[Asimor]

So, Im running Windows XP pro, i have reformatted a number of times to try and fix my problem, and it simply doesnt fix it :S
Which is rather strange seeing as a format is almost like starting fresh, ive tried replacing CD drives, Spyware scans, Virus scans, Malware scans, HJT scans, all of which gave nothing out of the ordinary, ive even tried using a different hard drive, resetting BIOS settings, resetting CMOS, resetting the pagefile.sys,
basically ive tried to think of everywhere data is stored (other than just on a hard drive because the problem persists through a format) and tried to wipe/reset it

I have no idea as to what is exactly on my system, i do have a talk talk router "echolife 520's" which i beleive may be providing me with these problems, but i have also tried reformatting in friends houses (to avoid the use of the internet&router) and the problem still previals. Is there anywhere on the motherboard where some virus/spyware/malware/whateverthe[bleep]ihave can be stored?

The main side effects, i download lets say, Nvidia Graphics Drivers from the offical nvidia driver page, and as the download finishes i click open (through firefox) and as the installer starts to unpack the driver files it will say something along the lines of "the executable you are trying to run is corrupted, please verify the files intergrity and try again, or re download the drivers". When i try and download AVG free, from the AVG offical webpage, it downloads, i try to run it, and that too gives an error of the files being corrupted, eg "CRC failed in *filename*.Bat/exe"

This problem is really starting to annoy me, the easiest way out of it is to buy a new pc ofc, and i really cant afford it so this is not an option.
Please help.

Edited by Asimor, 24 January 2008 - 11:19 AM.

[Advertisements]

Hello

Download rootchk by Ejvindh to your desktop.

• Temporarily Disable Real Time Monitoring Programs you have running that are listed here, such as TeaTimer, Adwatch, and HIPs programs like Prevx, while we complete the fixes (see **Note below).
• Disconnect from the internet
• Double click rootchk.exe to run the program
• After a short time a logfile will open.
• Copy the contents of the log into your next reply.
• Re-enable active protection on any program you have disabled while completing the scan

**Note:If you are using the ZoneAlarm Pro firewall or any other security program that protects your registry (Teatimer, Adwatch, Prevx), rootchk may produce false positives. That is why it is important for you to disable these programs before running a rootchk scan. To prevent ZoneAlarm Pro conflicts, first enable the Windows Firewall (click start | Control Panel | Windows Firewall and select the checkbox to turn it on). Then disable ZoneAlarm Pro before running the rootchk. Also, disable any other active protection programs including HIPs that block registry write access. After the scan, be sure re-enable ZoneAlarm Pro and any other active protection programs you have temporarily disabled.



Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

[Rorschach112]

Hello

Download rootchk by Ejvindh to your desktop.

• Temporarily Disable Real Time Monitoring Programs you have running that are listed here, such as TeaTimer, Adwatch, and HIPs programs like Prevx, while we complete the fixes (see **Note below).
• Disconnect from the internet
• Double click rootchk.exe to run the program
• After a short time a logfile will open.
• Copy the contents of the log into your next reply.
• Re-enable active protection on any program you have disabled while completing the scan

**Note:If you are using the ZoneAlarm Pro firewall or any other security program that protects your registry (Teatimer, Adwatch, Prevx), rootchk may produce false positives. That is why it is important for you to disable these programs before running a rootchk scan. To prevent ZoneAlarm Pro conflicts, first enable the Windows Firewall (click start | Control Panel | Windows Firewall and select the checkbox to turn it on). Then disable ZoneAlarm Pro before running the rootchk. Also, disable any other active protection programs including HIPs that block registry write access. After the scan, be sure re-enable ZoneAlarm Pro and any other active protection programs you have temporarily disabled.



Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

[Asimor]

Hello there, thx for your time

Deckard's System Scanner v20071014.68
Run by Asimor on 2008-01-29 18:22:41
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Failed to create restore point; System Restore is disabled (service is not running).


-- Last 5 Restore Point(s) --
17: 2008-01-23 14:19:28 UTC - RP17 - Software Distribution Service 3.0
16: 2008-01-23 12:44:41 UTC - RP16 - Installed Microsoft .NET Framework 1.1
15: 2008-01-23 12:41:47 UTC - RP15 - Installed NVIDIA ForceWare Network Access Manager
14: 2008-01-23 12:34:07 UTC - RP14 - Installed Sound Blaster Audigy
13: 2008-01-23 12:33:10 UTC - RP13 - Installed Creative WaveStudio


-- First Restore Point --
1: 2008-01-23 12:27:37 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Percentage of Memory in Use: 90% (more than 75%).
Total Physical Memory: 511 MiB (512 MiB recommended).


