ComputerForum.com ComputerForum.com  

Go Back   Computer Forum > Computer Software > Computer Security
Hijack! Thanks Hijack! Thanks
Register FAQ Members List Social Groups Calendar Search Today's Posts Mark Forums Read

Reply
Page 1 of 2 1 2
 
LinkBack Thread Tools Search this Thread Display Modes
Old 12-15-2008, 11:15 PM   #1 (permalink)
Platinum Member
 
Join Date: Sep 2005
Location: In My House
Posts: 948
Post Hijack! Thanks
ComboFix 08-12-15.01 - Gustavo 2008-12-15 14:05:46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1378 [GMT -8:00]
Running from: c:\documents and settings\Gustavo\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((( Files Created from 2008-11-15 to 2008-12-15 )))))))))))))))))))))))))))))))
.

2008-12-13 16:13 . 2008-12-13 16:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\SwiftKit
2008-12-05 14:47 . 2008-12-05 14:47 603,904 --a------ c:\windows\system32\TUProgSt.exe
2008-12-05 14:47 . 2008-12-05 14:47 362,240 --a------ c:\windows\system32\TuneUpDefragService.exe
2008-12-05 14:47 . 2008-11-12 16:44 27,904 --a------ c:\windows\system32\uxtuneup.dll
2008-12-05 14:46 . 2008-12-05 14:46 <DIR> d-------- c:\documents and settings\Gustavo\Application Data\TuneUp Software
2008-12-05 14:46 . 2008-12-05 14:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2008-12-05 14:45 . 2008-12-05 14:49 <DIR> d-------- c:\program files\TuneUp Utilities 2009
2008-12-05 14:45 . 2008-12-05 14:45 <DIR> d--hs---- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2008-12-03 18:28 . 2008-12-03 18:28 38 --a------ c:\windows\avisplitter.INI
2008-11-28 19:33 . 2008-11-28 19:33 <DIR> d-------- c:\windows\A7E07C2B2220441587E3784D5814BC93.TMP
2008-11-28 19:32 . 2008-11-28 19:34 <DIR> d-------- c:\windows\NV36442096.TMP
2008-11-28 19:24 . 2008-11-28 19:24 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-11-28 19:24 . 2008-11-28 19:24 <DIR> d-------- c:\documents and settings\Gustavo\Application Data\SystemRequirementsLab
2008-11-27 13:56 . 2008-11-27 14:15 <DIR> d-------- c:\windows\system32\QuickTime
2008-11-27 13:56 . 2008-07-10 14:56 107,864 --a------ c:\windows\system32\tsccvid.dll
2008-11-22 19:10 . 2008-11-22 19:10 <DIR> d-------- c:\documents and settings\Gustavo\.jagex_cache_32

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-12-15 21:42 --------- d-----w c:\documents and settings\Gustavo\Application Data\mIRC
2008-12-15 21:40 31 ----a-w c:\documents and settings\Gustavo\jagex_runescape_preferences.dat
2008-12-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-14 17:49 --------- d-----w c:\program files\uTorrent
2008-12-14 17:48 --------- d-----w c:\documents and settings\Gustavo\Application Data\uTorrent
2008-12-03 01:08 --------- d-----w c:\documents and settings\Gustavo\Application Data\HPAppData
2008-11-29 03:32 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-28 04:22 --------- d-----w c:\program files\EPSON
2008-11-28 01:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-28 01:01 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-21 04:22 --------- d-----w c:\program files\Yahoo!
2008-11-21 04:22 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-15 07:08 --------- d-----w c:\documents and settings\Gustavo\Application Data\AVS4YOU
2008-11-15 07:07 --------- d-----w c:\program files\AVS4YOU
2008-11-15 07:06 --------- d-----w c:\program files\Common Files\AVSMedia
2008-11-15 05:37 --------- d-----w c:\program files\Folding@Home
2008-11-11 02:30 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-10-31 04:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-10-31 04:14 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-30 21:14 117,888 ----a-w c:\windows\system32\drivers\Rtenicxp.sys
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 00:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-23 00:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-10-22 07:10 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-19 03:12 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-19 02:52 --------- d-----w c:\documents and settings\Gustavo\Application Data\Malwarebytes
2008-10-19 02:51 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-10-18 23:29 --------- d-----w c:\program files\Java
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 03:46 --------- d-----w c:\documents and settings\Gustavo\Application Data\AVSMedia
2008-10-16 03:31 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2008-10-12 21:40 5,068,152 ----a-w c:\windows\system32\SpoonUninstall.exe
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-01 00:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-28 03:40 16,376 ----a-w c:\windows\gdrv.sys
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
.

