Trojans/ virus blocked, computer now extremely slow

By rtuss
Aug 29, 2011
  1. Hi. A few weeks ago, Avast notified me that certain Trojans and viruses were blocked. However, since then, my computer has become progressively slow and problematic. IE now locks up. Firefox does, too. It takes forever to open programs, etc. Malwarebytes didn't seem to find anything.

    Please find my logs attached. NOTE: GMER either stalls (even if I don't touch the mouse) or gives me the blue screen. I've tried it at least 5 times with no success, so I am sorry that I don't have that log.

    Malwarebytes Log
    Malwarebytes' Anti-Malware

    Database version: 7588

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 9.0.8112.16421

    8/27/2011 7:11:05 PM
    mbam-log-2011-08-27 (19-11-05).txt

    Scan type: Quick scan
    Objects scanned: 180407
    Time elapsed: 12 minute(s), 2 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    GMER Initial Automatic Scan (full scan crashes system)

    GMER -
    Rootkit quick scan 2011-08-27 19:31:56
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3500620AS rev.DE13
    Running: GMER.exe; Driver: C:\Users\Tussey\AppData\Local\Temp\uxdiipoc.sys

    ---- System - GMER 1.0.15 ----

    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x94D728DE]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \Driver\tdx \Device\Ip SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
    AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
    AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
    AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

