[Inactive] Some Help Needed, Please!

  1. 18-07-2009  #1
    gowthan
    gowthan is offline Junior Member

    [Inactive] Some Help Needed, Please!

    Hello Everyone,
    I have a Toshiba Satellite L300.
    Running Vista Home Premium. Everything was fine since last week.
    I think i have Malware or something hidden on my machine.
    Everytime i try to open the system properties,user accounts,change my battery options, the window would open up but it will close right away.
    And also when i try to open device manager, evet viewer, i get this error messege.
    This may be because the file does not exist, is not an MMC console, or was created with a later version of MMC. This may also be because you do not have sufficient access rights to the file.
    I have Avast Pro running and i have used Malwarebytes' Anti-Malware to scan my PC. that didnt no find anything.

    So here is my Hijack Log. Pls help me fix my PC. ThankS.

    ---
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:01:54 PM, on 17/07/2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18248)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Windows\RtHDVCpl.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Windows\system32\mfpmp.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = AOL.ca - Canada's Breaking News, Entertainment, Music, Life & Style and Email
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = AOL.ca - Canada's Breaking News, Entertainment, Music, Life & Style and Email
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster .exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O13 - Gopher Prefix:
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
    O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
    O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

  3. 18-07-2009  #2
    broni
    broni is offline Senior Member
    Download, ad run Norton Removal Tool: Download and run the Norton Removal Tool


    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.
  4. 18-07-2009  #3
    gowthan
    gowthan is offline Junior Member
    Thank you, here are the 2 reports:
    ----
    ComboFix 09-07-14.08 - Gowthan 18/07/2009 14:49.1.2 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.2.1033.18.3061.2029 [GMT -4:00]
    Running from: c:\users\Gowthan\Desktop\ComboFix.exe
    AV: avast! antivirus 4.8.1229 [VPS 081113-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    SP: avast! antivirus 4.8.1229 [VPS 081113-1] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\users\Gowthan\Documents\My Received Files\New Sets\CD1\Desktop_.ini
    c:\windows\Installer\577e59.msi
    c:\windows\Installer\WMEncoder.msi

    .
    ((((((((((((((((((((((((( Files Created from 2009-06-18 to 2009-07-18 )))))))))))))))))))))))))))))))
    .

    2009-07-18 18:55 . 2009-07-18 18:55 -------- d-----w- c:\users\Gowthan\AppData\Local\temp
    2009-07-18 18:55 . 2009-07-18 18:55 -------- d-----w- c:\users\User\AppData\Local\temp
    2009-07-18 18:37 . 2009-07-18 18:37 -------- d-----w- c:\programdata\NortonInstaller
    2009-07-17 22:41 . 2009-07-17 22:41 -------- d-----w- c:\users\Guest
    2009-07-17 22:41 . 2009-07-17 22:41 -------- d-----w- c:\program files\Trend Micro
    2009-07-17 03:48 . 2009-07-17 03:48 -------- d-----w- c:\users\Gowthan\AppData\Roaming\Uniblue
    2009-07-09 01:05 . 2009-07-18 18:33 -------- d-----w- c:\users\Gowthan\AppData\Roaming\vlc
    2009-07-09 00:41 . 2009-07-12 21:24 -------- d-----w- c:\program files\RocketDock
    2009-07-08 01:27 . 2009-07-08 22:55 -------- d-----w- c:\program files\CyberLink
    2009-07-07 23:41 . 2009-07-07 23:41 -------- d-----w- c:\users\Gowthan\AppData\Roaming\CyberLink
    2009-07-07 23:38 . 2009-07-08 01:42 -------- d-----w- c:\programdata\CyberLink
    2009-07-07 23:38 . 2009-07-07 23:38 -------- d-----w- c:\program files\Common Files\CyberLink
    2009-07-07 23:35 . 2009-07-07 23:55 29480 ----a-w- c:\windows\system32\msxml3a.dll
    2009-07-07 23:34 . 2009-07-08 00:09 53319 ----a-w- c:\programdata\Temp\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe
    2009-07-07 04:03 . 2009-07-07 04:03 -------- d-----w- c:\users\User\AppData\Roaming\PC Suite
    2009-07-04 16:40 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
    2009-07-04 16:40 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
    2009-07-04 16:36 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
    2009-07-04 16:36 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
    2009-07-04 16:34 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
    2009-06-22 19:23 . 2009-06-22 19:23 239088 ----a-w- c:\users\User\AppData\Roaming\Mozilla\plugins\npgo ogletalk.dll
    2009-06-20 21:55 . 2009-06-20 21:55 -------- d-----w- c:\program files\Vodei