------- Sigcheck -------

2007-10-30 08:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 03:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2008-04-02 21:58 360064 482ab7f9cd41702e8f856c11cfefb02d c:\windows\$NtServicePackUninstall$\tcpip.sys
2006-02-28 04:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB941644$\tcpip.sys
2008-04-13 11:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-04-13 11:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\ServicePackFiles\i386\TCPIP.SYS
2008-09-28 00:19 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\dllcache\TCPIP.SYS
2008-09-28 00:19 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"OODefragTray"="c:\windows\system32\oodtray.ex e" [2007-05-11 2512392]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168]
"NvMediaCenter"="c:\windows\system32\NvMcTray. dll" [2008-10-07 86016]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 c:\windows\RTHDCPL.exe]

c:\documents and settings\Gustavo\Start Menu\Programs\Startup\
Folding@Home 5.03.lnk - c:\program files\Folding@Home\winFAH.exe [2008-03-20 323584]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2008-08-16 1114112]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-09-27 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-09-27 23:32 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Steam\\steamapps\\hells3000\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Program Files\\LimeWire\\LimeWire.exe"=
"e:\\Program Files\\Russobit-M\\Worms Armageddon\\WA.exe"=
"e:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Double Agent\\SCDA-Offline\\System\\SplinterCell4.exe"=
"e:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Double Agent\\SCDA-Online\\System\\SCDA_online.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"57550:TCP"= 57550:TCPando P2P TCP Listening Port
"57550:UDP"= 57550:UDPando P2P UDP Listening Port

R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-02-29 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-02-29 55024]
R2 ekrn;Eset Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" [2008-06-10 468224]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [2008-12-05 603904]
S2 FAH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe;FAH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe;c:\documents and settings\Gustavo\Desktop\FAH504-Console.exe -svcstart []
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-06 33752]
S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-12-15 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 16:28]
.
- - - - ORPHANS REMOVED - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\AskBarDis\bar\bin\askBar.dll
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\AskBarDis\bar\bin\askBar.dll
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll


.
------- Supplementary Scan -------
.
IE: Add to AMV Converter... - e:\program files\MP3 Player Utilities 4.13\AMVConverter\grab.html
IE: Add to Media Manager... - e:\program files\MP3 Player Utilities 4.13\MediaManager\grab.html
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Gustavo\Application Data\Mozilla\Firefox\Profiles\woaod1xm.default\
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: e:\program files\VideoLAN\VLC\npvlc.dll
.

************************************************** ************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-15 14:09:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet004\Services\F AH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe]
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(996)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2008-12-15 14:12:16
ComboFix-quarantined-files.txt 2008-12-15 22:11:22

Pre-Run: 129,282,048 bytes free
Post-Run: 417,767,424 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Home Edition" /noexecute=optin /fastdetect

197 --- E O F --- 2008-12-14 00:40:45



-----------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:14:59 PM, on 12/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - Startup: Folding@Home 5.03.lnk = ?
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Add to AMV Converter... - E:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager... - E:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1222582528015
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FAH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe - Unknown owner - C:\Documents and Settings\Gustavo\Desktop\FAH504-Console.exe (file missing)
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 6781 bytes
__________________
NEC Display Solutions LCD2070NX-BK
E2140
Antec Nine Hundred Black Steel
Antec True Power Trio TP3-650
GA-P35-DS3L
BFG Tech BFGE85256GTE GeForce 8500GT 256MB
CORSAIR XMS2 2GB (2 x 1GB) (PC2 6400)
FOLDING FOR THE GOOD OF MANKIND :F@H Team 44358
hells3000 is offline   Reply With Quote