    ---- EOF - GMER 1.0.15 ----

    DDS Scan
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_23
    Run by Tussey at 10:34:40 on 2011-08-29
    Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.3070.1926 [GMT -5:00]
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    ============== Running Processes ===============
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Canon\DIAS\CnxDIAS.exe
    C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\Program Files\Microsoft\BingBar\SeaPort.EXE
    C:\Program Files\Splashtop\Splashtop Remote\Server\SRService.exe
    C:\Program Files\Splashtop\Splashtop Software Updater\SSUService.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Zune\ZuneLauncher.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\eFax Messenger 4.4\J2GTray.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\svchost.exe -k WindowsMobile
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    ============== Pseudo HJT Report ===============
    uSearch Page = hxxp://
    uStart Page = hxxp://
    uSearch Bar = hxxp://
    uDefault_Search_URL = hxxp://
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://
    uSearchURL,(Default) = hxxp://
    uURLSearchHooks: Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\\prxtbCou0.dll
    mURLSearchHooks: Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\\prxtbCou0.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\\prxtbCou0.dll
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Cooliris Plug-In for Internet Explorer: {eaee5c74-6d0d-4aca-9232-0da4a7b866ba} - c:\program files\piclensie\cooliris.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll
    TB: Toolbar: {37153479-1976-43c3-a1ee-557513977b64} - c:\program files\\prxtbCou0.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
    uRun: [SacReminder] c:\programdata\officeguardian\reminder\SacReminder.exe
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
    mRun: [RtHDVCpl] RtHDVCpl.exe
    mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
    mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
    mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
    mRun: [eFax 4.4] "c:\program files\efax messenger 4.4\J2GDllCmd.exe" /R
    mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    StartupFolder: c:\users\tussey\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\tussey\appdata\roaming\dropbox\bin\Dropbox.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\efax44~1.lnk - c:\program files\efax messenger 4.4\J2GTray.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
    IE: {3437D640-C91A-458f-89F5-B9095EA4C28B} - {04F93351-81D2-4484-9982-0D55DEFFFAE6} - c:\program files\piclensie\cooliris.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
    DPF: Web-Based Email Tools - hxxp://
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://
    TCP: DhcpNameServer =
    TCP: Interfaces\{B606011C-7314-4845-B75C-9BC23DB776BC} : DhcpNameServer =
    TCP: Interfaces\{C004678F-650F-42EA-B31D-C4CA0441A7B6} : DhcpNameServer =
    Filter: application/xhtml+xml - {32F66A26-7614-11D4-BD11-00104BD3F987} - c:\program files\design science\mathplayer\MathMLMimer.dll
    Filter: application/xhtml+xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - c:\program files\design science\mathplayer\MathMLMimer.dll
    Filter: application/xhtml+xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - c:\program files\design science\mathplayer\MathMLMimer.dll
    Filter: text/xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - c:\program files\design science\mathplayer\MathMLMimer.dll
    Filter: text/xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - c:\program files\design science\mathplayer\MathMLMimer.dll
    Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll
    Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    ================= FIREFOX ===================
    FF - ProfilePath - c:\users\tussey\appdata\roaming\mozilla\firefox\profiles\imtw7yz1.default\
    FF - prefs.js: - hxxp://{searchTerms}
    FF - prefs.js: browser.startup.homepage - hxxp://
    FF - prefs.js: keyword.URL - chrome://browser-region/locale/
    FF - prefs.js: network.proxy.type - 0
    FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\coffplgn\components\coFFPlgn.dll
    FF - component: c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\ipsffplgn\components\IPSFFPl.dll
    FF - component: c:\users\tussey\appdata\roaming\mozilla\firefox\profiles\imtw7yz1.default\extensions\{37153479-1976-43c3-a1ee-557513977b64}\components\RadioWMPCoreGecko19.dll
    FF - plugin: c:\program files\common files\doubletwist\NPPodcast.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\google\update\\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
    ============= SERVICES / DRIVERS ===============
    R0 AFS;AFS;c:\windows\system32\drivers\AFS.SYS [2011-4-16 79052]
    R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-8-8 16184]
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-13 371544]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-10-28 301528]
    R2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2010-5-4 81920]
    R2 Apache2.2;Apache2.2;c:\xampp\xampplite\apache\bin\httpd.exe [2010-6-22 29416]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-10-28 19544]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-10-28 53592]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-10-28 42184]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-11-1 374152]
    R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-8-11 12856]
    R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-5-6 47640]
    R2 SplashtopRemoteService;Splashtop® Remote Service;c:\program files\splashtop\splashtop remote\server\SRService.exe [2011-8-10 518984]
    R2 SSUService;Splashtop Software Updater Service;c:\program files\splashtop\splashtop software updater\SSUService.exe [2011-3-7 341832]
    R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-2-23 2253688]
    R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [2011-2-23 25088]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-27 136176]
    S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-27 136176]
    S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [2010-1-6 528896]
    S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\zune\WMZuneComm.exe [2010-11-11 268528]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache;c:\windows\\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    =============== Created Last 30 ================
    2011-08-28 06:57:21 7152464 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{a950d61f-6adb-4b14-b366-67c83f553c63}\mpengine.dll
    2011-08-24 12:28:43 2048 ----a-w- c:\windows\system32\tzres.dll
    2011-08-15 14:00:10 -------- d-----w- C:\temp
    2011-08-15 13:53:09 -------- d-----w- c:\users\tussey\appdata\local\{0A36B131-6523-4C74-8318-740330A367C3}
    2011-08-11 01:42:42 375808 ----a-w- c:\windows\system32\winsrv.dll
    2011-08-11 01:42:40 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-08-11 01:42:39 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
    2011-08-11 01:42:25 3602832 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-08-11 01:42:25 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-08-11 01:42:22 905104 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-08-08 17:10:52 29520 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
    2011-08-08 17:10:48 16184 ----a-w- c:\windows\system32\drivers\SmartDefragDriver.sys
    2011-08-08 17:07:54 -------- d-----w- c:\users\tussey\appdata\roaming\IObit
    2011-08-08 17:07:48 -------- d-----w- c:\program files\IObit
    2011-08-08 16:31:46 -------- d-----w- c:\users\tussey\appdata\roaming\Sammsoft
    ==================== Find3M ====================
    2011-07-29 17:04:20 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-07-22 02:54:43 1797632 ----a-w- c:\windows\system32\jscript9.dll
    2011-07-22 02:48:26 1126912 ----a-w- c:\windows\system32\wininet.dll
    2011-07-22 02:44:36 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2011-07-12 16:20:54 83816 ----a-w- c:\windows\system32\dns-sd.exe
    2011-07-12 16:20:54 73064 ----a-w- c:\windows\system32\dnssd.dll
    2011-07-07 00:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-07-07 00:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-07-06 21:32:48 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
    2011-07-06 21:32:36 53632 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\LMIproc.dll
    2011-07-06 21:32:28 87424 ----a-w- c:\windows\system32\LMIinit.dll
    2011-07-06 21:32:28 29568 ----a-w- c:\windows\system32\LMIport.dll
    2011-06-16 21:38:10 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
    2011-06-16 21:38:08 87424 ----a-w- c:\windows\system32\LMIinit.dll.000.bak
    2011-06-02 13:35:56 98816 ----a-w- c:\windows\system32\mfps.dll
    2011-06-02 13:34:49 2043392 ----a-w- c:\windows\system32\win32k.sys
    2011-06-02 13:32:44 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui
    2011-06-02 13:32:42 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
    2011-06-02 13:32:42 519680 ----a-w- c:\windows\system32\d3d11.dll
    2011-06-02 13:32:42 369664 ----a-w- c:\windows\system32\WMPhoto.dll
    2011-06-02 13:32:42 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
    2011-06-02 13:32:42 252928 ----a-w- c:\windows\system32\dxdiag.exe
    2011-06-02 13:32:42 195584 ----a-w- c:\windows\system32\dxdiagn.dll
    2011-06-02 13:32:42 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
    ============= FINISH: 10:35:14.00 ===============