-- HijackThis (run as Asimor.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:23:01, on 29/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Asimor\My Documents\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Asimor.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 2397 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20080123-160114-491 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
backup-20080123-160114-628 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
backup-20080123-160114-660 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
backup-20080123-160114-837 O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
backup-20080123-160114-848 O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
backup-20080123-160114-931 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
backup-20080124-003231-519 O1 - Hosts: 128.0.0.1 localhost

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>

S3 SABProcEnum - c:\program files\mozilla firefox\sabprocenum.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 ForceWare Intelligent Application Manager (IAM) - c:\program files\nvidia corporation\networkaccessmanager\bin\nsvcappflt.exe <Not Verified; ; app_filter Module>
R2 ForcewareWebInterface (Forceware Web Interface) - "c:\program files\nvidia corporation\networkaccessmanager\apache group\apache2\bin\apache.exe" -k runservice <Not Verified; Apache Software Foundation; Apache HTTP Server>
R2 nSvcIp (ForceWare IP service) - c:\program files\nvidia corporation\networkaccessmanager\bin\nsvcip.exe <Not Verified; NVIDIA; NVIDIA nSvcIp>
R2 nSvcLog (ForceWare user log service) - c:\program files\nvidia corporation\networkaccessmanager\bin\nsvclog.exe <Not Verified; NVIDIA; NVIDIA nSvcLog>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Ethernet Controller
Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_100A15BD&REV_13\4&13699180&0&5048
Manufacturer:
Name: Ethernet Controller
PNP Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_100A15BD&REV_13\4&13699180&0&5048
Service:

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: PS/2 Compatible Mouse
Device ID: ACPI\PNP0F13\3&2411E6FE&0
Manufacturer: Microsoft
Name: PS/2 Compatible Mouse
PNP Device ID: ACPI\PNP0F13\3&2411E6FE&0
Service: i8042prt