Old 12-15-2008, 11:26 PM   #2 (permalink)
Diamond Member
 
Respital's Avatar
 
Join Date: Aug 2007
Location: Canada
Age: 15
Posts: 2,646
Default
Please see ***************IMPORTANT: Please read before posting******************** and post the requested logs so that we may accurately identify and remove any malware present.
__________________
Winner of Photo Tourney: Twilight
/My Rig:/
/Case :/ Antec Sonata III
/Power Supply :/ Antec Earthquake 500W
/Motherboard :/ Gigabyte P35-DSR3
/Processor :/ Intel E6850@3.4Ghz
/Ram :/ Consair 2x 1 Gb 800mhz
/Video Card :/ Zotac 8800 GT
/Monitor:/Samsung T220 w 20 000 : 1 Contrast and 2ms response time
/3DMark06 Score :/ 11730
Respital is offline   Reply With Quote
Old 12-15-2008, 11:36 PM   #3 (permalink)
Platinum Member
 
Join Date: Sep 2005
Location: In My House
Posts: 948
Default
I did what it said 0_0

thanks for your help kid
__________________
NEC Display Solutions LCD2070NX-BK
E2140
Antec Nine Hundred Black Steel
Antec True Power Trio TP3-650
GA-P35-DS3L
BFG Tech BFGE85256GTE GeForce 8500GT 256MB
CORSAIR XMS2 2GB (2 x 1GB) (PC2 6400)
FOLDING FOR THE GOOD OF MANKIND :F@H Team 44358
hells3000 is offline   Reply With Quote
Old 12-15-2008, 11:41 PM   #4 (permalink)
Diamond Member
 
Respital's Avatar
 
Join Date: Aug 2007
Location: Canada
Age: 15
Posts: 2,646
Default
Quote:
Originally Posted by hells3000 View Post
I did what it said 0_0

thanks for your help kid
Please post the logs generated by both programs.
__________________
Winner of Photo Tourney: Twilight
/My Rig:/
/Case :/ Antec Sonata III
/Power Supply :/ Antec Earthquake 500W
/Motherboard :/ Gigabyte P35-DSR3
/Processor :/ Intel E6850@3.4Ghz
/Ram :/ Consair 2x 1 Gb 800mhz
/Video Card :/ Zotac 8800 GT
/Monitor:/Samsung T220 w 20 000 : 1 Contrast and 2ms response time
/3DMark06 Score :/ 11730
Respital is offline   Reply With Quote
Old 12-22-2008, 06:08 AM   #5 (permalink)
Platinum Member
 
Join Date: Sep 2005
Location: In My House
Posts: 948
Default
I lost the logs...


I tried running the malwarebytes but it did not work

I reinstalled and when I am on setup I get errors.



__________________
NEC Display Solutions LCD2070NX-BK
E2140
Antec Nine Hundred Black Steel
Antec True Power Trio TP3-650
GA-P35-DS3L
BFG Tech BFGE85256GTE GeForce 8500GT 256MB
CORSAIR XMS2 2GB (2 x 1GB) (PC2 6400)
FOLDING FOR THE GOOD OF MANKIND :F@H Team 44358
hells3000 is offline   Reply With Quote


Old 12-23-2008, 03:42 AM   #6 (permalink)
Platinum Member
 
Join Date: Sep 2005
Location: In My House
Posts: 948
Default
Malwarebytes' Anti-Malware 1.31
Database version: 1533
Windows 5.1.2600 Service Pack 3

12/22/2008 6:41:06 PM
mbam-log-2008-12-22 (18-41-06).txt

Scan type: Quick Scan
Objects scanned: 52464
Time elapsed: 15 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



ComboFix 08-12-21.04 - Gustavo 2008-12-22 18:12:58.4 - NTFSx86
Running from: c:\documents and settings\Gustavo\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-11-23 to 2008-12-23 )))))))))))))))))))))))))))))))
.

