Computer slow, freezes, shuts down internet, sound erratic

BullGuard Antivirus Forum > Virus > Virus Questions > Computer slow, freezes, shuts down internet, sound erratic

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Avastreader
New Member

Date Joined Sep 2008
Total Posts : 6

Posted 9-15-2008 1:57 (GMT +1)

My computer is acting really funny. When I open any window it takes a long tame to open and when I open more it freezes. The internet is just terrible. It freezes, takes a long time to open, and it logs me off, closing all windows. Sound is erratic with lots of static when I use the messenger with the camera. I have updated my Microsoft Windows to version SP3. Per your recommendations I downloaded and ran CCleaner, Superantispyware and Combofix. Below are my logs for Combofix and Hijackthis.

Thank you so much for all your help.

ComboFix 08-09-10.02 - Owner 2008-09-10 17:56:22.2 - NTFSx86
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 )))))))))))))))))))))))))))))))
.

2008-09-10 17:45 . 2008-09-10 17:52 <DIR> d-------- C:\HJT
2008-09-10 15:56 . 2008-09-10 15:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-10 15:55 . 2008-09-10 15:56 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-10 15:55 . 2008-09-10 15:55 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2008-09-10 15:54 . 2008-09-10 15:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-10 15:16 . 2008-09-10 15:16 <DIR> d-------- C:\Program Files\CCleaner
2008-09-08 18:52 . 2008-09-08 18:52 230,424 --a------ C:\DC6810xp-001.raw
2008-09-06 18:48 . 2008-09-06 18:48 230,424 --a------ C:\DC6810xp-002.raw
2008-09-05 22:03 . 2008-04-13 17:12 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2008-09-05 22:03 . 2008-04-13 17:12 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
2008-09-05 22:03 . 2008-04-13 11:46 15,232 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2008-09-05 22:03 . 2008-04-13 11:46 15,232 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2008-09-05 22:03 . 2008-04-13 11:46 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2008-09-05 22:03 . 2008-04-13 11:46 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2008-09-05 22:03 . 2008-04-13 11:39 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2008-09-05 22:03 . 2008-04-13 11:39 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2008-09-05 22:02 . 2008-04-13 11:46 85,248 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2008-09-05 22:02 . 2008-04-13 11:46 85,248 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
2008-09-05 22:02 . 2008-04-13 11:46 19,200 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2008-09-05 22:02 . 2008-04-13 11:46 19,200 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
2008-09-05 22:02 . 2008-04-13 11:46 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2008-09-05 22:02 . 2008-04-13 11:46 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
2008-09-05 22:01 . 2008-04-13 11:46 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2008-09-05 22:01 . 2008-04-13 11:46 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
2008-09-05 22:00 . 2008-04-13 17:12 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-09-05 22:00 . 2008-04-13 17:12 91,136 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-09-05 22:00 . 2008-04-13 17:12 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-09-05 22:00 . 2008-04-13 17:12 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-09-05 22:00 . 2008-04-13 17:12 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-09-05 22:00 . 2008-04-13 17:12 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-09-05 22:00 . 2008-04-13 17:12 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-09-05 22:00 . 2008-04-13 17:12 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-09-05 21:57 . 2007-04-10 14:46 2,385,896 --a------ C:\WINDOWS\system32\drivers\VX6000Xp.sys
2008-09-05 21:57 . 2007-04-10 14:46 996,712 --a------ C:\WINDOWS\vVX6000.exe
2008-09-05 21:57 . 2007-04-10 14:46 484,712 --a------ C:\WINDOWS\system32\vVX6000.dll
2008-09-05 21:57 . 2007-04-10 14:46 202,088 --a------ C:\WINDOWS\system32\LCCoin14.dll
2008-09-05 21:57 . 2007-04-10 14:46 185,704 --a------ C:\WINDOWS\system32\cVX6000.dll
2008-09-05 21:57 . 2007-04-10 14:46 116,072 --a------ C:\WINDOWS\system32\VX6000.dll
2008-09-05 21:57 . 2007-04-10 14:46 36,328 --a------ C:\WINDOWS\system32\drivers\VX6KCamd.sys
2008-09-05 21:57 . 2007-04-10 14:46 15,497 --a------ C:\WINDOWS\VX6KStd.ini
2008-09-05 21:57 . 2007-04-10 14:46 13,022 --a------ C:\WINDOWS\VX6000.src
2008-09-05 21:54 . 2008-09-05 21:57 <DIR> d-------- C:\Program Files\Microsoft LifeCam
2008-09-05 21:25 . 2008-09-05 21:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-09-05 13:55 . 2008-09-05 13:55 <DIR> d-------- C:\WINDOWS\system32\drivers\umdf
2008-09-05 13:53 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2008-09-05 13:53 . 2006-07-28 09:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2008-09-05 13:53 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-09-05 13:53 . 2006-07-28 09:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2008-09-05 13:53 . 2006-09-28 16:03 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-08-27 19:04 . 2008-08-27 19:04 <DIR> d-------- C:\Program Files\Odyssey Technologies, Inc
2008-08-27 19:04 . 1999-02-18 10:57 97,552 --a------ C:\WINDOWS\system32\MSCOMM32.OCX
2008-08-27 19:04 . 2008-08-27 19:04 0 --a------ C:\WINDOWS\PROTOCOL.INI
2008-08-27 19:02 . 1998-09-23 12:15 299,520 --a------ C:\WINDOWS\uninst.exe
2008-08-27 18:26 . 2008-04-13 11:45 60,032 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-08-27 18:26 . 2008-04-13 11:45 60,032 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-08-27 18:23 . 2008-04-13 11:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-08-27 18:23 . 2008-04-13 11:45 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-08-14 00:50 . 2008-05-01 07:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-11 00:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-10 10:10 --------- d-----w C:\Program Files\Microsoft Works
2008-09-02 19:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\HAURI
2008-08-27 09:52 --------- d-----w C:\Documents and Settings\Owner\Application Data\ZoomBrowser EX
2008-08-27 09:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\CameraWindowDC
2008-08-20 20:40 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-07 23:02 --------- d-----w C:\Program Files\AVG
2008-07-28 21:05 --------- d-----w C:\Program Files\Common Files\Scanner
2008-07-28 21:05 --------- d-----w C:\Documents and Settings\Owner\Application Data\Netscape
2008-07-27 20:13 --------- d-----w C:\Documents and Settings\Owner\Application Data\CANON INC
2008-07-27 19:55 --------- d-----w C:\Program Files\Canon
2008-07-27 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-07-27 19:45 --------- d-----w C:\Program Files\Common Files\Canon
2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 05:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 05:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-19 05:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2007-02-24 21:16 2,518 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2008-06-07 05:43 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008060620080607\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-26 68856]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [X]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-02 29744]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-28 344064]
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 212992]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2006-11-07 1121280]
"VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-11-11 1005096]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-08 98304]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-26 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2008-07-30 4891984]
"VrSchedule"="C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\HrRes.exe" [2007-10-22 241664]
"Vrmon"="C:\Program Files\PCSecurityShield\Common\Base\Vrmonnt.exe" [2007-09-12 221184]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX6000"="C:\WINDOWS\vVX6000.exe" [2007-04-10 996712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 hpcsvc;ViRobot Communication Service;C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe [2007-06-26 270336]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-01-25 200576]
R3 VRFWNTD5;VRFWNTD5 Hauri Network Driver;C:\WINDOWS\system32\drivers\VRFWNTD5.sys [2007-04-24 80950]
R3 VRsecos;VRsecos;C:\WINDOWS\system32\drivers\VRsecos.sys [2007-08-31 15644]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-02 29744]
S3 vrrepair;ViRobot Repairing Service;C:\Program Files\PCSecurityShield\Common\Base\vrrepair.exe [2008-08-20 267616]
S3 VX6000;Microsoft LifeCam VX-6000;C:\WINDOWS\system32\DRIVERS\VX6000Xp.sys [2007-04-10 2385896]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c51d920-6c52-11dc-b926-00038a000015}]
\Shell\AutoRun\command - F:\LaunchU3.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - VRADFIL
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\njwpkafh.default\
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_02\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_02\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_02\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_02\bin\NPJava14.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_02\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_02\bin\NPJPI150_02.dll
FF -: plugin - C:\Program Files\Java\jre1.5.0_02\bin\NPOJI610.dll
FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-10 18:00:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-10 18:05:00
ComboFix-quarantined-files.txt 2008-09-11 01:04:50
ComboFix2.txt 2008-09-11 00:23:14

Pre-Run: 34,134,892,544 bytes free
Post-Run: 34,121,125,888 bytes free

213 --- E O F --- 2008-09-10 11:39:20

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:48:03 PM, on 9/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\PCSecurityShield\Common\hsvcmod.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\WINDOWS\system32\WLTRAY.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\HrRes.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\vVX6000.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee.com\PERSON~1\Mp!!!ent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsock.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clearwire.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: IEHelpObj Class - {EC45E3FE-C16D-4F24-9238-D1B49AD74815} - C:\Program Files\PCSecurityShield\ShieldPro\Service\hWebMan.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [VrSchedule] C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\HrRes.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\PCSecurityShield\Common\Base\Vrmonnt.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX6000] C:\WINDOWS\vVX6000.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ViRobot for WinNT(tm) Folder Protect (HFACSVC) - hauri - C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe
O23 - Service: ViRobot Communication Service (hpcsvc) - HAURI - C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe
O23 - Service: Hauri Common Service (hsvcmod) - HAURI Inc. - C:\Program Files\PCSecurityShield\Common\hsvcmod.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Hauri Firewall (vrfwsvc) - Hauri inc. - C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe
O23 - Service: ViRobot Desktop Monitoring (vrmonsvc) - HAURI - C:\Program Files\PCSecurityShield\Common\Base\vrmonsvc.exe
O23 - Service: ViRobot Repairing Service (vrrepair) - HAURI - C:\Program Files\PCSecurityShield\Common\Base\vrrepair.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 12053 bytes

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 16319

Posted 9-15-2008 5:15 (GMT +1)

Hello

It looks like you have two active antivirus programs running ?

"If the resident scanners of two different AV programs are used simultaneously, conflicts can result. The computer may run very, very slowly, it may become difficult to access files or the computer may crash altogether.”

I´ll therefore suggest you remove one of them from add/remove programs in controlpanel.

Reboot, post new hijackthis log

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Avastreader
New Member

Date Joined Sep 2008
Total Posts : 6

Posted 9-15-2008 9:25 (GMT +1)

Hello
Thank you for your very prompt reply.

I am in a dilemma. I not only have 2 AV but 3.
1.McAfee- I have wanted to get rid of it for a very long time, but I cannot find it on the Add/Remove program list. Any suggestions?
2.Shield Pro- We bought it a few months ago, but it hasn't found anything yet.
3.Avast- I just recently installed it, and it has found malware and viruses. There is currently a virus in the vault. If I delete this AV, will I need to transfer the virus to Shield Pro, and how do I that?

Overall I like Avast better, but I feel like I should keep Shield Pro because I paid for it. What do you think I should do?

Thank you again for all your help.

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 16319

Posted 9-16-2008 6:15 (GMT +1)

I think you should dectivate - VrSchedule] C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\HrRes.exe
from msconfig. Look here how to:

http://www.netsquirrel.com/msconfig/

And we´ll remove mcafee.

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

Killall::

Snapshot::

Folder::
c:\PROGRA~1\mcafee.com

Save this as:
CFScript

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

Then post fresh combofix log, along with new hijackthis log

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Avastreader
New Member

Date Joined Sep 2008
Total Posts : 6

Posted 9-18-2008 4:46 (GMT +1)

Hello

Thank you for your advice. I did what you said. I am sorry that it took so long to reply, but after I did the first step, the computer became extremely slow. It took until now to finally finish everything and send you the logs. After rebooting, the computer screen was blank for several hours. It took several hours for the windows start page to open up with all its pop ups. Going into the web was a nightmare - another several hours of waiting time to get in. Is this normal?

As you requested, below are the new Combofix and Hijackthis logs.

Thank you.

ComboFix 08-09-16.05 - Owner 2008-09-17 19:59:37.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.184 [GMT -7:00]Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-18 to 2008-09-18 )))))))))))))))))))))))))))))))
.

2008-09-10 17:45 . 2008-09-10 17:52 <DIR> d-------- C:\HJT
2008-09-10 15:56 . 2008-09-10 15:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-10 15:55 . 2008-09-10 15:56 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-10 15:55 . 2008-09-10 15:55 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2008-09-10 15:54 . 2008-09-10 15:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-10 15:16 . 2008-09-10 15:16 <DIR> d-------- C:\Program Files\CCleaner
2008-09-08 18:52 . 2008-09-08 18:52 230,424 --a------ C:\DC6810xp-001.raw
2008-09-06 18:48 . 2008-09-06 18:48 230,424 --a------ C:\DC6810xp-002.raw
2008-09-05 22:03 . 2008-04-13 17:12 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2008-09-05 22:03 . 2008-04-13 17:12 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax
2008-09-05 22:03 . 2008-04-13 11:46 15,232 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2008-09-05 22:03 . 2008-04-13 11:46 15,232 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys
2008-09-05 22:03 . 2008-04-13 11:46 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2008-09-05 22:03 . 2008-04-13 11:46 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys
2008-09-05 22:03 . 2008-04-13 11:39 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2008-09-05 22:03 . 2008-04-13 11:39 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys
2008-09-05 22:02 . 2008-04-13 11:46 85,248 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2008-09-05 22:02 . 2008-04-13 11:46 85,248 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys
2008-09-05 22:02 . 2008-04-13 11:46 19,200 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2008-09-05 22:02 . 2008-04-13 11:46 19,200 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys
2008-09-05 22:02 . 2008-04-13 11:46 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2008-09-05 22:02 . 2008-04-13 11:46 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys
2008-09-05 22:01 . 2008-04-13 11:46 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2008-09-05 22:01 . 2008-04-13 11:46 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys
2008-09-05 22:00 . 2008-04-13 17:12 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-09-05 22:00 . 2008-04-13 17:12 91,136 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax
2008-09-05 22:00 . 2008-04-13 17:12 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-09-05 22:00 . 2008-04-13 17:12 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax
2008-09-05 22:00 . 2008-04-13 17:12 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-09-05 22:00 . 2008-04-13 17:12 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll
2008-09-05 22:00 . 2008-04-13 17:12 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-09-05 22:00 . 2008-04-13 17:12 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax
2008-09-05 21:57 . 2007-04-10 14:46 2,385,896 --a------ C:\WINDOWS\system32\drivers\VX6000Xp.sys
2008-09-05 21:57 . 2007-04-10 14:46 996,712 --a------ C:\WINDOWS\vVX6000.exe
2008-09-05 21:57 . 2007-04-10 14:46 484,712 --a------ C:\WINDOWS\system32\vVX6000.dll
2008-09-05 21:57 . 2007-04-10 14:46 202,088 --a------ C:\WINDOWS\system32\LCCoin14.dll
2008-09-05 21:57 . 2007-04-10 14:46 185,704 --a------ C:\WINDOWS\system32\cVX6000.dll
2008-09-05 21:57 . 2007-04-10 14:46 116,072 --a------ C:\WINDOWS\system32\VX6000.dll
2008-09-05 21:57 . 2007-04-10 14:46 36,328 --a------ C:\WINDOWS\system32\drivers\VX6KCamd.sys
2008-09-05 21:57 . 2007-04-10 14:46 15,497 --a------ C:\WINDOWS\VX6KStd.ini
2008-09-05 21:57 . 2007-04-10 14:46 13,022 --a------ C:\WINDOWS\VX6000.src
2008-09-05 21:54 . 2008-09-05 21:57 <DIR> d-------- C:\Program Files\Microsoft LifeCam
2008-09-05 21:25 . 2008-09-05 21:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-09-05 13:55 . 2008-09-05 13:55 <DIR> d-------- C:\WINDOWS\system32\drivers\umdf
2008-09-05 13:53 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2008-09-05 13:53 . 2006-07-28 09:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2008-09-05 13:53 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2008-09-05 13:53 . 2006-07-28 09:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2008-09-05 13:53 . 2006-09-28 16:03 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2008-08-27 19:04 . 2008-08-27 19:04 <DIR> d-------- C:\Program Files\Odyssey Technologies, Inc
2008-08-27 19:04 . 1999-02-18 10:57 97,552 --a------ C:\WINDOWS\system32\MSCOMM32.OCX
2008-08-27 19:04 . 2008-08-27 19:04 0 --a------ C:\WINDOWS\PROTOCOL.INI
2008-08-27 19:02 . 1998-09-23 12:15 299,520 --a------ C:\WINDOWS\uninst.exe
2008-08-27 18:26 . 2008-04-13 11:45 60,032 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-08-27 18:26 . 2008-04-13 11:45 60,032 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-08-27 18:23 . 2008-04-13 11:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-08-27 18:23 . 2008-04-13 11:45 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-17 01:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-17 01:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-10 10:10 --------- d-----w C:\Program Files\Microsoft Works
2008-09-02 19:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\HAURI
2008-08-27 09:52 --------- d-----w C:\Documents and Settings\Owner\Application Data\ZoomBrowser EX
2008-08-27 09:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\CameraWindowDC
2008-08-07 23:02 --------- d-----w C:\Program Files\AVG
2008-07-28 21:05 --------- d-----w C:\Program Files\Common Files\Scanner
2008-07-28 21:05 --------- d-----w C:\Documents and Settings\Owner\Application Data\Netscape
2008-07-27 20:13 --------- d-----w C:\Documents and Settings\Owner\Application Data\CANON INC
2008-07-27 19:55 --------- d-----w C:\Program Files\Canon
2008-07-27 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-07-27 19:45 --------- d-----w C:\Program Files\Common Files\Canon
2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 05:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 05:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-19 05:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2007-02-24 21:16 2,518 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2008-06-07 05:43 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008060620080607\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-26 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [X]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-02 29744]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 212992]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-28 344064]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2006-11-07 1121280]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-08 98304]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-26 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Vrmon"="C:\Program Files\PCSecurityShield\Common\Base\VRMONNT.EXE" [2007-09-12 221184]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX6000"="C:\WINDOWS\vVX6000.exe" [2007-04-10 996712]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-13 169984]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VrSchedule]
--a------ 2007-10-22 16:00 241664 C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\HrRes.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 hpcsvc;ViRobot Communication Service;C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe [2007-06-26 270336]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-01-25 200576]
R3 VRFWNTD5;VRFWNTD5 Hauri Network Driver;C:\WINDOWS\system32\drivers\VRFWNTD5.sys [2007-04-24 80950]
R3 VRsecos;VRsecos;C:\WINDOWS\system32\drivers\VRsecos.sys [2007-08-31 15644]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-02 29744]
S3 vrrepair;ViRobot Repairing Service;C:\Program Files\PCSecurityShield\Common\Base\vrrepair.exe [2008-08-20 267616]
S3 VX6000;Microsoft LifeCam VX-6000;C:\WINDOWS\system32\DRIVERS\VX6000Xp.sys [2007-04-10 2385896]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c51d920-6c52-11dc-b926-00038a000015}]
\Shell\AutoRun\command - F:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SpybotSnD - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-17 20:06:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe
C:\Program Files\PCSecurityShield\Common\hsvcmod.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe
C:\WINDOWS\system32\WLTRAY.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsock.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2008-09-17 20:21:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-18 03:21:04
ComboFix2.txt 2008-09-16 19:30:14
ComboFix3.txt 2008-09-11 01:05:02
ComboFix4.txt 2008-09-11 00:23:14

Pre-Run: 34,198,900,736 bytes free
Post-Run: 34,189,987,840 bytes free

215 --- E O F --- 2008-09-10 11:39:20

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:24:48 PM, on 9/17/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe
C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe
C:\Program Files\PCSecurityShield\Common\hsvcmod.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\hrres.exe
C:\WINDOWS\vVX6000.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsock.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clearwire.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: IEHelpObj Class - {EC45E3FE-C16D-4F24-9238-D1B49AD74815} - C:\Program Files\PCSecurityShield\ShieldPro\Service\hWebMan.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\PCSecurityShield\Common\Base\VRMONNT.EXE
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX6000] C:\WINDOWS\vVX6000.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ViRobot for WinNT(tm) Folder Protect (HFACSVC) - hauri - C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe
O23 - Service: ViRobot Communication Service (hpcsvc) - HAURI - C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe
O23 - Service: Hauri Common Service (hsvcmod) - HAURI Inc. - C:\Program Files\PCSecurityShield\Common\hsvcmod.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - Unknown owner - c:\program files\mcafee.com\agent\mcdetect.exe (file missing)
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe (file missing)
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - Unknown owner - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe (file missing)
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe (file missing)
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Hauri Firewall (vrfwsvc) - Hauri inc. - C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe
O23 - Service: ViRobot Desktop Monitoring (vrmonsvc) - HAURI - C:\Program Files\PCSecurityShield\Common\Base\vrmonsvc.exe
O23 - Service: ViRobot Repairing Service (vrrepair) - HAURI - C:\Program Files\PCSecurityShield\Common\Base\vrrepair.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 10717 bytes

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 16319

Posted 9-20-2008 5:58 (GMT +1)

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

Killall::

Snapshot::

Folder::
C:\PROGRA~1\McAfee

Driver::

McDetect.exe

McShield

McTskshd.exe

mcupdmgr.exe

MpfService

MskService

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

Save this as:
CFScript

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

Then post fresh combofix log, and tell how things are running ?

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Avastreader
New Member

Date Joined Sep 2008
Total Posts : 6

Posted 9-23-2008 5:12 (GMT +1)

Hello

I input this info into CCombofix as you suggested. The results were this: After rebooting, the computer started doing crazy things. Again, it took about 2 days for the computer to settle down to where I was able to open and close programs without taking so much time. These are some of the crazy things that started happening at the restart screen:

error messages:

-Google desktop problem…..did not start up successfully

-WLTRAY adapter disable

Avast warning messages – “Mail scanner warning Avast! Will not be able to protect outgoing/ingoing mail”:

-SMTP Protocol error:10044

-POP3 Protocol error:10044

-NNTP Protocol error:10044

-IMAP Protocol error:10044

And to top it all off, I can no longer get onto the internet. I had to use my computer at work to send you this information. There is a signal, and there is an “excellent connection”, but it is unable to use any of the servers to connect to the internet. What did I do wrong? Maybe from now on you should tell me what the possible side effects are to what we are doing and how to fix them?

Also, I was able to get into Task Manager, and I noticed that one of the VRMONSVC.EXE was running at 96000+ and SuperAntiSpyware was running at 76000+, while the rest of the processes were running no higher than 20000. I also noticed that there were 55 processes running. How did that happen? It is obvious that this was making the computer so slow. I ended up uninstalling the AV, just because I did not know what the other one was. At this point I am getting so frustrated that I am thinking about wiping the hard drive clean and starting all over.

How can I get the internet connection back? And, what do you think I should do next?

I know that you’re trying to help us, and I thank you for that. I hope to hear from you soon.

ComboFix 08-09-20.01 - Owner 2008-09-20 10:08:31.5 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.181 [GMT -7:00]

Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\PROGRA~1\McAfee

C:\PROGRA~1\McAfee\SpamKiller\borlndmm.dll

C:\PROGRA~1\McAfee\SpamKiller\McABImp.dll

C:\PROGRA~1\McAfee\SpamKiller\mcapfbho.dat

C:\PROGRA~1\McAfee\SpamKiller\McApfBHO.dll

C:\PROGRA~1\McAfee\SpamKiller\McLog.dll

C:\PROGRA~1\McAfee\SpamKiller\McMAPI.dll

C:\PROGRA~1\McAfee\SpamKiller\McRFC822.dll

C:\PROGRA~1\McAfee\SpamKiller\MSK.chm

C:\PROGRA~1\McAfee\SpamKiller\MSKAgent.exe

C:\PROGRA~1\McAfee\SpamKiller\MSKClien.inf

C:\PROGRA~1\McAfee\SpamKiller\MSKClnt.exe

C:\PROGRA~1\McAfee\SpamKiller\MSKColors.dat

C:\PROGRA~1\McAfee\SpamKiller\MSKCom.dll

C:\PROGRA~1\McAfee\SpamKiller\MSKCommo.inf

C:\PROGRA~1\McAfee\SpamKiller\mskdcr.exe

C:\PROGRA~1\McAfee\SpamKiller\MSKDetct.exe

C:\PROGRA~1\McAfee\SpamKiller\MSKDicti.inf

C:\PROGRA~1\McAfee\SpamKiller\MSKExtra.inf

C:\PROGRA~1\McAfee\SpamKiller\MSKFilte.inf

C:\PROGRA~1\McAfee\SpamKiller\MSKOEPlg.dll

C:\PROGRA~1\McAfee\SpamKiller\MSKOlHlp.exe

C:\PROGRA~1\McAfee\SpamKiller\MSKOLPlg.dll

C:\PROGRA~1\McAfee\SpamKiller\MSKOLRes.dll

C:\PROGRA~1\McAfee\SpamKiller\MSKPing.dll

C:\PROGRA~1\McAfee\SpamKiller\MSKProto.inf

C:\PROGRA~1\McAfee\SpamKiller\MSKRescs.dll

C:\PROGRA~1\McAfee\SpamKiller\MSKResou.inf

C:\PROGRA~1\McAfee\SpamKiller\MSKServe.inf

C:\PROGRA~1\McAfee\SpamKiller\MSKSrvr.exe

C:\PROGRA~1\McAfee\SpamKiller\MSKSrvr.tlb

C:\PROGRA~1\McAfee\SpamKiller\MSKUI.dll

C:\PROGRA~1\McAfee\SpamKiller\MSN.phd

C:\PROGRA~1\McAfee\SpamKiller\msvcr71.dll

C:\PROGRA~1\McAfee\SpamKiller\POP3.phd

C:\PROGRA~1\McAfee\SpamKiller\ReadMe.txt

C:\PROGRA~1\McAfee\SpamKiller\SMTP.phd

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\Legacy_MCDETECT.EXE

-------\Legacy_MCSHIELD

-------\Legacy_MCTSKSHD.EXE

-------\Legacy_MCUPDMGR.EXE

-------\Legacy_MPFSERVICE

-------\Legacy_MSKSERVICE

-------\Service_McDetect.exe

-------\Service_McShield

-------\Service_McTskshd.exe

-------\Service_mcupdmgr.exe

-------\Service_MpfService

-------\Service_MskService

((((((((((((((((((((((((( Files Created from 2008-08-20 to 2008-09-20 )))))))))))))))))))))))))))))))

2008-09-10 17:45 . 2008-09-10 17:52 <DIR> d-------- C:\HJT

2008-09-10 15:56 . 2008-09-10 15:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

2008-09-10 15:55 . 2008-09-10 15:56 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2008-09-10 15:55 . 2008-09-10 15:55 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com

2008-09-10 15:54 . 2008-09-10 15:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-09-10 15:16 . 2008-09-10 15:16 <DIR> d-------- C:\Program Files\CCleaner

2008-09-08 18:52 . 2008-09-08 18:52 230,424 --a------ C:\DC6810xp-001.raw

2008-09-06 18:48 . 2008-09-06 18:48 230,424 --a------ C:\DC6810xp-002.raw

2008-09-05 22:03 . 2008-04-13 17:12 16,384 --a------ C:\WINDOWS\system32\ipsink.ax

2008-09-05 22:03 . 2008-04-13 17:12 16,384 --a--c--- C:\WINDOWS\system32\dllcache\ipsink.ax

2008-09-05 22:03 . 2008-04-13 11:46 15,232 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys

2008-09-05 22:03 . 2008-04-13 11:46 15,232 --a--c--- C:\WINDOWS\system32\dllcache\streamip.sys

2008-09-05 22:03 . 2008-04-13 11:46 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys

2008-09-05 22:03 . 2008-04-13 11:46 10,880 --a--c--- C:\WINDOWS\system32\dllcache\ndisip.sys

2008-09-05 22:03 . 2008-04-13 11:39 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys

2008-09-05 22:03 . 2008-04-13 11:39 5,504 --a--c--- C:\WINDOWS\system32\dllcache\mstee.sys

2008-09-05 22:02 . 2008-04-13 11:46 85,248 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys

2008-09-05 22:02 . 2008-04-13 11:46 85,248 --a--c--- C:\WINDOWS\system32\dllcache\nabtsfec.sys

2008-09-05 22:02 . 2008-04-13 11:46 19,200 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS

2008-09-05 22:02 . 2008-04-13 11:46 19,200 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys

2008-09-05 22:02 . 2008-04-13 11:46 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys

2008-09-05 22:02 . 2008-04-13 11:46 11,136 --a--c--- C:\WINDOWS\system32\dllcache\slip.sys

2008-09-05 22:01 . 2008-04-13 11:46 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys

2008-09-05 22:01 . 2008-04-13 11:46 17,024 --a--c--- C:\WINDOWS\system32\dllcache\ccdecode.sys

2008-09-05 22:00 . 2008-04-13 17:12 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax

2008-09-05 22:00 . 2008-04-13 17:12 91,136 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax

2008-09-05 22:00 . 2008-04-13 17:12 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax

2008-09-05 22:00 . 2008-04-13 17:12 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax

2008-09-05 22:00 . 2008-04-13 17:12 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll

2008-09-05 22:00 . 2008-04-13 17:12 53,760 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll

2008-09-05 22:00 . 2008-04-13 17:12 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax

2008-09-05 22:00 . 2008-04-13 17:12 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax

2008-09-05 21:57 . 2007-04-10 14:46 2,385,896 --a------ C:\WINDOWS\system32\drivers\VX6000Xp.sys

2008-09-05 21:57 . 2007-04-10 14:46 996,712 --a------ C:\WINDOWS\vVX6000.exe

2008-09-05 21:57 . 2007-04-10 14:46 484,712 --a------ C:\WINDOWS\system32\vVX6000.dll

2008-09-05 21:57 . 2007-04-10 14:46 202,088 --a------ C:\WINDOWS\system32\LCCoin14.dll

2008-09-05 21:57 . 2007-04-10 14:46 185,704 --a------ C:\WINDOWS\system32\cVX6000.dll

2008-09-05 21:57 . 2007-04-10 14:46 116,072 --a------ C:\WINDOWS\system32\VX6000.dll

2008-09-05 21:57 . 2007-04-10 14:46 36,328 --a------ C:\WINDOWS\system32\drivers\VX6KCamd.sys

2008-09-05 21:57 . 2007-04-10 14:46 15,497 --a------ C:\WINDOWS\VX6KStd.ini

2008-09-05 21:57 . 2007-04-10 14:46 13,022 --a------ C:\WINDOWS\VX6000.src

2008-09-05 21:54 . 2008-09-05 21:57 <DIR> d-------- C:\Program Files\Microsoft LifeCam

2008-09-05 21:25 . 2008-09-05 21:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8

2008-09-05 13:55 . 2008-09-05 13:55 <DIR> d-------- C:\WINDOWS\system32\drivers\umdf

2008-09-05 13:53 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll

2008-09-05 13:53 . 2006-07-28 09:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll

2008-09-05 13:53 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll

2008-09-05 13:53 . 2006-07-28 09:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll

2008-09-05 13:53 . 2006-09-28 16:03 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll

2008-08-27 19:04 . 2008-08-27 19:04 <DIR> d-------- C:\Program Files\Odyssey Technologies, Inc

2008-08-27 19:04 . 1999-02-18 10:57 97,552 --a------ C:\WINDOWS\system32\MSCOMM32.OCX

2008-08-27 19:04 . 2008-08-27 19:04 0 --a------ C:\WINDOWS\PROTOCOL.INI

2008-08-27 19:02 . 1998-09-23 12:15 299,520 --a------ C:\WINDOWS\uninst.exe

2008-08-27 18:26 . 2008-04-13 11:45 60,032 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys

2008-08-27 18:26 . 2008-04-13 11:45 60,032 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys

2008-08-27 18:23 . 2008-04-13 11:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys

2008-08-27 18:23 . 2008-04-13 11:45 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-09-17 01:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy

2008-09-17 01:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-09-10 10:10 --------- d-----w C:\Program Files\Microsoft Works

2008-09-02 19:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\HAURI

2008-08-27 09:52 --------- d-----w C:\Documents and Settings\Owner\Application Data\ZoomBrowser EX

2008-08-27 09:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\CameraWindowDC

2008-08-07 23:02 --------- d-----w C:\Program Files\AVG

2008-07-28 21:05 --------- d-----w C:\Program Files\Common Files\Scanner

2008-07-28 21:05 --------- d-----w C:\Documents and Settings\Owner\Application Data\Netscape

2008-07-27 20:13 --------- d-----w C:\Documents and Settings\Owner\Application Data\CANON INC

2008-07-27 19:55 --------- d-----w C:\Program Files\Canon

2008-07-27 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser

2008-07-27 19:45 --------- d-----w C:\Program Files\Common Files\Canon

2007-02-24 21:16 2,518 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat

2008-06-07 05:43 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008060620080607\index.dat

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-26 68856]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [X]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 32768]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-02 29744]

"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]

"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 212992]

"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-28 344064]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-08 98304]

"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-26 185896]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"Vrmon"="C:\Program Files\PCSecurityShield\Common\Base\VRMONNT.EXE" [2007-09-12 221184]

"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]

"VX6000"="C:\WINDOWS\vVX6000.exe" [2007-04-10 996712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Power2GoExpress"="NA" [X]

"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk

backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk

backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VrSchedule]

--a------ 2007-10-22 16:00 241664 C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\HrRes.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Messenger\\msmsgs.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]

R2 hpcsvc;ViRobot Communication Service;C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe [2007-06-26 270336]

R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]

R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-01-25 200576]

R3 VRFWNTD5;VRFWNTD5 Hauri Network Driver;C:\WINDOWS\system32\drivers\VRFWNTD5.sys [2007-04-24 80950]

R3 VRsecos;VRsecos;C:\WINDOWS\system32\drivers\VRsecos.sys [2007-08-31 15644]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-02 29744]

S3 vrrepair;ViRobot Repairing Service;C:\Program Files\PCSecurityShield\Common\Base\vrrepair.exe [2008-08-20 267616]

S3 VX6000;Microsoft LifeCam VX-6000;C:\WINDOWS\system32\DRIVERS\VX6000Xp.sys [2007-04-10 2385896]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

\Shell\AutoRun\command - F:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c51d920-6c52-11dc-b926-00038a000015}]

\Shell\AutoRun\command - F:\LaunchU3.exe

Contents of the 'Scheduled Tasks' folder

- - - - ORPHANS REMOVED - - - -

HKLM-Run-MSKAGENTEXE - C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

HKLM-Run-MSKDetectorExe - C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-09-20 10:14:50

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

------------------------ Other Running Processes ------------------------

C:\WINDOWS\system32\ati2evxx.exe

C:\WINDOWS\system32\WLTRYSVC.EXE

C:\WINDOWS\system32\BCMWLTRY.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\ati2evxx.exe

C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe

C:\Program Files\PCSecurityShield\Common\hsvcmod.exe

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsock.exe

C:\WINDOWS\system32\WLTRAY.EXE

**************************************************************************

Completion time: 2008-09-20 11:38:52 - machine was rebooted

ComboFix-quarantined-files.txt 2008-09-20 18:38:42

ComboFix2.txt 2008-09-18 03:21:37

ComboFix3.txt 2008-09-16 19:30:14

ComboFix4.txt 2008-09-11 01:05:02

ComboFix5.txt 2008-09-20 17:06:06

Pre-Run: 34,235,211,776 bytes free

Post-Run: 34,216,009,728 bytes free

248 --- E O F --- 2008-09-10 11:39:20

Post Edited (Touch) : 23-09-2008 05:21:53 GMT

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 16319

Posted 9-23-2008 6:25 (GMT +1)

Download LSP-Fix and save it into its own directory. You can download LSP-Fix from the following location:

LSP-Fix Download Location

Once the file is downloaded navigate to where you saved the file and double-click on it to start the application

Click on -> I know what I'm doing - then – Finish - button

Reboot.

Please download Malwarebytes' Anti-Malware:

http://www.spywarefri.dk/downloads1/mbam-setup.exe

Or here:

http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol;pop&cdlPid=10878968

to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.

At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch

Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded, select Perform full scan, then click Scan.

When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click Remove Selected.

When completed, a log will open in Notepad. Please save it to a convenient location.

Copy and Paste that log into your next reply, along with fresh hijackthis log.

NB: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Avastreader
New Member

Date Joined Sep 2008
Total Posts : 6

Posted 9-24-2008 12:51 (GMT +1)

I appreciate your suggestions, but as I said, I am no longer able to access the internet from the computer. How can I download this and follow your instructions without internet access? Is it small enough to fit on a disk?

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 16319

Posted 9-24-2008 5:33 (GMT +1)

Lsp fix can be on a floppy disc, as it have a size of 169 kb

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Avastreader
New Member

Date Joined Sep 2008
Total Posts : 6

Posted 9-28-2008 5:13 (GMT +1)

Hello

It worked

Thank you very much. We now have internet. Computer still runs slow, especially when starting or rebooting. Here are the logs of Malwarebytes and HijackThis.

Malwarebytes' Anti-Malware 1.28
Database version: 1208
Windows 5.1.2600 Service Pack 3

9/25/2008 11:53:19 PM
mbam-log-2008-09-25 (23-53-19).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 114426
Time elapsed: 1 hour(s), 2 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:30 PM, on 9/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\vVX6000.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\PCSecurityShield\ShieldPro\AntiVirus\hrres.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe
C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe
C:\Program Files\PCSecurityShield\Common\hsvcmod.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsock.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clearwire.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: IEHelpObj Class - {EC45E3FE-C16D-4F24-9238-D1B49AD74815} - C:\Program Files\PCSecurityShield\ShieldPro\Service\hWebMan.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\PCSecurityShield\Common\Base\VRMONNT.EXE
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX6000] C:\WINDOWS\vVX6000.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ViRobot for WinNT(tm) Folder Protect (HFACSVC) - hauri - C:\Program Files\PCSecurityShield\ShieldPro\AccessControl\HFACSvc.exe
O23 - Service: ViRobot Communication Service (hpcsvc) - HAURI - C:\Program Files\PCSecurityShield\ShieldPro\hpcsvc.exe
O23 - Service: Hauri Common Service (hsvcmod) - HAURI Inc. - C:\Program Files\PCSecurityShield\Common\hsvcmod.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Hauri Firewall (vrfwsvc) - Hauri inc. - C:\Program Files\PCSecurityShield\ShieldPro\PCFirewall\vrfwsvc.exe
O23 - Service: ViRobot Desktop Monitoring (vrmonsvc) - HAURI - C:\Program Files\PCSecurityShield\Common\Base\vrmonsvc.exe
O23 - Service: ViRobot Repairing Service (vrrepair) - HAURI - C:\Program Files\PCSecurityShield\Common\Base\vrrepair.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9463 bytes

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 16319

Posted 9-28-2008 6:55 (GMT +1)

Run a scan with HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll (file missing)

O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll (file missing)

And you´re done smile

To completely and immediately remove any infected file or files in the data store, turn off and then turn on System Restore. To do so, follow these steps:
System Restore

Uninstall ComboFix

Go to Start->Run, and type in ComboFix /u
Make sure there is a space between ComboFix and /u
Click Enter

This will ->

Uninstall ComboFix. Delete its related folders and files.

Reset your clock settings. Hide file extensions.

Hide the system/hidden files. And resets System Restore again.

See if these tips can improve performance -

Optimize XP:

http://www.microsoft.com/windowsxp/using/setup/expert/northrup_restoreperf.mspx

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

Forum Information

Currently it is Saturday, November 21, 2009 1:30 PM (GMT +1)
There are a total of 73.031 posts in 17.116 threads.
In the last 3 days there were 14 new threads and 69 reply posts. View Active Threads