-- Files created between 2007-12-29 and 2008-01-29 -----------------------------

2008-01-29 14:12:07 0 d-------- C:\Documents and Settings\Asimor\Application Data\WinRAR
2008-01-25 03:11:09 0 d-------- C:\Program Files\Teamspeak2_RC2
2008-01-25 01:36:00 0 d-------- C:\Documents and Settings\Asimor\Application Data\teamspeak2
2008-01-24 15:47:26 0 d-------- C:\WINDOWS\nview
2008-01-24 15:38:54 0 d--h----- C:\WINDOWS\system32\GroupPolicy
2008-01-24 15:13:42 0 d-------- C:\NVIDIA
2008-01-23 16:23:44 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-01-23 15:52:58 0 d-------- C:\Documents and Settings\Asimor\Application Data\Macromedia
2008-01-23 15:52:57 0 d-------- C:\Documents and Settings\Asimor\Application Data\Adobe
2008-01-23 15:22:12 0 d-------- C:\WINDOWS\system32\SuperAdBlocker.com
2008-01-23 14:53:35 0 d-------- C:\Program Files\Trend Micro
2008-01-23 14:49:47 396 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-23 14:49:37 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-23 14:49:37 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-01-23 14:49:37 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-01-23 14:49:37 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-01-23 14:49:37 81920 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-01-23 14:49:37 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-23 14:44:19 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-23 14:44:17 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-01-23 14:44:17 0 d-------- C:\Documents and Settings\Asimor\Application Data\SUPERAntiSpyware.com
2008-01-23 14:29:23 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-23 14:19:55 0 d-------- C:\Documents and Settings\Asimor\Application Data\Mozilla
2008-01-23 14:19:30 0 d-------- C:\WINDOWS\system32\PreInstall
2008-01-23 14:19:29 0 d--h----- C:\WINDOWS\$hf_mig$
2008-01-23 14:16:03 0 d---s---- C:\Documents and Settings\Asimor\UserData
2008-01-23 14:15:58 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-01-23 13:20:14 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-01-23 13:08:28 0 d-------- C:\Program Files\World of Warcraft
2008-01-23 12:55:31 0 d-------- C:\WINDOWS\pss
2008-01-23 12:44:43 0 d-------- C:\WINDOWS\system32\URTTemp
2008-01-23 12:42:13 0 d-------- C:\Program Files\NVIDIA Corporation
2008-01-23 12:41:40 0 d-------- C:\WINDOWS\Downloaded Installations
2008-01-23 12:36:50 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-01-23 12:34:55 41984 -----n--- C:\WINDOWS\Ctregrun.exe <Not Verified; Creative Technology Ltd; Creative On-line Registration System>
2008-01-23 12:33:27 0 d-------- C:\WINDOWS\system32\Data
2008-01-23 12:32:02 0 d-------- C:\WINDOWS\RegisteredPackages
2008-01-23 12:31:55 0 d-------- C:\Program Files\Creative
2008-01-23 12:30:18 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-23 12:30:16 0 d-------- C:\Program Files\Common Files\InstallShield
2008-01-23 12:27:25 0 d-------- C:\Documents and Settings\Asimor\Application Data\Identities
2008-01-23 12:27:20 0 dr-h----- C:\Documents and Settings\Asimor\SendTo
2008-01-23 12:27:20 0 dr-h----- C:\Documents and Settings\Asimor\Recent
2008-01-23 12:27:20 0 d--h----- C:\Documents and Settings\Asimor\PrintHood
2008-01-23 12:27:20 0 d--h----- C:\Documents and Settings\Asimor\NetHood
2008-01-23 12:27:20 0 dr------- C:\Documents and Settings\Asimor\My Documents
2008-01-23 12:27:20 0 d--h----- C:\Documents and Settings\Asimor\Local Settings
2008-01-23 12:27:20 0 dr------- C:\Documents and Settings\Asimor\Favorites
2008-01-23 12:27:20 0 d-------- C:\Documents and Settings\Asimor\Desktop
2008-01-23 12:27:20 0 d---s---- C:\Documents and Settings\Asimor\Cookies
2008-01-23 12:27:20 0 dr-h----- C:\Documents and Settings\Asimor\Application Data
2008-01-23 12:27:19 0 d--h----- C:\Documents and Settings\Asimor\Templates
2008-01-23 12:27:19 0 dr------- C:\Documents and Settings\Asimor\Start Menu
2008-01-23 12:27:19 1048576 --ah----- C:\Documents and Settings\Asimor\NTUSER.DAT
2008-01-23 12:26:33 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-01-23 12:26:31 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-01-23 12:26:31 0 d-------- C:\WINDOWS\Prefetch
2008-01-23 12:26:29 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2008-01-23 12:26:29 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2008-01-23 12:26:29 0 d---s---- C:\Documents and Settings\LocalService\Cookies
2008-01-23 12:26:29 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-01-23 12:26:29 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-01-23 12:25:54 225280 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-01-23 12:25:54 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-01-23 12:25:54 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2008-01-23 12:25:54 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-01-23 12:25:54 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-01-23 12:23:16 0 d-------- C:\WINDOWS\system32\xircom
2008-01-23 12:23:15 0 d-------- C:\Program Files\microsoft frontpage
2008-01-23 12:23:08 262144 --ah----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-01-23 12:22:59 0 -rahs---- C:\MSDOS.SYS
2008-01-23 12:22:59 0 -rahs---- C:\IO.SYS
2008-01-23 12:22:59 0 --a------ C:\CONFIG.SYS
2008-01-23 12:22:59 0 --a------ C:\AUTOEXEC.BAT
2008-01-23 12:22:05 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-01-23 12:21:55 0 dr------- C:\WINDOWS\Offline Web Pages
2008-01-23 12:21:55 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-01-23 12:21:45 0 d--h----- C:\Program Files\WindowsUpdate
2008-01-23 12:21:28 0 d-------- C:\WINDOWS\system32\DirectX
2008-01-23 12:21:06 0 d---s---- C:\WINDOWS\Tasks
2008-01-23 12:21:06 0 d-------- C:\Program Files\Common Files\MSSoap
2008-01-23 12:21:03 0 d-------- C:\WINDOWS\system32\Macromed
2008-01-23 12:21:03 0 d-------- C:\WINDOWS\srchasst
2008-01-23 12:20:58 0 d-------- C:\Program Files\Movie Maker