2008-12-22 14:19 . 2002-04-15 22:13 245,760 --a------ c:\windows\Matrix Code Emulator.scr
2008-12-21 20:55 . 2008-12-21 21:00 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-21 20:55 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-21 20:55 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-19 18:55 . 2008-12-19 19:00 <DIR> d-------- c:\program files\DFX
2008-12-15 20:10 . 2008-12-15 20:10 <DIR> d-------- c:\windows\system32\AGEIA
2008-12-15 20:10 . 2008-12-15 20:10 <DIR> d-------- c:\program files\AGEIA Technologies
2008-12-15 20:07 . 2008-10-07 13:33 453,152 --a------ c:\windows\system32\nvudisp.exe
2008-12-15 20:07 . 2008-12-22 16:41 200,819 --a------ c:\windows\system32\nvapps.xml
2008-12-15 20:07 . 2008-10-07 13:33 18,477 --a------ c:\windows\system32\nvdisp.nvu
2008-12-15 20:04 . 2008-10-02 10:07 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2008-12-15 18:40 . 2008-12-15 18:41 <DIR> d-------- c:\documents and settings\Administrator
2008-12-15 17:43 . 2008-12-15 20:16 <DIR> d-------- c:\windows\nview
2008-12-15 15:29 . 2008-12-15 15:28 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-15 15:22 . 2008-02-28 12:26 1,414,440 --a------ c:\windows\system32\ShellManager310E2D762.dll
2008-12-15 15:22 . 2008-02-28 12:01 774,144 --a------ c:\windows\system32\NEROINSTAEC43759.DB
2008-12-13 16:13 . 2008-12-13 16:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\SwiftKit
2008-12-05 14:46 . 2008-12-05 14:46 <DIR> d-------- c:\documents and settings\Gustavo\Application Data\TuneUp Software
2008-12-05 14:46 . 2008-12-05 14:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2008-12-05 14:45 . 2008-12-05 14:45 <DIR> d--hs---- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2008-12-03 18:28 . 2008-12-03 18:28 38 --a------ c:\windows\avisplitter.INI
2008-11-28 19:32 . 2008-11-28 19:34 <DIR> d-------- c:\windows\NV36442096.TMP
2008-11-28 19:24 . 2008-11-28 19:24 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-11-28 19:24 . 2008-11-28 19:24 <DIR> d-------- c:\documents and settings\Gustavo\Application Data\SystemRequirementsLab
2008-11-27 13:56 . 2008-11-27 14:15 <DIR> d-------- c:\windows\system32\QuickTime
2008-11-27 13:56 . 2008-07-10 14:56 107,864 --a------ c:\windows\system32\tsccvid.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-12-22 22:43 --------- d-----w c:\documents and settings\Gustavo\Application Data\uTorrent
2008-12-22 04:54 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2008-12-22 04:43 --------- d-----w c:\program files\HP
2008-12-20 02:59 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-19 12:13 31 ----a-w c:\documents and settings\Gustavo\jagex_runescape_preferences.dat
2008-12-19 11:40 --------- d-----w c:\documents and settings\Gustavo\Application Data\mIRC
2008-12-16 01:29 --------- d-----w c:\program files\Windows Desktop Search
2008-12-15 23:42 --------- d-----w c:\program files\Steam
2008-12-15 23:34 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-15 23:26 --------- d-----w c:\program files\Common Files\Nero
2008-12-15 23:26 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-12-15 23:10 --------- d-----w c:\program files\Java
2008-12-15 23:05 --------- d-----w c:\program files\Common Files\AVSMedia
2008-12-15 23:04 --------- d-----w c:\program files\AVS4YOU
2008-12-15 09:49 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-14 17:49 --------- d-----w c:\program files\uTorrent
2008-12-03 01:08 --------- d-----w c:\documents and settings\Gustavo\Application Data\HPAppData
2008-11-28 04:22 --------- d-----w c:\program files\EPSON
2008-11-28 01:01 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-21 04:22 --------- d-----w c:\program files\Yahoo!
2008-11-21 04:22 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-15 07:08 --------- d-----w c:\documents and settings\Gustavo\Application Data\AVS4YOU
2008-11-11 02:30 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-10-31 04:15 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-10-31 04:14 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-10-30 21:14 117,888 ----a-w c:\windows\system32\drivers\Rtenicxp.sys
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-12 21:40 5,068,152 ----a-w c:\windows\system32\SpoonUninstall.exe
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-10-01 00:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-28 03:40 16,376 ----a-w c:\windows\gdrv.sys
.