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-07-18 18:36 . 2008-10-15 02:27 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2009-07-18 17:52 . 2008-11-08 17:26 -------- d-----w- c:\programdata\VMware
    2009-07-17 22:13 . 2008-10-15 02:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-07-17 22:12 . 2008-10-15 02:26 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-07-15 22:51 . 2008-11-29 05:05 -------- d-----w- c:\users\Gowthan\AppData\Roaming\dvdcss
    2009-07-15 01:53 . 2008-09-23 00:48 -------- d-----w- c:\program files\Messenger Plus! Live
    2009-07-13 17:36 . 2008-10-15 02:23 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-13 17:36 . 2008-10-15 02:23 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-07-08 02:10 . 2009-02-15 01:07 -------- d-----w- c:\users\Gowthan\AppData\Roaming\Nokia
    2009-07-08 01:38 . 2008-02-11 23:34 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-07 04:03 . 2009-07-07 04:03 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_ 00_00.Wdf
    2009-07-04 17:06 . 2008-02-12 00:44 -------- d-----w- c:\programdata\Microsoft Help
    2009-06-18 20:17 . 2008-09-17 17:55 1356 ----a-w- c:\users\Gowthan\AppData\Local\d3d9caps.dat
    2009-06-18 04:47 . 2009-06-18 04:47 -------- d-----w- c:\users\User\AppData\Roaming\DivX
    2009-06-06 04:12 . 2009-02-24 00:17 112800 ----a-w- c:\users\User\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-05-19 13:35 . 2008-09-17 17:56 112800 ----a-w- c:\users\Gowthan\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-05-04 18:42 . 2009-05-04 18:42 190800 ---ha-w- c:\windows\system32\mlfcache.dat
    2009-04-24 16:05 . 2009-07-04 16:38 827904 ----a-w- c:\windows\system32\wininet.dll
    2009-04-24 16:02 . 2009-07-04 16:38 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-04-24 13:44 . 2009-07-04 16:38 26624 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-06-15 20:59 . 2008-09-22 23:53 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp. exe" [2009-02-05 81000]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
    "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-01-22 712704]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
    "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
    "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-01-29 4911104]

    c:\users\User\AppData\Roaming\Microsoft\Windows\St art Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\aawservice]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3384229552-1554451906-1745968894-1003]
    "EnableNotificationsRef"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3384229552-1554451906-1745968894-1006]
    "EnableNotificationsRef"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
    "{0563CB39-ADAE-48F0-95DC-091C58E4D664}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{9A40F4BE-6AF8-4958-874B-7B383836802E}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{9D27644A-9E2C-4391-B342-77E3CEB68652}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{916AAA77-CEE8-4C7B-BD20-1E5AE56D55A9}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{AE4FFA0D-7DCD-4F4F-84D3-1D048B7E500D}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "TCP Query User{3F45D93D-A751-42D8-A38C-AC016488054B}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{A803AB24-624C-4079-B789-995E57A4477C}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "TCP Query User{D6FABA26-0A33-4EE5-8ED1-D45053A954F9}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "UDP Query User{45E5E118-839F-4EC2-80D3-BB71E6D05F40}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
    "{DEB9369B-9A2E-448E-92E4-69EF4461B75A}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{1D0CA8FE-1D42-48B9-B166-4B1EDC1A14D6}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
    "{C954F076-98F5-47F2-B261-3E510815E552}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
    "{E5F867D0-89B9-40FC-A059-4F2E7E65ABD5}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
    "{AD3B6E5A-B287-42CC-986C-97456A48F173}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
    "{51D45AB0-7C42-4613-8004-EFBD7875C421}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
    "{55C6FECB-9D39-4E60-8613-605E31192EF1}"= UDP:c:\program files\VMware\VMware Workstation\vmware-authd.exe:VMware Authd
    "{7DF73CCE-776D-4301-98B1-2A5780E809C1}"= TCP:c:\program files\VMware\VMware Workstation\vmware-authd.exe:VMware Authd
    "TCP Query User{6801EB71-9F9D-492E-B350-A7F12D567F10}c:\\program files\\packet tracer 5.0\\bin\\packettracer5.exe"= UDP:c:\program files\packet tracer 5.0\bin\packettracer5.exe:PacketTracer5
    "UDP Query User{98074AF8-F936-40D3-9EE5-26C8979C3952}c:\\program files\\packet tracer 5.0\\bin\\packettracer5.exe"= TCP:c:\program files\packet tracer 5.0\bin\packettracer5.exe:PacketTracer5
    "{1650ED33-8669-4F0B-9287-3B559286B32C}"= UDP:23586:BitComet 23586 TCP
    "{46AE04F5-322D-4532-8224-398728314890}"= TCP:23586:BitComet 23586 UDP
    "{0C83FF59-03EA-439D-ADC2-A4BA3D9CF27F}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
    "{AE9B2D7D-0223-4E26-BB74-D723035A39CF}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
    "{16B7AC8F-0843-4628-BF65-CBBBD79A44ED}"= UDP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
    "{7CF6F414-0BFB-48F9-89A1-806352B3AA32}"= TCP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.dll:Google Talk Plugin
    "{5C002B0F-BE9B-492E-8A97-E6C301DD6BA3}"= UDP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin
    "{F4CDDCFF-F4E3-4252-9F8F-E3BEA69E8A43}"= TCP:c:\users\Gowthan\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe:Google Talk Plugin
    "{4B8945F2-4021-4CB9-B98E-DEAB854F7E2F}"= UDP:c:\users\Gowthan\AppData\Local\Temp\7zSD6EE.tm p\SymNRT.exe:Norton Removal Tool
    "{ED5F3E7D-3DDD-4AB5-847E-DE396B7A908B}"= TCP:c:\users\Gowthan\AppData\Local\Temp\7zSD6EE.tm p\SymNRT.exe:Norton Removal Tool