2008-01-23 12:20:52 0 d-------- C:\WINDOWS\system32\Restore
2008-01-23 12:20:24 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-01-23 12:20:05 0 d-------- C:\WINDOWS\Registration
2008-01-23 12:19:57 0 d-------- C:\Program Files\Online Services
2008-01-23 12:19:49 0 d-------- C:\Program Files\Messenger
2008-01-23 12:19:47 0 d-------- C:\Program Files\MSN Gaming Zone
2008-01-23 12:19:24 0 d-------- C:\Program Files\Windows NT
2008-01-23 12:19:22 0 d-------- C:\WINDOWS\system32\MsDtc
2008-01-23 12:19:21 0 d-------- C:\WINDOWS\system32\Com
2008-01-23 12:10:52 0 d--hs---- C:\WINDOWS\Installer
2008-01-23 12:10:52 0 d-------- C:\Program Files\Common Files\ODBC
2008-01-23 12:10:49 0 dr------- C:\Program Files
2008-01-23 12:10:49 0 d-------- C:\Program Files\Common Files
2008-01-23 12:10:49 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-01-23 12:10:29 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-01-23 12:10:29 0 dr------- C:\Documents and Settings\Default User\Start Menu
2008-01-23 12:10:29 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-01-23 12:10:29 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-01-23 12:10:29 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-01-23 12:10:29 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-01-23 12:10:29 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-01-23 12:10:29 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-01-23 12:10:29 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-01-23 12:10:29 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-01-23 12:10:29 0 d---s---- C:\Documents and Settings\Default User\Cookies
2008-01-23 12:10:29 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-01-23 12:10:29 0 dr------- C:\Documents and Settings\All Users\Start Menu
2008-01-23 12:10:29 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-01-23 12:10:29 0 dr------- C:\Documents and Settings\All Users\Documents
2008-01-23 12:10:29 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-01-23 12:10:18 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-01-23 12:10:18 0 d-------- C:\WINDOWS\system32\CatRoot
2008-01-23 12:10:13 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-01-23 12:10:13 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-01-23 12:10:13 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2008-01-23 12:10:13 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-01-23 12:09:54 0 d--hs---- C:\System Volume Information
2008-01-23 12:09:54 0 d-------- C:\Documents and Settings
2008-01-23 12:04:52 0 d-------- C:\WINDOWS
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\WinSxS
2008-01-23 12:04:52 0 dr------- C:\WINDOWS\Web
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\twain_32
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\wins
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\wbem
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\usmt
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\spool
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\ShellExt
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\Setup
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\ras
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\oobe
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\npp
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\mui
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\inetsrv
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\IME
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\icsxml
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\ias
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\export
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\drivers
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-01-23 12:04:52 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\dhcp
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\config
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\3076
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\2052
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1054
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1042
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1041
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1037
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1033
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1031
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1028
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system32\1025
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\system
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\security
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Resources
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\repair
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Provisioning
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\PeerNet
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\pchealth
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\mui
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\msapps
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\msagent
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Media
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\java
2008-01-23 12:04:52 0 d--h----- C:\WINDOWS\inf
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\ime
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Help
2008-01-23 12:04:52 0 dr--s---- C:\WINDOWS\Fonts
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\ehome
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Driver Cache
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Debug
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Cursors
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Connection Wizard
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\Config
2008-01-23 12:04:52 0 d-------- C:\WINDOWS\AppPatch


