Hi there jholland
I am sorry, My comp slowes to a crawl and freezes often and I don't think I can fully run the progs
AdAware keeps finding files from a trojan downloader but doesn't get rid of the problem.
If you have noticed particular unneeded auto starts,or suspicious auto starting services, and very dangerous "Trusted Sites", I would be more than obliged if you could point them out and I can fix them on the Hijackthis
I will try and add here the log files from OTL and Combifix which I managed to run yesterday/today I had to attach the txt files as copy paste made the reply too long
silclay 0 Newbie Poster
Hi there jholland
I am sorry, My comp slowes to a crawl and freezes often and I don't think I can fully run the progs
AdAware keeps finding files from a trojan downloader but doesn't get rid of the problem.
If you have noticed particular unneeded auto starts,or suspicious auto starting services, and very dangerous "Trusted Sites", I would be more than obliged if you could point them out and I can fix them on the Hijackthis
I will try and add here the log files from OTL and Combifix which I managed to run yesterday/todaybut so far the logs I post seem to be too long for the "reply" to work so I am attaching the txt files
ComboFix 10-10-21.02 - dsilver 10/22/2010 7:51:53.1.2 - x86
Running from: C:\mydoc\HijackThis\MalwareBytes forum\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: Trend Micro OfficeScan Antivirus *On-access scanning disabled* (Outdated) {4CA5B9AB-4295-4D4C-9664-0EBE85AE0525}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {061AE366-576E-4716-93BD-961A93D59089}
FW: Trend Micro Personal Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\dsilver\Favorites\Delphion Intellectual Property Network to search, view and analyze patent collections worldwide..ur
C:\Documents and Settings\dsilver\GoToAssistDownloadHelper.exe
C:\mydoc\MP4 player\16GB\New Folder\AVI-TOOL\Desktop_.ini
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
C:\WINDOWS\system32\_000014_.tmp.dll
C:\WINDOWS\system32\_000015_.tmp.dll
C:\WINDOWS\system32\_000016_.tmp.dll
C:\WINDOWS\system32\Icons
C:\WINDOWS\system32\Icons\Acrobat8.ico
C:\WINDOWS\system32\Icons\BGinfo.ico
C:\WINDOWS\system32\Icons\BlackBarry.ico
C:\WINDOWS\system32\Icons\Bosanova.ico
C:\WINDOWS\system32\Icons\CallCent.ico
C:\WINDOWS\system32\Icons\CitrixP.ico
C:\WINDOWS\system32\Icons\CitrixT.ico
C:\WINDOWS\system32\Icons\Code.ico
C:\WINDOWS\system32\Icons\ConnectW.ico
C:\WINDOWS\system32\Icons\CuteFTP7.ico
C:\WINDOWS\system32\Icons\Designer.ico
C:\WINDOWS\system32\Icons\DiskOn.ico
C:\WINDOWS\system32\Icons\eCenter.ico
C:\WINDOWS\system32\Icons\ERP Portal.ico
C:\WINDOWS\system32\Icons\ExcelXP.ico
C:\WINDOWS\system32\Icons\Facsys.ico
C:\WINDOWS\system32\Icons\FixPrt.ico
C:\WINDOWS\system32\Icons\G-Top Icon_v2.ico
C:\WINDOWS\system32\Icons\GeL.ico
C:\WINDOWS\system32\Icons\HRWeb.ico
C:\WINDOWS\system32\Icons\IDMUSER.ico
C:\WINDOWS\system32\Icons\ImgPro.ico
C:\WINDOWS\system32\Icons\Infosite.ico
C:\WINDOWS\system32\Icons\KillNote.ico
C:\WINDOWS\system32\Icons\Msds.ico
C:\WINDOWS\system32\Icons\PerformanceEva.ico
C:\WINDOWS\system32\Icons\PowerPXP.ico
C:\WINDOWS\system32\Icons\printers.ico
C:\WINDOWS\system32\Icons\PTV_MESHEK.ico
C:\WINDOWS\system32\Icons\RMilim.ico
C:\WINDOWS\system32\Icons\RunLoginScript.ico
C:\WINDOWS\system32\Icons\SachrWeb.ico
C:\WINDOWS\system32\Icons\SKBW.ico
C:\WINDOWS\system32\Icons\SmarTeam.ico
C:\WINDOWS\system32\Icons\SmarTeamDocCenter.ico
C:\WINDOWS\system32\Icons\survey.ico
C:\WINDOWS\system32\Icons\TapiRNDPortal.ico
C:\WINDOWS\system32\Icons\winscp376.ico
C:\WINDOWS\system32\Icons\Winzip11.ico
C:\WINDOWS\system32\Icons\Wisdom Portal.ico
C:\WINDOWS\system32\Icons\WordXP.ico
C:\WINDOWS\system32\logs
C:\WINDOWS\system32\zlibwapi.dll
----- BITS: Possible infected sites -----
hxxp://ILPTVSMS31.il.teva.corp:80
.