    DDS Attach Log

    DDS (Ver_2011-08-26.01)
    Microsoft® Windows Vista™ Business
    Boot Device: \Device\HarddiskVolume2
    Install Date: 5/4/2010 1:47:25 PM
    System Uptime: 8/29/2011 10:05:54 AM (0 hours ago)
    Motherboard: Dell Inc. | | 0N185P
    Processor: Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz | Socket 775 | 1995/333mhz
    ==== Disk Partitions =========================
    C: is FIXED (NTFS) - 466 GiB total, 307.143 GiB free.
    E: is Removable
    F: is Removable
    G: is Removable
    K: is Removable
    ==== Disabled Device Manager Items =============
    Class GUID:
    Description: iR1018/1022/1023
    Device ID: USB\VID_04A9&PID_269D&MI_00\6&28F23473&0&0000
    Name: iR1018/1022/1023
    PNP Device ID: USB\VID_04A9&PID_269D&MI_00\6&28F23473&0&0000
    Class GUID: {4d36e965-e325-11ce-bfc1-08002be10318}
    Description: CD-ROM Drive
    Device ID: IDE\CDROMPLDS_DVD-ROM_DH-16D3S___________________SD11____\5&B18AC95&0&2.0.0
    Manufacturer: (Standard CD-ROM drives)
    Name: PLDS DVD-ROM DH-16D3S ATA Device
    PNP Device ID: IDE\CDROMPLDS_DVD-ROM_DH-16D3S___________________SD11____\5&B18AC95&0&2.0.0
    Service: cdrom
    Class GUID: {4d36e965-e325-11ce-bfc1-08002be10318}
    Description: CD-ROM Drive
    Device ID: IDE\CDROMOPTIARC_DVD+-RW_AD-7200S________________102A____\5&1DD25D3A&0&3.0.0
    Manufacturer: (Standard CD-ROM drives)
    Name: Optiarc DVD+-RW AD-7200S ATA Device
    PNP Device ID: IDE\CDROMOPTIARC_DVD+-RW_AD-7200S________________102A____\5&1DD25D3A&0&3.0.0
    Service: cdrom
    ==== System Restore Points ===================
    ==== Installed Programs ======================
    Update for Microsoft Office 2007 (KB2508958)
    7-Zip 4.65
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.3
    Adobe Shockwave Player 11.5
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Install Manager
    avast! Free Antivirus
    Belkin F7D1101 Basic Wireless USB Adapter
    Bing Bar
    Brother P-touch Editor 5.0
    Canon iR1018/1022/1023
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    CCC Help English
    Cerenade Filler
    CKZ Time Clock 4.05.02
    Cooliris for Internet Explorer
    Coupon Printer for Windows Toolbar
    Dell Driver Download Manager
    Dell Resource CD
    eFax Messenger
    Express Scribe
    GIMP 2.6.9
    Google Toolbar for Internet Explorer
    Google Update Helper
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Java Auto Updater
    Java(TM) 6 Update 22
    Java(TM) 6 Update 23
    JMB36X Raid Configurer
    Malwarebytes' Anti-Malware version
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Basic 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft UI Engine
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Web Publishing Wizard 1.52
    MobileMe Control Panel
    Moraff's Maximum MahJongg
    Mozilla Firefox 5.0 (x86 en-US)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    office Convert Pdf to Jpg Jpeg Tiff Free 6.4 3.3
    PhotoStage Slideshow Producer
    Picasa 3
    PrimoPDF -- by Nitro PDF Software
    QuickBooks Pro 2008
    Realtek 8169 8168 8101E 8102E Ethernet Driver
    Realtek High Definition Audio Driver
    Roxio Activation Module
    Roxio Creator Audio
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Drag-to-Disc
    Roxio Express Labeler 3
    Roxio Update Manager
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2509488)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft Office 2007 System (KB2541012)
    Security Update for Microsoft Office Excel 2007 (KB2541007)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Serif PagePlus SE 1.0
    Shutterfly Express Uploader
    SiteSpinner V2
    Skype Toolbars
    Skype™ 5.3
    Smart Defrag 2
    Sonic CinePlayer Decoder Pack
    Splashtop Streamer
    SupportSoft Assisted Service
    TeamViewer 6
    The Print Shop 21
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2007 System (KB2539530)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office Outlook 2007 (KB2509470)
    Update for Microsoft Office Outlook 2007 Help (KB963677)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Update for Outlook 2007 Junk Email Filter (KB2586924)
    VeryPDF PDF Editor v2.6
    Windows Live ID Sign-in Assistant
    Windows Mobile Device Center
    Windows Mobile Device Updater Component
    Wireless-G PCI Adapter
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar
    YouSendIt Plug-in for Outlook
    Zune Language Pack (DEU)
    Zune Language Pack (ESP)
    Zune Language Pack (FRA)
    Zune Language Pack (ITA)
    Zune Language Pack (NLD)
    Zune Language Pack (PTB)
    Zune Language Pack (PTG)
    ==== Event Viewer Messages From Past Week ========
    8/29/2011 9:25:26 AM, Error: Service Control Manager [7024] - The Apache2.2 service terminated with service-specific error 1 (0x1).
    8/29/2011 9:23:46 AM, Error: EventLog [6008] - The previous system shutdown at 9:06:52 AM on 8/29/2011 was unexpected.
    8/29/2011 10:07:54 AM, Error: Service Control Manager [7000] - The iPodDrv service failed to start due to the following error: The system cannot find the file specified.
    8/29/2011 10:06:20 AM, Error: EventLog [6008] - The previous system shutdown at 10:03:39 AM on 8/29/2011 was unexpected.
    8/27/2011 8:25:02 PM, Error: EventLog [6008] - The previous system shutdown at 8:22:53 PM on 8/27/2011 was unexpected.
    8/27/2011 7:38:11 PM, Error: EventLog [6008] - The previous system shutdown at 7:35:40 PM on 8/27/2011 was unexpected.
    8/27/2011 6:27:31 PM, Error: Service Control Manager [7034] - The Advanced SystemCare Service service terminated unexpectedly. It has done this 1 time(s).
    8/26/2011 7:30:08 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease for the Network Card with network address 944452706582 has been denied by the DHCP server (The DHCP Server sent a DHCPNACK message).
    8/26/2011 3:00:09 AM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address The computer with the IP address did not allow the name to be claimed by this computer.
    8/25/2011 6:22:48 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.
    8/25/2011 6:22:19 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service.
    8/25/2011 3:11:31 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Eventlog service.
    8/22/2011 3:05:41 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Tussey-PC\Tussey SID (S-1-5-21-413474157-2574016083-4173898664-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    ==== End Of File ===========================