-- Find3M Report ---------------------------------------------------------------

2008-01-23 12:10:29 62 --ahs---- C:\Documents and Settings\Asimor\Application Data\desktop.ini
2007-12-05 01:41:00 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2007-12-05 01:41:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2007-12-05 01:41:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 01:41:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2007-12-05 01:41:00 1474560 --a------ C:\WINDOWS\system32\nview.dll
2007-12-05 01:41:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2007-12-05 01:41:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2007-12-05 01:41:00 425984 --a------ C:\WINDOWS\system32\keystone.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [29/04/2005 18:22]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/12/2007 01:41]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/12/2007 01:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [27/02/2007 11:39]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 27/02/2007 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P17Helper]
Rundll32 P17.dll,P17Helper

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Spooler"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{100b34c2-c9ac-11dc-bfac-806d6172696f}]
AutoRun\command- D:\SETUP.EXE /UPDATE




-- End of Deckard's System Scanner: finished at 2008-01-29 18:23:58 ------------

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon™ 64 X2 Dual Core Processor 4400+
CPU 1: AMD Athlon™ 64 X2 Dual Core Processor 4400+
Percentage of Memory in Use: 87%
Physical Memory (total/avail): 510.42 MiB / 65.3 MiB
Pagefile Memory (total/avail): 1245.53 MiB / 626.17 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1922.74 MiB

C: is Fixed (NTFS) - 279.47 GiB total, 267.04 GiB free.
D: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - Maxtor 6L300R0 - 279.47 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 279.47 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.
AntiVirusDisableNotify is set.
FirewallDisableNotify is set.

FW: NVIDIA Firewall v1.0 (NVIDIA Corporation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Asimor\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=ASIM0R
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Asimor
LOGONSERVER=\\ASIM0R
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 35 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2302
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Asimor\LOCALS~1\Temp
TMP=C:\DOCUME~1\Asimor\LOCALS~1\Temp
USERDOMAIN=ASIM0R
USERNAME=Asimor
USERPROFILE=C:\Documents and Settings\Asimor
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Asimor (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> "C:\Program Files\Creative\SBAudigy\Program\Setup.exe" /S /U /W
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34EBD418-B8E6-4E86-89C4-33B72CF5663F}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34EBD418-B8E6-4E86-89C4-33B72CF5663F}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{52338F65-A1C3-4CDC-B733-50051682B297}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{52338F65-A1C3-4CDC-B733-50051682B297}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{569A9538-86EC-44C3-8EE4-C68B165F2A75}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{569A9538-86EC-44C3-8EE4-C68B165F2A75}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5B17E626-7885-4FC3-A66A-73548A4F01FD}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5B17E626-7885-4FC3-A66A-73548A4F01FD}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{73919E2B-725C-4FAA-8473-45E063A3575F}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{73919E2B-725C-4FAA-8473-45E063A3575F}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9194237B-7B58-40B4-A739-184AD59531A2}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9194237B-7B58-40B4-A739-184AD59531A2}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BD6928A2-9F8F-4AA7-9A3A-FD4A271712EE}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BD6928A2-9F8F-4AA7-9A3A-FD4A271712EE}\setup.exe" -l0x9 /remove
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE4A4C48-2232-4CCB-AD61-490ACD29BA85}\setup.exe" -l0x9
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE4A4C48-2232-4CCB-AD61-490ACD29BA85}\setup.exe" -l0x9 /remove
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Mozilla Firefox (2.0.0.11) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NVIDIA Drivers --> C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA ForceWare Network Access Manager --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1033
Sound Blaster Audigy --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1B1DDAD2-C704-49F8-8FC2-18DAAD9A87C5}\SETUP.EXE" -l0x9 /remove
SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
TeamSpeak 2 RC2 --> "C:\Program Files\Teamspeak2_RC2\unins000.exe"
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
World of Warcraft --> C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type263 / Error
Event Submitted/Written: 01/26/2008 10:46:42 PM
Event ID/Source: 1001 / Application Error
Event Description:
Fault bucket 61618944.
The Wep key exchange did not result in a secure connection setup after 802.1x authentication. The current setting has been marked as failed and the Wireless connection will be disconnected.

Event Record #/Type262 / Error
Event Submitted/Written: 01/26/2008 10:46:33 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application teamspeak.exe, version 2.0.32.60, faulting module teamspeak.exe, version 2.0.32.60, fault address 0x0010c307.
Processing media-specific event for [teamspeak.exe!ws!]

Event Record #/Type261 / Warning
Event Submitted/Written: 01/26/2008 07:25:13 PM
Event ID/Source: 1005 / Windows Product Activation
Event Description:
Your Windows product has not been activated with Microsoft yet. Please use the Product Activation Wizard within 27 days.

Event Record #/Type243 / Warning
Event Submitted/Written: 01/25/2008 03:00:55 AM
Event ID/Source: 1020 / ASP.NET 1.1.4322.0
Event Description:
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

Event Record #/Type239 / Error
Event Submitted/Written: 01/25/2008 03:00:54 AM
Event ID/Source: 0 / System.EnterpriseServices
Event Description:
System.EnterpriseServices failed to install. Please fix the problem (see exception below) and run 'regasm System.EnterpriseServices.dll' again to install System.EnterpriseServices.