------- Sigcheck -------

2007-10-30 08:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 03:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2008-04-02 21:58 360064 482ab7f9cd41702e8f856c11cfefb02d c:\windows\$NtServicePackUninstall$\tcpip.sys
2006-02-28 04:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB941644$\tcpip.sys
2008-04-13 11:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\$NtUninstallKB951748$\tcpip.sys
2008-04-13 11:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\ServicePackFiles\i386\TCPIP.SYS
2008-09-28 00:19 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\dllcache\TCPIP.SYS
2008-09-28 00:19 361600 d24ea301e2b36c4e975fd216ca85d8e7 c:\windows\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((( snapshot@2008-12-22_15.42.08.68 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-23 00:37:46 16,384 ----atw c:\windows\temp\Perflib_Perfdata_5d4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168]
"SunJavaUpdateSched"="e:\program files\Java\jre6\bin\jusched.exe" [2008-12-15 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray. dll" [2008-10-07 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-09-27 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-09-27 23:32 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Steam\\steamapps\\hells3000\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Program Files\\Russobit-M\\Worms Armageddon\\WA.exe"=
"e:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Double Agent\\SCDA-Offline\\System\\SplinterCell4.exe"=
"e:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Double Agent\\SCDA-Online\\System\\SCDA_online.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"57550:TCP"= 57550:TCPando P2P TCP Listening Port
"57550:UDP"= 57550:UDPando P2P UDP Listening Port

R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-02-29 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-02-29 55024]
R2 ekrn;Eset Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" [2008-06-10 468224]
S2 FAH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe;FAH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe;c:\documents and settings\Gustavo\Desktop\FAH504-Console.exe -svcstart []
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-06 33752]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system3 2\drivers\mbamswissarmy.sys [2008-12-21 38496]
S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Gustavo\Application Data\Mozilla\Firefox\Profiles\woaod1xm.default\
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: e:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: e:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: e:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: e:\program files\VideoLAN\VLC\npvlc.dll
.

************************************************** ************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-22 18:15:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet006\Services\F AH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe]
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(980)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2008-12-22 18:18:23
ComboFix-quarantined-files.txt 2008-12-23 02:17:18
ComboFix2.txt 2008-12-22 23:44:07
ComboFix3.txt 2008-12-15 22:12:17

Pre-Run: 1,142,509,568 bytes free
Post-Run: 1,123,618,816 bytes free

173 --- E O F --- 2008-12-18 11:02:53
__________________
NEC Display Solutions LCD2070NX-BK
E2140
Antec Nine Hundred Black Steel
Antec True Power Trio TP3-650
GA-P35-DS3L
BFG Tech BFGE85256GTE GeForce 8500GT 256MB
CORSAIR XMS2 2GB (2 x 1GB) (PC2 6400)
FOLDING FOR THE GOOD OF MANKIND :F@H Team 44358
hells3000 is offline   Reply With Quote
Old 12-23-2008, 03:45 AM   #7 (permalink)
Platinum Member
 