    Thanks so much.
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    Welcome to TechSpot! I'll help with the malware.

    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.
    • Please let me know if there is any change in the system.

    If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
    You should know that part of Avast job is to block malware. That is a good thing. Some AV programs have 'Alerts' that will popup and advise you of something that's been blocked. If that is the case, most AV programs have a box to uncheck this alert.

    If, on the other hand, malware got into the system and you were being advised and didn't run a scan and have Avast clean to malware, that is different. Since there are many reasons for "slow", it may or may not be due to malware.
    You are running a great number of processes, many of them should only run when you're using the program such as camera, media players and we will be removing entries related to this: Coupon Printer for Windows and Toolbar. You're not getting these coupons for free. They're are sending ads, possibly some malware.
    Running MathPlayer would make me consider that this is either our work computer or it's school related.
    I don't see Advanced SystemCare listed in the installed programs, but it's on the system, trying to run. I strongly suggest uninstalling this> neither the program or it's home site are recommended.
    Please tell me how much RAM is installed.
    Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once installed, you should see a blue screen prompt that says:
      The Recovery Console was successfully installed.
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.

    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish

    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    There are 2 outdated versions of Java: Java(TM) 6 Update 22 and Java(TM) 6 Update 23. Please update now to the current v6u27> Java Updates . Uninstall any earlier versions in Add/Remove Programs as they are vulnerabilities for the system.
    Note: Uncheck 'Install Yahoo Toolbar' on the download screen before you do the update.
    Logs in next reply please.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...