Exception:
'System.Runtime.InteropServices.COMException (0x8004E00F): COM+ was unable to talk to the Microsoft Distributed Transaction Coordinator
at System.EnterpriseServices.Admin.ICatalog2.CurrentPartition(String bstrPartitionIDOrName)
at System.EnterpriseServices.RegistrationHelperTx.InstallUtilityApplication(Type t)'



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type804 / Error
Event Submitted/Written: 01/29/2008 06:19:06 PM
Event ID/Source: 7034 / Service Control Manager
Event Description:
The COM+ Event System service terminated unexpectedly. It has done this 1 time(s).

Event Record #/Type803 / Error
Event Submitted/Written: 01/29/2008 06:19:06 PM
Event ID/Source: 7034 / Service Control Manager
Event Description:
The Error Reporting Service service terminated unexpectedly. It has done this 1 time(s).

Event Record #/Type802 / Error
Event Submitted/Written: 01/29/2008 06:19:06 PM
Event ID/Source: 7034 / Service Control Manager
Event Description:
The Logical Disk Manager service terminated unexpectedly. It has done this 1 time(s).

Event Record #/Type801 / Error
Event Submitted/Written: 01/29/2008 04:32:25 PM
Event ID/Source: 7034 / Service Control Manager
Event Description:
The Windows User Mode Driver Framework service terminated unexpectedly. It has done this 1 time(s).

Event Record #/Type796 / Error
Event Submitted/Written: 01/29/2008 08:08:55 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
The Computer Browser service terminated with the following error:
%%1460



-- End of Deckard's System Scanner: finished at 2008-01-29 18:23:58 ------------

********************************* ROOTCHK-(28-12-07)-LOG, by ejvindh
29/01/2008 18:28:11.09

NOTICE!! Rootchk is not being updated anymore, and is thus gradually getting outdated.
Last update was made 28-12-07

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end


catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 18:28:13
Windows 5.1.2600 Service Pack 2
scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

hidden processes: 0
hidden services: 0
hidden files: 0


And as for the online scanner, it downloaded 90% of the files and returned with an error for now, il try again now tho....

this is what i dont understand and the main quim for fixing my problem
"Percentage of Memory in Use: 90% (more than 75%).
Total Physical Memory: 511 MiB (512 MiB recommended)."
I only have 26 running processes, including microsofts needed processes
Which is quite good, and judging by the task managers "memory usage" column they nowhere near add up to 450 Meg
And i need that Ram memory for playing games, coz its not that much anyway, most new games require at least 1gig of ram.
:/

Edited by Asimor, 29 January 2008 - 01:25 PM.

[Rorschach112]

If it fails again then do this

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.

[Asimor]

Process.exe;C:\Documents and Settings\Asimor\Desktop\SmitfraudFix;Tool.Prockill;Incurable.Deleted.;
restart.exe;C:\Documents and Settings\Asimor\Desktop\SmitfraudFix;Tool.ShutDown.11;Incurable.Deleted.;
Process.exe;C:\Program Files\Mozilla Firefox\SmitfraudFix;Tool.Prockill;Incurable.Deleted.;
restart.exe;C:\Program Files\Mozilla Firefox\SmitfraudFix;Tool.ShutDown.11;Incurable.Deleted.;
Process.exe;C:\WINDOWS\system32;Tool.Prockill;Incurable.Deleted.;
hack tools :|

Im guess i shouldnt have selected "delete uncuarble", (only reason i think this, is because maybe "process.exe" in the windows system32 folder might actually be needed for windows to run) ah well il know when i reboot lol XD
After browsing a forum i adminisrate ive noticed images dont load, lol.
Also, tested my pc with a download and the .exe's are still getting infected
Just so you know

Anything else i must do master?

Edited by Asimor, 31 January 2008 - 07:08 AM.

[Rorschach112]

Can you explain your problem again

It doesn't look like it is malware related

[Asimor]

Right ok mate no problem,
Well, the first thing i noticed, was that i am not able to download and install programs, like for example, i try to download AVG, it downloads, i double click on the .exe, the CRC check fails and returns with an error "the exe you are trying to run is infected" or something along those lines.
Another thing i notice, i play world of warcraft, and i get spikes of lagg, Not F.P.S lagg, Or latency(ping) lagg, but local Computer lagg, and this should not be happening at all, i get disconnected from the server about 6 times every evening i play (averaging 4 hrs an evening), its like my computer just stopps communicating with the game server because it does not want to? :S.
Also another thing i notice, my pagefile size is extremely high, the phsyical memory which my computer is using is unexplainably high, like at the moment i have 21 running processes, most of which are windows processes, the largest is 26 MiB (firefox), the next largest is 4 MiB, and they all go down in size till the smallest being 0 kilobytes, and yet my RAM memory usage is 200 MiB, lets say all the processes (apart from firefox) are 4 meg, 20 x 4meg = 80 meg, and firefox 26meg, 106 MegaBytes, thats 100 Megabytes unaccounted for...Not only that but the running processes arent even all 4 megabytes each (the next largest after the 4 meg process is 1 meg).
Just to add, i dont think, personally, that the problem is hardware related, ive swapped ram sticks (yes im using identically sized 256 sticks), ive swapped the hard drive, just incase i had dead blocks on it, the problem still remains, and surely if it was my motherboard that was broke the computer wouldnt work at all.

My computer spec is
Cpu: AMD 4400+ Dual Core (2.2ghz)
GFX: Geforce 7900 GTX 512 MiB
Ram: 2x 256 sticks DDR 600mhz
PSU: 550watts
HDD: Maxtor something or other, IDE 7,800 RPM, may even be 10,200 RPM

Edited by Asimor, 31 January 2008 - 12:31 PM.

[Rorschach112]

Do this

Please download and unzip Icesword to its own folder on your desktop


If you get a lot of "red entries" in an IceSword log, don't panic.

Step 1 : Close all windows and run IceSword. Click the Processes tab and watch for processes displayed in red color. A red colored process in this list indicates that it's hidden. Write down the PathName of any processes in red color. Then click on LOG at the top left. It will prompt you to save the log, call this Processes and save it to your desktop.


Step 2 : Click the Win32 Services tab and look out for red colored entries in the services list. Write down the Module name of any services in red color, you will need to expand out the Module tab to see the full name. Then click on LOG. It will prompt you to save the log, call this Services and save it to your desktop.


Step 3 : Click the Startup tab and look out for red colored entries in the startup list. Write down the Path of any startup entries in red color. Then click on LOG. It will prompt you to save the log, call this Startup and save it to your desktop.


Step 4 : Click the SSDT tab and check for red colored entries. If there are any, write down the KModule name.


Step 5 : Click the Message Hooks tab and check for any entries that are underneath Type and labelled WH_KEYBOARD. Write down the Process Path of these entries if present.



Now post all of the data collected under the headings for :

Processes
Win32 Services
Startup
SSDT
Message Hooks

[Asimor]

There are only red entries for;-

SSDT
most red entry kmodule names are "unknown"
The ones that are not are as follows
\systemroot\system32\drivers\fwdrv.sys
\??\c:\Windows\system32\drivers\SYMEVENT.SYS
(both above entries occur more than once)


There is one message hook entry labelled WH_KEYBOARD
C:\program files\Common Files\Symantec Shared\ccApp.exe

Edited by Asimor, 03 February 2008 - 06:59 PM.

[Rorschach112]

Your logs are clean ! We need to do a few things

You can delete the tools that we used


Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* I notice that you have no firewall on your PC, this is extremely dangerous and leaves your PC open to vulnerabilities, so please download and install one of the following programs : ZoneAlarm, Comodo, or
Outpost
Make sure you only use one firewall though. A tutorial on understanding and using firewalls may be found here.

* I notice that you have no anti-virus program on your PC, this is extremely dangerous and leaves your PC open to vulnerabilities, so please download and install one of the following programs :
AVG makes an excellent free antivirus client, as do AntiVir or avast!.

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

[Asimor]

Heh, thanks for the advice, i will use that hosts file looks rather useful!
I already have an active anti spyware, Firefox, an active firewall, and an active antivirus


Its probably my router screwing me in the butt then
Thanks for the help mate
*high fives*

Edited by Asimor, 05 February 2008 - 06:00 PM.

[Rorschach112]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.