Join Date: Sep 2005
Location: In My House
Posts: 948
Default
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:45:06 PM, on 12/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
E:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1222582528015
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FAH@C:+Documents and Settings+Gustavo+Desktop+FAH504-Console.exe - Unknown owner - C:\Documents and Settings\Gustavo\Desktop\FAH504-Console.exe (file missing)
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4835 bytes
__________________
NEC Display Solutions LCD2070NX-BK
E2140
Antec Nine Hundred Black Steel
Antec True Power Trio TP3-650
GA-P35-DS3L
BFG Tech BFGE85256GTE GeForce 8500GT 256MB
CORSAIR XMS2 2GB (2 x 1GB) (PC2 6400)
FOLDING FOR THE GOOD OF MANKIND :F@H Team 44358
hells3000 is offline   Reply With Quote
Old 12-23-2008, 09:34 PM   #8 (permalink)
Platinum Member
 
Join Date: Sep 2005
Location: In My House
Posts: 948
Default
bump...
__________________
NEC Display Solutions LCD2070NX-BK
E2140
Antec Nine Hundred Black Steel
Antec True Power Trio TP3-650
GA-P35-DS3L
BFG Tech BFGE85256GTE GeForce 8500GT 256MB
CORSAIR XMS2 2GB (2 x 1GB) (PC2 6400)
FOLDING FOR THE GOOD OF MANKIND :F@H Team 44358
hells3000 is offline   Reply With Quote
Old 12-23-2008, 10:06 PM   #9 (permalink)
Moderator
 
johnb35's Avatar
 
Join Date: Sep 2005
Location: Near Joliet Illinois
Age: 39
Posts: 3,612
Default
Your log is clean. What issues are you having if any now?
__________________
Motherboard - Gigabyte GA-EP45-UD3R
CPU - E8400
Memory - 2GB Corsair XMS2 (2x 1gb)
Graphics - ATI HD3870
Hard Drives - 250GB Seagate
DVD Drive - Lite-On
DVD Burner - Lite-On
Power Supply - Rosewill RP600V2-S-SL 600W
22" Acer widescreen AL2216WBD
johnb35 is offline   Reply With Quote
Old 12-23-2008, 10:20 PM   #10 (permalink)
Platinum Member
 
Join Date: Sep 2005
Location: In My House
Posts: 948
Default
My pc is slow

I can't multi-task properly

windows freeze on me

then I get errors

asks me to send a report, which I do

then goes to the microsoft page and tells me to lower my gpu acceleration or to get the latest driver.



When windows is loading it takes more than a minute.

I am starting to believe it's my gpu...
__________________
NEC Display Solutions LCD2070NX-BK
E2140
Antec Nine Hundred Black Steel
Antec True Power Trio TP3-650
GA-P35-DS3L
BFG Tech BFGE85256GTE GeForce 8500GT 256MB
CORSAIR XMS2 2GB (2 x 1GB) (PC2 6400)
FOLDING FOR THE GOOD OF MANKIND :F@H Team 44358
Last edited by hells3000; 12-23-2008 at 10:23 PM.
hells3000 is offline   Reply With Quote
Reply
Page 1 of 2 1 2

Bookmarks

« Previous Thread | Next Thread »
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes
Hybrid Mode Hybrid Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Similar Threads
Thread Thread Starter Forum Replies Last Post
HIJACK LOG, can't search, HIJACK LOG xroxis01 Computer Security 7 06-09-2008 09:37 PM
computer crashing - hijack this log supercoop06 Computer Security 0 12-02-2006 10:59 PM
homepage hijack! craigh Computer Security 2 04-05-2006 05:17 PM
File missing, Can't fix it with Hijack this. ANNR Operating Systems 6 03-28-2006 09:51 PM


All times are GMT +1. The time now is 05:37 PM.

Contact Us - Computer Forum - Sitemap - Top

Powered by: vBulletin Version 3.8.4
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.3.0 ©2009, Crawlability, Inc.
Copyright © 2002-2009 Computer Forum - Internet Business - Web Design Forum