((((((((((((((((((((((((( Files Created from 2010-09-22 to 2010-10-22 )))))))))))))))))))))))))))))))
.
2010-10-22 08:51:18 . 2010-10-22 08:51:18 -------- d-----w- C:\WINDOWS\system32\Logs
2010-10-19 15:15:59 . 2010-08-26 08:31:38 69976 ----a-w- C:\WINDOWS\system32\drivers\sbapifs.sys
2010-10-19 15:15:58 . 2010-08-26 08:31:38 21464 ----a-w- C:\WINDOWS\system32\drivers\sbaphd.sys
2010-10-19 14:23:52 . 2010-08-26 08:31:35 15880 ----a-w- C:\WINDOWS\system32\lsdelete.exe
2010-10-19 06:29:00 . 2010-08-26 08:31:36 64288 ----a-w- C:\WINDOWS\system32\drivers\Lbd.sys
2010-10-19 05:43:12 . 2010-10-19 05:43:19 -------- dc-h--w- C:\Documents and Settings\All Users\Application Data\{A4716110-A599-4517-A21D-0B81799F4676}
2010-10-19 05:42:19 . 2010-10-19 05:42:19 -------- d-----w- C:\Program Files\Lavasoft
2010-10-15 22:53:08 . 2010-10-15 22:53:08 -------- d-----w- C:\Documents and Settings\LocalService\Application Data\McAfee
2010-10-15 06:20:15 . 2010-10-15 06:20:15 -------- d-----w- C:\Documents and Settings\All Users\Application Data\McAfee
2010-10-14 12:30:13 . 2010-10-14 12:31:56 -------- d-----w- C:\Documents and Settings\dsilver\Local Settings\Application Data\Temp
2010-10-14 12:27:19 . 2010-10-14 13:35:19 -------- d-----w- C:\Documents and Settings\dsilver\Local Settings\Application Data\Google
2010-10-14 12:20:31 . 2010-10-14 12:21:23 -------- d-----w- C:\Documents and Settings\dsilver\Local Settings\Application Data\Deployment
2010-10-13 17:19:11 . 2010-10-13 17:19:11 -------- d-----w- C:\Documents and Settings\dsilver\Application Data\Malwarebytes
2010-10-13 17:18:37 . 2010-10-13 17:18:37 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2010-10-13 05:23:20 . 2010-10-13 05:23:20 -------- d-----w- C:\Documents and Settings\dsilver\Local Settings\Application Data\VS Revo Group
2010-10-13 05:22:17 . 2009-12-30 10:20:54 27064 ----a-w- C:\WINDOWS\system32\drivers\revoflt.sys
2010-10-13 05:22:11 . 2010-10-13 05:22:11 -------- d-----w- C:\Program Files\VS Revo Group
2010-10-12 05:58:34 . 2010-10-12 06:00:05 -------- d-----w- C:\Documents and Settings\dsilver\Application Data\AVG
2010-10-12 05:54:42 . 2010-10-13 07:36:45 -------- d---a-w- C:\Documents and Settings\All Users\Application Data\TEMP
2010-10-11 18:34:46 . 2010-10-11 18:34:46 -------- d-----w- C:\$AVG
2010-10-11 11:23:49 . 2010-10-11 11:23:49 -------- d--h--w- C:\Documents and Settings\All Users\Application Data\Common Files
2010-10-11 11:21:37 . 2010-10-16 14:45:06 -------- d-----w- C:\WINDOWS\system32\drivers\AVG
2010-10-11 11:21:37 . 2010-10-13 06:27:11 -------- d-----w- C:\Documents and Settings\All Users\Application Data\AVG10
2010-10-11 11:18:08 . 2010-10-13 07:37:01 -------- d-----w- C:\Program Files\AVG
2010-10-11 11:16:23 . 2010-10-11 11:19:32 -------- d-----w- C:\Documents and Settings\All Users\Application Data\MFAData
2010-10-06 14:13:33 . 2010-10-06 14:13:37 -------- d-----w- C:\Program Files\CCleaner
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fae3e6b1-1936-40d6-9acc-59ebcf661ccb}]
2010-09-06 17:49:04 2735200 ----a-w- C:\Program Files\ImTranslator_Pro\tbImT0.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{fae3e6b1-1936-40d6-9acc-59ebcf661ccb}"= "C:\Program Files\ImTranslator_Pro\tbImT0.dll" [2010-09-06 17:49:04 2735200]The attachment preview is chopped off after the first 10 KB. Please download the entire file.
O T L E x t r a s l o g f i l e c r e a t e d o n : 1 0 / 2 1 / 2 0 1 0 7 : 1 7 : 3 2 P M - R u n 1
O T L b y O l d T i m e r - V e r s i o n 3 . 2 . 1 6 . 0 F o l d e r = C : \ D o c u m e n t s a n d S e t t i n g s \ d s i l v e r \ D e s k t o p
W i n d o w s X P P r o f e s s i o n a l E d i t i o n S e r v i c e P a c k 3 ( V e r s i o n = 5 . 1 . 2 6 0 0 ) - T y p e = N T W o r k s t a t i o n
I n t e r n e t E x p l o r e r ( V e r s i o n = 8 . 0 . 6 0 0 1 . 1 8 7 0 2 )
L o c a l e : 0 0 0 0 0 4 0 9 | C o u n t r y : U n i t e d S t a t e s | L a n g u a g e : E N U | D a t e F o r m a t : M / d / y y y y
2 . 0 0 G b T o t a l P h y s i c a l M e m o r y | 1 . 0 0 G b A v a i l a b l e P h y s i c a l M e m o r y | 4 2 . 0 0 % M e m o r y f r e e
5 . 0 0 G b P a g i n g F i l e | 4 . 0 0 G b A v a i l a b l e i n P a g i n g F i l e | 7 8 . 0 0 % P a g i n g F i l e f r e e
P a g i n g f i l e l o c a t i o n ( s ) : C : \ p a g e f i l e . s y s 3 0 5 7 5 0 9 2 [ b i n a r y d a t a ]
% S y s t e m D r i v e % = C : | % S y s t e m R o o t % = C : \ W I N D O W S | % P r o g r a m F i l e s % = C : \ P r o g r a m F i l e s
D r i v e C : | 2 3 2 . 8 8 G b T o t a l S p a c e | 1 3 5 . 5 1 G b F r e e S p a c e | 5 8 . 1 9 % S p a c e F r e e | P a r t i t i o n T y p e : N T F S
C o m p u t e r N a m e : P T V N 0 3 5 8 9 7 | U s e r N a m e : d s i l v e r | N O T l o g g e d i n a s A d m i n i s t r a t o r .
B o o t M o d e : N o r m a l | S c a n M o d e : A l l u s e r s | Q u i c k S c a n
C o m p a n y N a m e W h i t e l i s t : O n | S k i p M i c r o s o f t F i l e s : O n | N o C o m p a n y N a m e W h i t e l i s t : O n | F i l e A g e = 9 0 D a y s
[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = E x t r a R e g i s t r y ( S a f e L i s t ) = = = = = = = = = = [ / c o l o r ]
[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = F i l e A s s o c i a t i o n s = = = = = = = = = = [ / c o l o r ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ C l a s s e s \ < e x t e n s i o n > ]
[ H K E Y _ U S E R S \ S - 1 - 5 - 2 1 - 1 0 2 5 8 7 2 6 3 2 - 9 0 3 7 4 8 1 5 2 - 2 6 9 5 8 0 9 3 2 7 - 1 1 1 5 9 \ S O F T W A R E \ C l a s s e s \ < e x t e n s i o n > ]
. h t m l [ @ = h t m l f i l e ] - - R e g E r r o r : K e y e r r o r . F i l e n o t f o u n d
[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = S h e l l S p a w n i n g = = = = = = = = = = [ / c o l o r ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ C l a s s e s \ < k e y > \ s h e l l \ [ c o m m a n d ] \ c o m m a n d ]
b a t f i l e [ o p e n ] - - " % 1 " % *
c m d f i l e [ o p e n ] - - " % 1 " % *
c o m f i l e [ o p e n ] - - " % 1 " % *
e x e f i l e [ o p e n ] - - " % 1 " % *
p i f f i l e [ o p e n ] - - " % 1 " % *
r e g f i l e [ m e r g e ] - - R e g E r r o r : K e y e r r o r .
s c r f i l e [ c o n f i g ] - - " % 1 "
s c r f i l e [ i n s t a l l ] - - r u n d l l 3 2 . e x e d e s k . c p l , I n s t a l l S c r e e n S a v e r % l ( M i c r o s o f t C o r p o r a t i o n )
s c r f i l e [ o p e n ] - - " % 1 " / S
t x t f i l e [ e d i t ] - - R e g E r r o r : K e y e r r o r .
U n k n o w n [ o p e n a s ] - - % S y s t e m R o o t % \ s y s t e m 3 2 \ r u n d l l 3 2 . e x e % S y s t e m R o o t % \ s y s t e m 3 2 \ s h e l l 3 2 . d l l , O p e n A s _ R u n D L L % 1
D i r e c t o r y [ f i n d ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e ( M i c r o s o f t C o r p o r a t i o n )
F o l d e r [ o p e n ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e / i d l i s t , % I , % L ( M i c r o s o f t C o r p o r a t i o n )
F o l d e r [ e x p l o r e ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e / e , / i d l i s t , % I , % L ( M i c r o s o f t C o r p o r a t i o n )
D r i v e [ f i n d ] - - % S y s t e m R o o t % \ E x p l o r e r . e x e ( M i c r o s o f t C o r p o r a t i o n )
[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = S e c u r i t y C e n t e r S e t t i n g s = = = = = = = = = = [ / c o l o r ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r ]
" F i r s t R u n D i s a b l e d " = 1
" A n t i V i r u s D i s a b l e N o t i f y " = 0
" F i r e w a l l D i s a b l e N o t i f y " = 0
" U p d a t e s D i s a b l e N o t i f y " = 0
" A n t i V i r u s O v e r r i d e " = 0
" F i r e w a l l O v e r r i d e " = 0
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ A h n l a b A n t i V i r u s ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ C o m p u t e r A s s o c i a t e s A n t i V i r u s ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ K a s p e r s k y A n t i V i r u s ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ M c A f e e A n t i V i r u s ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ M c A f e e F i r e w a l l ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ P a n d a A n t i V i r u s ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ P a n d a F i r e w a l l ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S o p h o s A n t i V i r u s ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S y m a n t e c A n t i V i r u s ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ S y m a n t e c F i r e w a l l ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T i n y F i r e w a l l ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T r e n d A n t i v i r u s ]
" D i s a b l e M o n i t o r i n g " = 1
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ T r e n d F i r e w a l l ]
" D i s a b l e M o n i t o r i n g " = 1
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ S e c u r i t y C e n t e r \ M o n i t o r i n g \ Z o n e L a b s F i r e w a l l ]
[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = S y s t e m R e s t o r e S e t t i n g s = = = = = = = = = = [ / c o l o r ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s N T \ S y s t e m R e s t o r e ]
" D i s a b l e C o n f i g " = 0
" D i s a b l e S R " = 0
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ S y s t e m R e s t o r e ]
" D i s a b l e S R " = 1
[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S r ]
" S t a r t " = 4
[ H K E Y _ L O C A L _ M A C H I N E \ S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ S r S e r v i c e ]
" S t a r t " = 4
[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = F i r e w a l l S e t t i n g s = = = = = = = = = = [ / c o l o r ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s F i r e w a l l ]
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s F i r e w a l l \ D o m a i n P r o f i l e ]
" E n a b l e F i r e w a l l " = 0
" D o N o t A l l o w E x c e p t i o n s " = 0
" D i s a b l e N o t i f i c a t i o n s " = 0
" D i s a b l e U n i c a s t R e s p o n s e s T o M u l t i c a s t B r o a d c a s t " = 0
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s F i r e w a l l \ D o m a i n P r o f i l e \ A u t h o r i z e d A p p l i c a t i o n s ]
" E n a b l e d " = 0
" A l l o w U s e r P r e f M e r g e " = 0
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s F i r e w a l l \ D o m a i n P r o f i l e \ G l o b a l l y O p e n P o r t s ]
" E n a b l e d " = 0
" A l l o w U s e r P r e f M e r g e " = 0
[ H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s F i r e w a l l \ D o m a i n P r o f i lThe attachment preview is chopped off after the first 10 KB. Please download the entire file.
O T L l o g f i l e c r e a t e d o n : 1 0 / 2 1 / 2 0 1 0 7 : 1 7 : 3 2 P M - R u n 1
O T L b y O l d T i m e r - V e r s i o n 3 . 2 . 1 6 . 0 F o l d e r = C : \ D o c u m e n t s a n d S e t t i n g s \ d s i l v e r \ D e s k t o p
W i n d o w s X P P r o f e s s i o n a l E d i t i o n S e r v i c e P a c k 3 ( V e r s i o n = 5 . 1 . 2 6 0 0 ) - T y p e = N T W o r k s t a t i o n
I n t e r n e t E x p l o r e r ( V e r s i o n = 8 . 0 . 6 0 0 1 . 1 8 7 0 2 )
L o c a l e : 0 0 0 0 0 4 0 9 | C o u n t r y : U n i t e d S t a t e s | L a n g u a g e : E N U | D a t e F o r m a t : M / d / y y y y
2 . 0 0 G b T o t a l P h y s i c a l M e m o r y | 1 . 0 0 G b A v a i l a b l e P h y s i c a l M e m o r y | 4 2 . 0 0 % M e m o r y f r e e
5 . 0 0 G b P a g i n g F i l e | 4 . 0 0 G b A v a i l a b l e i n P a g i n g F i l e | 7 8 . 0 0 % P a g i n g F i l e f r e e
P a g i n g f i l e l o c a t i o n ( s ) : C : \ p a g e f i l e . s y s 3 0 5 7 5 0 9 2 [ b i n a r y d a t a ]
% S y s t e m D r i v e % = C : | % S y s t e m R o o t % = C : \ W I N D O W S | % P r o g r a m F i l e s % = C : \ P r o g r a m F i l e s
D r i v e C : | 2 3 2 . 8 8 G b T o t a l S p a c e | 1 3 5 . 5 1 G b F r e e S p a c e | 5 8 . 1 9 % S p a c e F r e e | P a r t i t i o n T y p e : N T F S
C o m p u t e r N a m e : P T V N 0 3 5 8 9 7 | U s e r N a m e : d s i l v e r | N O T l o g g e d i n a s A d m i n i s t r a t o r .
B o o t M o d e : N o r m a l | S c a n M o d e : A l l u s e r s | Q u i c k S c a n
C o m p a n y N a m e W h i t e l i s t : O n | S k i p M i c r o s o f t F i l e s : O n | N o C o m p a n y N a m e W h i t e l i s t : O n | F i l e A g e = 9 0 D a y s
[ c o l o r = # E 5 6 7 1 7 ] = = = = = = = = = = P r o c e s s e s ( S a f e L i s t ) = = = = = = = = = = [ / c o l o r ]
P R C - [ 2 0 1 0 / 1 0 / 2 1 1 9 : 1 1 : 1 5 | 0 0 0 , 5 7 5 , 4 8 8 | - - - - | M ] ( O l d T i m e r T o o l s ) - - C : \ D o c u m e n t s a n d S e t t i n g s \ d s i l v e r \ D e s k t o p \ O T L . e x e
P R C - [ 2 0 1 0 / 1 0 / 1 9 0 7 : 5 1 : 3 3 | 0 0 0 , 9 2 9 , 0 0 8 | - - - - | M ] ( L a v a s o f t ) - - C : \ P r o g r a m F i l e s \ L a v a s o f t \ A d - A w a r e \ A A W T r a y . e x e
P R C - [ 2 0 1 0 / 1 0 / 1 9 0 7 : 5 1 : 3 2 | 0 0 1 , 3 7 4 , 9 6 8 | - - - - | M ] ( L a v a s o f t ) - - C : \ P r o g r a m F i l e s \ L a v a s o f t \ A d - A w a r e \ A A W S e r v i c e . e x e
P R C - [ 2 0 1 0 / 0 9 / 0 9 0 4 : 4 6 : 4 2 | 0 0 0 , 6 5 2 , 6 4 0 | - - - - | M ] ( A V G T e c h n o l o g i e s C Z , s . r . o . ) - - C : \ P r o g r a m F i l e s \ A V G \ A V G 1 0 \ a v g r s x . e x e
P R C - [ 2 0 1 0 / 0 3 / 0 9 1 7 : 2 1 : 0 8 | 0 0 0 , 4 3 5 , 5 8 4 | - - - - | M ] ( T r e n d M i c r o I n c . ) - - C : \ P r o g r a m F i l e s \ T r e n d M i c r o \ O f f i c e S c a n C l i e n t \ C N T A o S M g r . e x e
P R C - [ 2 0 1 0 / 0 2 / 0 5 1 6 : 0 1 : 0 0 | 0 0 0 , 8 4 9 , 1 9 2 | - - - - | M ] ( T r e n d M i c r o I n c . ) - - C : \ P r o g r a m F i l e s \ T r e n d M i c r o \ O f f i c e S c a n C l i e n t \ P c c N T M o n . e x e
P R C - [ 2 0 1 0 / 0 2 / 0 2 1 6 : 3 5 : 2 0 | 0 0 1 , 3 3 7 , 4 8 8 | - - - - | M ] ( T r e n d M i c r o I n c . ) - - C : \ P r o g r a m F i l e s \ T r e n d M i c r o \ O f f i c e S c a n C l i e n t \ T m L i s t e n . e x e
P R C - [ 2 0 1 0 / 0 2 / 0 2 1 6 : 3 3 : 1 8 | 0 0 1 , 3 8 5 , 7 6 8 | - - - - | M ] ( T r e n d M i c r o I n c . ) - - C : \ P r o g r a m F i l e s \ T r e n d M i c r o \ O f f i c e S c a n C l i e n t \ N T R t S c a n . e x e
P R C - [ 2 0 1 0 / 0 1 / 1 8 2 2 : 4 3 : 5 0 | 0 0 0 , 6 5 4 , 8 4 8 | - - - - | M ] ( M a c r o v i s i o n E u r o p e L t d . ) - - C : \ P r o g r a m F i l e s \ C o m m o n F i l e s \ M a c r o v i s i o n S h a r e d \ F L E X n e t P u b l i s h e r \ F N P L i c e n s i n g S e r v i c e . e x e
P R C - [ 2 0 1 0 / 0 1 / 1 8 1 4 : 5 1 : 5 4 | 0 0 0 , 0 3 8 , 1 7 6 | - - - - | M ] ( L e n o v o ) - - C : \ W I N D O W S \ s y s t e m 3 2 \ i b m p m s v c . e x e
P R C - [ 2 0 1 0 / 0 1 / 0 7 1 0 : 4 4 : 2 6 | 0 0 0 , 4 9 7 , 0 0 8 | - - - - | M ] ( T r e n d M i c r o I n c . ) - - C : \ P r o g r a m F i l e s \ T r e n d M i c r o \ O f f i c e S c a n C l i e n t \ T m P f w . e x e
P R C - [ 2 0 1 0 / 0 1 / 0 7 1 0 : 4 2 : 5 0 | 0 0 0 , 6 8 9 , 4 1 6 | - - - - | M ] ( T r e n d M i c r o I n c . ) - - C : \ P r o g r a m F i l e s \ T r e n d M i c r o \ O f f i c e S c a n C l i e n t \ T m P r o x y . e x e
P R C - [ 2 0 0 9 / 1 2 / 3 1 1 7 : 1 2 : 1 8 | 0 0 0 , 1 1 3 , 6 6 4 | - - - - | M ] ( T e v a ) - - C : \ P r o g r a m F i l e s \ N e t P o w e r \ N e t S a v e P o w e r . e x e
P R C - [ 2 0 0 9 / 1 2 / 0 1 1 1 : 1 3 : 1 2 | 0 0 0 , 3 4 5 , 3 5 2 | - - - - | M ] ( T r e n d M i c r o I n c . ) - - C : \ P r o g r a m F i l e s \ T r e n d M i c r o \ B M \ T M B M S R V . e x e
P R C - [ 2 0 0 9 / 0 7 / 2 8 0 1 : 0 2 : 0 0 | 0 0 0 , 0 5 3 , 2 4 8 | - - - - | M ] ( ) - - C : \ P r o g r a m F i l e s \ T h i n k P a d \ U t i l i t i e s \ P W M D B S V C . e x e
P R C - [ 2 0 0 9 / 0 7 / 2 2 0 8 : 4 4 : 4 2 | 0 0 0 , 5 0 1 , 0 3 2 | - - - - | M ] ( C h e c k P o i n t S e o f t w a r e T e c h n o l o g i e s L t d . ) - - C : \ P r o g r a m F i l e s \ C h e c k P o i n t \ D e v i c e A g e n t \ p s d a . e x e
P R C - [ 2 0 0 9 / 0 7 / 2 1 1 5 : 0 5 : 4 6 | 0 0 0 , 8 0 9 , 5 2 0 | - - - - | M ] ( C h e c k P o i n t S o f t w a r e T e c h L t d ) - - C : \ P r o g r a m F i l e s \ P o i n t s e c \ P o i n t s e c f o r P C \ P 9 5 t r a y . e x e
P R C - [ 2 0 0 9 / 0 7 / 2 1 1 5 : 0 5 : 3 4 | 0 0 0 , 6 2 9 , 2 9 6 | - - - - | M ] ( C h e c k P o i n t S o f t w a r e T e c h L t d ) - - C : \ W I N D O W S \ s y s t e m 3 2 \ P r o t _ s r v . e x e
P R C - [ 2 0 0 9 / 0 7 / 2 1 1 5 : 0 5 : 3 4 | 0 0 0 , 1 7 4 , 6 4 0 | - - - - | M ] ( C h e c k P o i n t S o f t w a r e T e c h L t d ) - - C : \ W I N D O W S \ s y s t e m 3 2 \ p s t a r t S r . e x e
P R C - [ 2 0 0 9 / 0 7 / 1 5 2 3 : 1 2 : 5 0 | 0 0 0 , 0 6 8 , 4 8 8 | - - - - | M ] ( C h e c k P o i n t S o f t w a r e T e c h n o l o g i e s L T D ) - - C : \ P r o g r a m F i l e s \ C o m m o n F i l e s \ C h e c k P o i n t \ U I F r a m e w o r k \ c p t r a y . e x e
P R C - [ 2 0 0 9 / 0 6 / 1 2 1 0 : 5 5 : 4 8 | 0 0 0 , 0 2 8 , 6 7 2 | - - - - | M ] ( L e n o v o G r o u p L i m i t e d ) - - C : \ P r o g r a m F i l e s \ L e n o v o \ S y s t e m U p d a t e \ S U S e r v i c e . e x e
P R C - [ 2 0 0 8 / 0 8 / 1 8 1 8 : 4 5 : 4 2 | 0 0 1 , 4 4 8 , 5 7 6 | - - - - | M ] ( B r o a d c o m C o r p o r a t i o n . ) - - C : \ P r o g r a m F i l e s \ T h i n k P a d \ B l u e t o o t h S o f t w a r e \ B T S t a c k S e r v e r . e x e
P R C - [ 2 0 0 8 / 0 8 / 1 8 1 8 : 4 5 : 4 2 | 0 0 0 , 6 0 4 , 7 7 6 | - - - - | M ] ( B r o a d c o m C o r p o r a t i o n . ) - - C : \ P r o g r a m F i l e s \ T h i n k P a d \ B l u e t o o t h S o f t w a r e \ B T T r a y . e x e
P R C - [ 2 0 0 8 / 0 8 / 1 8 1 8 : 4 5 : 4 2 | 0 0 0 , 3 4 6 , 7 2 0 | - - - - | M ] ( B r o a d c o m C o r p o r a t i o n . ) - - C : \ P r o g r a m F i l e s \ T h i n k P a d \ B l u e t o o t h S o f t w a r e \ b i n \ b t w d i n s . e x e
P R C - [ 2 0 0 8 / 0 6 / 1 8 1 3 : 4 6 : 5 4 | 0 0 2 , 6 9 1 , 1 8 5 | - - - - | M ] ( C h e c k P o i n t S o f t w a r e T e c h n o l o g i e s ) - - C : \ P r o g r a m F i l e s \ C h e c k P o i n t \ S e c u R e m o t e \ b i n \ S R _ G U I . e x e
P R C - [ 2 0 0 8 / 0 6 / 1 8 1 3 : 4 6 : 5 2 | 0 0 0 , 0 3 6 , 9 8 2 | - - - - | M ] ( C h e c k P o i n t S o f t w a r e T e c h n o l o g i e s ) - - C : \ P r o g r a m F i l e s \ C h e c k P o i n t \ S e c u R e m o t e \ b i n \ S R _ W a t c h d o g . e x e
P R C - [ 2 0 0 8 / 0 6 / 1 8 1 3 : 4 6 : 5 0 | 0 0 0 , 1 0 6 , 6 1 3 | - - - - | M ] ( C h e c k P o i n t S o f t w a r e T e c h n o l o g i e s ) - - C : \ P r o g r a m F i l e s \ C h e c k P o i n t \ S e c u R e m o t e \ b i n \ S R _ S e r v i c e . e x e
P R C - [ 2 0 0 8 / 0 6 / 0 6 1 8 : 2 1 : 0 4 | 0 0 0 , 1 8 1 , 5 3 6 | - - - - | M ] ( L e n o v o . ) - - C : \ W I N D O W S \ s y s t e m 3 2 \ T p S h o c k s . e x e
P R C - [ 2 0 0 8 / 0 6 / 0 5 0 2 : 3 6 : 0 0 | 0 0 0 , 2 4 2 , 9 7 6 | - - - - | M ] ( L e n o v o G r o u p L t d . ) - - C : \ P r o g r a m F i l e s \ T h i n k P a d \ U t i l i t i e s \ E Z E J M N A P . E X E
P R C - [ 2 0 0 8 / 0 5 / 2 0 0 4 : 0 0 : 0 0 | 0 0 0 , 7 5 7 , 7 9 2 | - - - - | M ] ( M i c r o s o f t C o r p o r a t i o n ) - - C : \ W I N D O W S \ s y s t e m 3 2 \ C C M \ C c m E x e c . e x e
P R C - [ 2 0 0 8 / 0 5 / 1 4 1 6 : 2 1 : 1 6 | 0 0 0 , 0 3 7 , 4 1 6 | - - - - | M ] ( L silclay 0 Newbie Poster
Hi there jholland
I am sorry, My comp slowes to a crawl and freezes often and I don't think I can fully run the progs
AdAware keeps finding files from a trojan downloader but doesn't get rid of the problem.
If you have noticed particular unneeded auto starts,or suspicious auto starting services, and very dangerous "Trusted Sites", I would be more than obliged if you could point them out and I can fix them on the Hijackthis
I will try and add here the log files from OTL and Combifix which I managed to run yesterday/today
silclay 0 Newbie Poster
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:38:57 PM, on 10/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Prot_srv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Watchdog.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\WINDOWS\system32\eTSrv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\iPass\iPassConnect\iPCAgent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\notes\nslsvice.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\pstartSr.exe
C:\Program Files\CheckPoint\Device Agent\psda.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\TmPfw.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\WINDOWS\system32\tp4mon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\TpShocks.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\Program Files\iPass\iPassConnect\downloader\ipccheck.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\system32\eTCrtMng.exe
C:\Program Files\Common Files\Check Point\UIFramework\cptray.exe
C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe
C:\WINDOWS\system32\iprntctl.exe
C:\WINDOWS\system32\iprntlgn.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\TalApplication\TevaApplication.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\NetPower\NetSavePower.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\Trend Micro\OfficeScan Client\Temp\pccntupd.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
…
silclay 0 Newbie Poster
New to the community
Being polite
Lovely to be here speak soon
silclay
(ThePope)