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [22/09/2008 7:41 PM 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswF sBlk.sys [22/09/2008 7:41 PM 20560]
    R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\as wMonFlt.sys [22/09/2008 7:41 PM 51792]
    R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [03/12/2007 5:03 PM 126976]
    R2 vmci;VMware vmci;c:\windows\System32\drivers\vmci.sys [19/09/2008 12:12 AM 54960]
    R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [11/02/2008 8:52 PM 7168]
    R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 4:40 PM 3668480]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3384229552-1554451906-1745968894-1003.job
    - c:\users\Gowthan\AppData\Local\Google\Update\Googl eUpdate.exe [2009-01-30 03:01]

    2009-07-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3384229552-1554451906-1745968894-1006Core.job
    - c:\users\User\AppData\Local\Google\Update\GoogleUp date.exe [2009-03-13 00:32]

    2009-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3384229552-1554451906-1745968894-1006UA.job
    - c:\users\User\AppData\Local\Google\Update\GoogleUp date.exe [2009-03-13 00:32]
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Uniblue RegistryBooster 2009 - c:\program files\uniblue\registrybooster\StartRegistryBooster .exe


    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    mStart Page = hxxp://www.shoptoshiba.ca/welcome
    uInternet Settings,ProxyOverride = *.local
    IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
    IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    LSP: c:\windows\system32\wpclsp.dll
    LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll
    FF - ProfilePath - c:\users\Gowthan\AppData\Roaming\Mozilla\Firefox\P rofiles\3x7uwsdw.default\
    FF - prefs.js: browser.search.selectedEngine - eBay
    FF - prefs.js: browser.startup.homepage - about:blank
    FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
    FF - component: c:\users\Gowthan\AppData\Roaming\Mozilla\Firefox\P rofiles\3x7uwsdw.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
    FF - plugin: c:\users\Gowthan\AppData\Local\Google\Update\1.2.1 45.5\npGoogleOneClick8.dll
    FF - plugin: c:\users\Gowthan\AppData\Roaming\Mozilla\plugins\n pgoogletalk.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    ************************************************** ************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2009-07-18 14:55
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2009-07-18 14:57
    ComboFix-quarantined-files.txt 2009-07-18 18:57

    Pre-Run: 50,076,413,952 bytes free
    Post-Run: 50,061,447,168 bytes free

    204 --- E O F --- 2009-07-04 17:06




    --- HIJACK LOG

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:00:10 PM, on 18/07/2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18248)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Windows\RtHDVCpl.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\system32\conime.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Windows\Explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = AOL.ca - Canada's Breaking News, Entertainment, Music, Life & Style and Email
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O13 - Gopher Prefix:
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
    O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
    O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

    --
    End of file - 7704 bytes
  5. 18-07-2009  #4
    broni
    broni is offline Senior Member
    I don't think, we're dealing with any infection here.
    You need to re-post your problem at Windows section.
  6. 18-07-2009  #5
    gowthan
    gowthan is offline Junior Member
    okii .. will doo
    thank you 4ur time.
  7. 18-07-2009  #6
    broni
    broni is offline Senior Member
    Save 20% on AVG Internet Security 2012 Suite!
    No problemo
+ Reply to Thread
« Infected Laptop (HJT! log inc.) | [Active] Odd Spam Email goings on! »