31 . 2005-02-06 02:45 2222800 c:\windows\system32\d3dx9_24.dll
+ 2009-05-21 06:57 . 2007-03-06 17:24 1146880 c:\windows\system32\bcmwltry.exe
+ 2009-05-26 05:32 . 2004-12-01 22:53 2846720 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2004-09-29 19:38 2676224 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:32 . 2009-05-26 05:32 2846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-05-26 05:31 . 2009-05-26 05:31 2676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
2008-05-21 08:43 1526296 -c--a-w c:\program files\TorrentMan\tbTorr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager"="c:\windows\system32\wltray.exe" [2007-03-02 1282048]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dynex Wireless Networking Utility.lnk - c:\program files\Dynex G Desktop Card Adapter\DynexWCUI.exe [2009-5-21 1462272]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05 356352 -c--a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
[BU]

[HKLM\~\startupfolder\C:^Documents and Settings^Rayne^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
backup=c:\windows\pss\PowerReg Scheduler V3.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Rayne^Start Menu^Programs^Startup^Ultra Hal Assistant Startup.lnk]
backup=c:\windows\pss\Ultra Hal Assistant Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\InterVideo\\DVD5\\WinDVD.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\NeverwinterNights\\NWN\\nwmain.exe"=
"c:\\KARI3PRO\\Kari3Pro.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Dynex G Desktop Card Adapter\\DynexWCUI.exe"=
"c:\\Program Files\\Spybot - Search & Destroy\\SDUpdate.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [5/21/2009 12:59 AM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/21/2009 12:59 AM 20560]
R2 Cepstral License Server;Cepstral License Server;c:\program files\Cepstral\bin\CepstralLicSrv.exe [6/25/2008 6:18 PM 57344]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [6/30/2008 8:09 PM 72672]
S0 Ramdisk;Ramdisk Driver;c:\windows\system32\drivers\RamDsk.sys [9/27/2004 7:00 PM 26240]
S3 FileObjInfo;STFileDriver;\??\c:\documents and settings\All Users\Application Data\Spyware Terminator\FileObjInfo.sys --> c:\documents and settings\All Users\Application Data\Spyware Terminator\FileObjInfo.sys [?]
S3 jgameenp;jgameenp;\??\c:\docume~1\Rayne\LOCALS~1\Temp\jgameenp.sys --> c:\docume~1\Rayne\LOCALS~1\Temp\jgameenp.sys [?]
S3 samhid;samhid;c:\windows\system32\drivers\Samhid.sys [5/17/2008 5:04 PM 7548]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [3/10/2009 10:58 PM 0]
S4 Stuffit Archive Name Service;Stuffit Archive Name Service;"c:\program files\Smith Micro\StuffIt 2009\ArcNameService.exe" --> c:\program files\Smith Micro\StuffIt 2009\ArcNameService.exe [?]
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = www.google.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: SOFTWARE
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-28 01:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(864)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-28 1:45
ComboFix-quarantined-files.txt 2009-05-28 08:45
ComboFix2.txt 2009-05-21 06:27
ComboFix3.txt 2009-05-18 17:27
ComboFix4.txt 2009-04-07 23:06
ComboFix5.txt 2009-05-28 08:34

Pre-Run: 834,002,944 bytes free
Post-Run: 877,174,784 bytes free

297

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Hello.
You have a few different problems here.

The first one being that svchost might be patched by a virus, which is causing the error.
Second, you have Torrent/P2P software installed, so we'll remove them next.
Third, stay away from porn sites, you are bound to get infected visiting them.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Ok, here's the uninstall list

3dmaze
7-Zip 4.57
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2
Adobe Shockwave Player 11.5
Advanced SystemCare 3
Ahriman's Prophecy
avast! Antivirus
Baker's Dozen
CCleaner (remove only)
CCScore
Cepstral David 5.1.0
Defraggler (remove only)
DesuBuddy
Dynex G Wireless Desktop Card Setup
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSSONIC
ESSTOOLS
essvatgt
FaceGen Customizer 1.1
Free Realms Installer
Game Booster
GGE909 PC Recoil Pad
HijackThis 2.0.2
InterVideo WinDVD 5
Java DB 10.4.1.3
Java(TM) 6 Update 13
Java(TM) SE Development Kit 6 Update 13
JavaFX(TM) 1.1 SDK
Jouster
Kari 3.49 Pro
Kari 3.7 Pro
Kari Scene Creator 3.32
kgcbaby
kgcbase
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
KSU
L&H TTS3000 British English
Lernout & Hauspie TruVoice American English TTS Engine
Letris
LOOXIS Faceworx 1.0
Male Voice Pack
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft .NET Framework SDK (English) 1.1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.0.6)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MVP Checkers Shareware
netbrdg
Neverwinter Nights
NextUp.com-NeoSpeech Paul16 Voice
Notifier
OfotoXMI
PCDADDIN
PCDHELP
PhotoFiltre
PRC Pack
Realtek AC'97 Audio
RegistrySmart
RPG Maker 2000 1.05
RPG Maker 95+ (Translated by Don Miguel)
RPG Maker XP - Postality Knights Edition ENHANCED
RPGƒcƒN[ƒ‹VX
RPGƒcƒN[ƒ‹VX RTP
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB961260)
SFR
SHASTA
SiS VGA Utilities
SKIN0001
SKINXSDK
Spybot - Search & Destroy
staticcr
StuffIt 2009
SUPERAntiSpyware Free Edition
The Haptek Player
The Sims 2
tooltips
TorrentMan Toolbar
Totalidea RAM-Disk Driver
Ultra Hal Assistant
Uniblue RegistryBooster 2009
Uniblue RegistryBooster 2009
VPRINTOL
Windows Genuine Advantage v1.3.0254.0
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WIRELESS
Yahoo! Messenger
Yahoo! Toolbar

Last edited by xxdarkwolfrosexx on 30th May 2009, 3:25 am; edited 1 time in total (Reason for editing : messup)

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

  • 7-Zip 4.57
    Adobe Reader 8.1.2
    TorrentMan Toolbar
    Uniblue RegistryBooster 2009
    Uniblue RegistryBooster 2009

Now that they are gone, I need to know if you have your XP disc

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
Limewire is from the last user who had this computer, I didn't see it in the uninstall wizard and you didn't say how to uninstall it Sad tearing I deleted the others though.

No, I got this computer from someone else, they didn't give me a CD, sorry.

descriptionNobody seems to know how to help me! EmptyRe: Nobody seems to know how to help me!

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum