|
Malware Removal Discussion about Trojans, viruses, hoaxes, firewalls, spyware, and general Security issues. If you suspect your PC is infected with a virus, trojan or spyware app please include any supporting documentation or logs |
![]() |
|
Topic Tools |
#1
|
||||
|
||||
Computer Spyware & Adware? PC Running slow, hanging, crashing, freezing!
Hello all,
It appears my computer may have adware & spyware as it is running terribly slow! It hangs, sometimes it will not allow me to login into a different user without freezing etc. It has been chugging and freezing alot...sometimes worse than others. I have ran a HIJACK this log file and posted it below. Please help me out! Thanks.. Logfile of HijackThis v1.99.1 Scan saved at 2:44:49 PM, on 10/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\PROGRA~1\Yahoo!\YOP\yop.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Protexis\License Service\PSIService.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Tablet.exe C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Yahoo!\browser\ybrwicon.exe C:\PROGRA~1\Yahoo!\browser\YBrowser.exe C:\PROGRA~1\Yahoo!\browser\YBrowser.exe C:\Program Files\HijackThis\HijackThis.exe I will paste the second half of the log file in my reply to this.. |
#2
|
||||
|
||||
second half of logfile-please help with removal..thanks
continued log file....
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rogers.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ca.red.clientapps.yahoo.com/c...search/ie.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.red.clientapps.yahoo.com/c.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csea rchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Dane\Application Data\Mozilla\Profiles\default\ibao36cs.slt\prefs.j s) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBContr oller O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47...amesLoader.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46.../bejeweled.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1133665587484 O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {D79B6F43-F214-4E7A-9ECB-CCC8771F2416} (LauncherV1 Class) - http://www.blogtv.ca//chatobject/launcher.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WB - C:\PROGRA~1\OBJECT~1\WINDOW~1\fastload.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing) O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\PROGRA~1\Symantec\isPwdSvc.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\Program Files\Common Files\Protexis\License Service\PSIService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE |
#3
|
||||
|
||||
Howdy EvilKnevil,
No outright infection showing here, but the IE default page being changed to "about:" is not correct. Let's scan now and check. Download ComboFix.exe from here to your desktop, and click the downloaded file to run the repair. When the command window opens, select 1 (and Enter). Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt. A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Post back the C:\ComboFix.txt log please. |
#4
|
||||
|
||||
Hey Tom,
Thanks for responding.. Here is the combofix log file.txt ComboFix 07-10-12.4 - Dane 2007-10-13 12:50:20.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.568 [GMT -4:00] Running from: C:\Documents and Settings\Dane\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-13 to 2007-10-13 ))))))))))))))))))))))))))))))) . 2007-10-13 12:49 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-08 00:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HipSoft 2007-10-04 21:08 <DIR> d-------- C:\Documents and Settings\Dane\Application Data\INAC 2007-10-04 21:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\INAC 2007-10-04 09:49 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-10-03 18:31 <DIR> d-------- C:\Documents and Settings\Dane\Application Data\SecondLife 2007-10-03 18:29 <DIR> d-------- C:\Program Files\SecondLife 2007-10-01 20:43 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-09-22 22:34 <DIR> d-------- C:\Documents and Settings\Dane\Application Data\My Games 2007-09-20 15:57 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-09-20 15:57 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-09-20 15:55 131,072 --a------ C:\WINDOWS\system32\ypclsp.dll 2007-09-20 15:55 86,016 --a------ C:\WINDOWS\system32\YPcservice.exe 2007-09-18 21:15 <DIR> d-------- C:\Program Files\iTunes 2007-09-18 21:15 <DIR> d-------- C:\Program Files\iPod 2007-09-18 21:14 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-09-18 21:11 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-18 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-09-18 14:43 317,616 --a------ C:\WINDOWS\system32\drivers\srtspl.sys 2007-09-18 14:43 278,576 --a------ C:\WINDOWS\system32\drivers\srtsp.sys 2007-09-18 14:43 43,696 --a------ C:\WINDOWS\system32\drivers\srtspx.sys 2007-09-17 01:07 6,344,704 --a------ C:\WINDOWS\system32\nvdisps.dll 2007-09-17 01:07 3,551,232 --a------ C:\WINDOWS\system32\nvvitvs.dll 2007-09-17 01:07 3,334,144 --a------ C:\WINDOWS\system32\nvgames.dll 2007-09-17 01:07 2,371,584 --a------ C:\WINDOWS\system32\nvwss.dll 2007-09-17 01:07 1,150,976 --a------ C:\WINDOWS\system32\nvmobls.dll 2007-09-17 01:07 753,664 --a------ C:\WINDOWS\system32\nvcplui.exe 2007-09-17 01:07 307,200 --a------ C:\WINDOWS\system32\nvexpbar.dll 2007-09-17 01:07 188,416 --a------ C:\WINDOWS\system32\nvmccss.dll 2007-09-14 05:46 <DIR> d-------- C:\Documents and Settings\Dane\Application Data\Sandlot Games 2007-09-14 04:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Zylom . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )) . 2007-10-13 15:45 --------- d-----w C:\Program Files\Diner Dash 2007-10-12 23:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-04 13:49 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-10-04 13:49 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-10-04 13:49 --------- d-----w C:\Program Files\Symantec 2007-10-04 13:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2007-10-02 00:43 --------- d-----w C:\Program Files\Winamp 2007-09-23 02:42 --------- d-----w C:\Program Files\Shockwave.com 2007-09-20 23:19 --------- d-----w C:\Documents and Settings\Dane\Application Data\Yahoo! 2007-09-20 19:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! 2007-09-20 19:55 --------- d-----w C:\Program Files\Yahoo! 2007-09-18 18:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat 2007-09-18 18:44 10,662 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat 2007-09-18 18:44 10,658 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat 2007-09-18 18:44 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf 2007-09-18 18:44 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf 2007-09-18 18:44 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf 2007-09-17 06:10 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-09-17 06:10 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe 2007-09-17 05:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-09-17 05:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-09-17 05:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-09-17 05:07 6,853,088 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-17 05:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-09-17 05:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-09-17 05:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-09-17 05:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2007-09-17 05:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2007-09-17 05:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2007-09-17 05:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll 2007-09-17 05:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll 2007-09-17 05:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll 2007-09-17 05:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2007-09-17 05:07 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2007-09-17 05:07 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe 2007-09-17 05:07 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe 2007-09-17 05:07 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll 2007-09-17 05:07 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe 2007-09-17 05:07 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll 2007-09-17 05:07 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe 2007-09-17 05:07 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll 2007-09-14 09:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2007-09-13 03:57 --------- d-----w C:\Documents and Settings\Dane\Application Data\PlayFirst 2007-09-13 03:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2007-09-04 04:01 --------- d-----w C:\Program Files\Lucy Q Deluxe 2007-09-03 12:34 67,645 ----a-w C:\WINDOWS\system32\drivers\pshook11.sys 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 23:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 23:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 23:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-06 23:04 259,608 ----a-w C:\Documents and Settings\Dane\Application Data\GDIPFONTCACHEV1.DAT 2006-01-26 13:02 6,088 ----a-w C:\Documents and Settings\All Users\Application Data\ypinfo.bin 2002-07-26 21:02 153,088 ----a-w C:\Program Files\UNWISE.EXE 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2007-07-03 18:38:13 8 --sh--r C:\WINDOWS\system32\E17551B79B.sys 2007-07-03 19:42:15 10,490 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07] "nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe] "USB2Check"="C:\WINDOWS\system32\PCLECoInst.dl l" [2004-04-06 19:05] "YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-06-26 13:48] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59] "osCheck"="C:\PROGRA~1\Symantec\osCheck.exe" [2007-01-14 03:11] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 06:15] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "SHS"="C:\Program Files\Rogers\SelfHealing\SHS.exe" [2007-04-25 10:46] "Update Manager"="C:\Program Files\Rogers\Update Manager\UpdateManager.exe" [2007-04-25 10:46] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] C:\PROGRA~1\OBJECT~1\WINDOW~1\fastload.dll 2001-12-20 22:34 24576 C:\PROGRA~1\OBJECT~1\WINDOW~1\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer4_in_1] "C:\Program Files\Lexmark 4200 Series\Fax\fm3032.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iolo Task Agent] C:\Program Files\iolo\Common\Task Agent\Task_Agent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 4200 Series] "C:\Program Files\Lexmark 4200 Series\lxbmbmgr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCLEPCI] C:\PROGRA~1\Pinnacle\PPE\PPE.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "TermService"=3 (0x3) "TapiSrv"=3 (0x3) "ewido security suite control"=2 (0x2) *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2007-10-09 02:54:55 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Dane.job" . ************************************************** ************************ catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-13 12:55:39 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************** ************************ . Completion time: 2007-10-13 12:56:45 . --- E O F --- |
#5
|
||||
|
||||
I seem to get pop up ads coming up on certain websites.
Like adware related stuff....sometimes when I reboot ...I have like48 processes running in the bckgrnd as well. Isn't that alot? I usually have to go in and shut a bunch down. I noticed one that would appear like 5 times in the process box...said something like 'calling local proxy'?? Does that sound normal or suspicious? I am just wondering. |
#6
|
||||
|
||||
Hard to second guess either what processes would be normal for this system as far as numbers, or if Proxy settings are not set there and should show. the log doesn't reflect outright infection but indicates you have Terminal Service and Telephony services disabled through msconfig there. Msconfig is definitely not a method for making services changes, so if this is the case open msconfig and under Services select Enable All, then OK and allow the reboot. If you only get popups on certain websites this less suggests system infection and more suggests website specific behaviors. Post one or two of the popup websites in your next reply so I can see as well on that.
|
#7
|
||||
|
||||
hello,
I can't think of any websites that give me popups right off hand...I always thought that that was an indication of spyware being on your system though. |
#8
|
||||
|
||||
No, plenty of sites have the means of providing popups, even with popup blocking tools in place. The flakier the site (warez, adult etc.) the more likely that activity.
|
![]() |
Bookmarks |
«
Previous Topic
|
Next Topic
»
|
|
![]() |
||||
Topic | Topic Starter | Forum | Replies | Last Post |
computer keeps crashing and is running very slow | ds21phillies21 | Windows 7 | 1 | March 22nd, 2014 04:32 PM |
Help...Computer running unbelievabley slow and crashing after only a few mins! | mountier | Hardware | 10 | March 11th, 2008 04:50 PM |
Computer Slow with lots of adware and spyware | JP_17315 | Malware Removal | 9 | November 20th, 2006 07:04 PM |
computer freezing and running slow | barrykane2003 | Malware Removal | 1 | April 26th, 2005 03:20 AM |
Slow computer - spyware, adware etc infected...please help | troppo | Malware Removal | 2 | January 10th, 2005 10:31 AM |
All times are GMT +1. The time now is 09:53 PM.