I am glad I found this page. I had the following 2 errors:
1) Data Execution Prevention - Generic Host Process for Win32 Services
Every time I close the window I send the info to Microsoft but the window just re-pops up.
2) AXWIN Frame Window: svchost.exe
The instruction at "some numbers" referenced memory at "some numbers". The memory could not be written.
I then received a warning from NT Authority System and my laptop counts down after a 60 second clock
and restarted with the same issues once again.
After running ComboFix, none of the windows has popped up so far again..... GREAT!!!!
But the ComboFix description told me to still post the log and have someone chekcing it for more potential viruses....
So, I would deeply appreciate if someone with the right knowledge could help me! THANK YOU VERY MUCH! Robin
Here is the log:
____________________________________________________________________
ComboFix 10-01-29.05 - Robin 01/29/2010 19:59:00.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3574.3042 [GMT -5:00]
Running from: c:\documents and settings\Robin\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\lowsec\user.ds.lll
c:\windows\system32\sdra64.exe
----- BITS: Possible infected sites -----
hxxp://armmf.adobe.com
Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it
.
((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-30 )))))))))))))))))))))))))))))))
.
2010-01-29 21:27 . 2010-01-29 21:27 -------- d-----w- c:\program files\Sun
2010-01-29 21:25 . 2010-01-29 21:26 -------- d-----w- c:\program files\Java
2010-01-29 19:42 . 2010-01-29 19:42 -------- d-----w- c:\program files\CCleaner
2010-01-12 21:59 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-30 01:14 . 2009-08-04 19:26 -------- d-----w- c:\documents and settings\Robin\Application Data\Skype
2010-01-30 00:05 . 2009-08-05 16:31 -------- d-----w- c:\documents and settings\Robin\Application Data\skypePM
2010-01-29 21:26 . 2009-08-25 17:01 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-29 20:02 . 2009-09-22 02:55 -------- d-----w- c:\documents and settings\Robin\Application Data\Azureus
2010-01-27 14:32 . 2004-08-04 10:00 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-01-14 00:14 . 2009-09-22 02:53 -------- d-----w- c:\program files\Vuze
2010-01-08 13:05 . 2009-11-29 01:06 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJPLM
2009-12-21 19:14 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-08 22:47 . 2009-08-03 23:45 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-02 01:55 . 2009-12-02 01:55 -------- d-----w- c:\documents and settings\All Users\Application Data\CanonIJ
2009-12-02 01:47 . 2009-12-02 01:47 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonIJScan
2009-12-01 22:48 . 2009-11-29 00:19 -------- d-----w- c:\documents and settings\Robin\Application Data\Canon Easy-WebPrint EX
2009-12-01 02:37 . 2009-12-01 02:37 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonIJMyPrinter
2009-11-21 15:51 . 2004-08-04 10:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2004-03-15 21:51 . 2004-03-15 21:51 114688 ----a-w- c:\program files\internet explorer\plugins\LV71ActiveXControl.dll
2003-05-01 13:36 . 2003-05-01 13:36 114688 ----a-w- c:\program files\internet explorer\plugins\LV7ActiveXControl.dll
2006-01-23 14:32 . 2006-01-23 14:32 131072 ----a-w- c:\program files\internet explorer\plugins\LV80ActiveXControl.dll
2007-02-08 14:48 . 2007-02-08 14:48 133920 ----a-w- c:\program files\internet explorer\plugins\LV82ActiveXControl.dll
2007-07-24 22:03 . 2007-07-24 22:03 118784 ----a-w- c:\program files\internet explorer\plugins\LV85ActiveXControl.dll
2008-06-26 02:51 . 2008-06-26 02:51 118784 ----a-w- c:\program files\internet explorer\plugins\LV86ActiveXControl.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25604904]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 303104]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-16 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-16 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-16 138008]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-01-26 159744]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"pdfFactory Dispatcher v3"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2009-06-12 606208]
"DataFinder"="c:\program files\National Instruments\Shared\DataFinderDesktop\bin\DataFinder.exe" [2007-10-21 2095648]
"niDevMon"="c:\program files\National Instruments\NI-DAQ\HWConfig\nidevmon.exe" [2008-12-30 109136]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\National Instruments\\Shared\\DataFinderDesktop\\bin\\DataFinder.exe"=
"c:\\Program Files\\National Instruments\\Shared\\mDNS Responder\\nimdnsResponder.exe"=
"c:\\Program Files\\National Instruments\\LabVIEW 8.5\\LabVIEW.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"<NO NAME>"=
R0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\system32\drivers\nipbcfk.sys [8/21/2008 7:04 PM 15448]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/3/2009 6:45 PM 108289]
R2 ni488enumsvc;NI-488.2 Enumeration Service;c:\windows\system32\nipalsm.exe [8/21/2008 9:51 PM 12696]
R2 niarbk;niarbk;c:\windows\system32\drivers\niarbk.dll [4/16/2007 2:40 PM 37376]
R2 nibffrk;nibffrk;c:\windows\system32\drivers\nibffrk.dll [4/16/2007 2:40 PM 21504]
R2 NICitadel5Service;National Instruments Citadel;c:\windows\system32\nicitdl5.exe [7/17/2007 2:37 PM 1145920]
R2 nidevldu;NI Device Loader;c:\windows\system32\nipalsm.exe [8/21/2008 9:51 PM 12696]
R2 niLXIDiscovery;National Instruments LXI Discovery Service;c:\vxipnp\WinNT\NIvisa\niLxiDiscovery.exe [6/20/2008 3:53 PM 129144]
R2 nimDNSResponder;National Instruments mDNS Responder Service;c:\program files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [6/18/2008 3:57 PM 192112]
R2 nimdsk;nimdsk;c:\windows\system32\drivers\nimdsk.dll [4/16/2007 2:41 PM 30208]
R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmkl.sys [12/18/2008 3:56 PM 11344]
R2 nistck;nistck;c:\windows\system32\drivers\niSTCk.dll [4/16/2007 2:42 PM 111616]
R2 NiViPxiK;NI-VISA PXI Driver;c:\windows\system32\drivers\NiViPxiKl.sys [6/20/2008 8:27 PM 11360]
R3 nidimk;nidimk;c:\windows\system32\drivers\nidimkl.sys [6/13/2008 1:51 PM 11360]
R3 nimru2k;nimru2k;c:\windows\system32\drivers\nimru2kl.sys [11/24/2008 12:42 AM 11360]
R3 nimstsk;nimstsk;c:\windows\system32\drivers\nimstskl.sys [12/29/2008 4:17 PM 11360]
R3 nipxigpk;NI PXI Generic Chassis Pilot;c:\windows\system32\drivers\nipxigpk.sys [6/25/2008 10:02 AM 20568]
S2 Nidaq32k;Nidaq32k;c:\windows\system32\drivers\nidaq32k.sys [4/16/2007 4:04 PM 674304]
S2 nidmmk;NI DMM and Data Logger Kernel Driver;c:\windows\system32\drivers\nidmmk.dll [4/16/2007 4:06 PM 50688]
S3 imaq1394k;imaq1394k;c:\windows\system32\drivers\imaq1394kl.sys [11/16/2007 3:06 PM 11480]
S3 lvalarmk;lvalarmk;c:\windows\system32\drivers\lvalarmk.sys [12/5/2008 2:21 PM 20104]
S3 ni1006k;NI PXI-1006 Chassis Pilot;c:\windows\system32\drivers\ni1006k.sys [11/11/2008 12:50 PM 26192]
S3 ni1045k;NI PXI-1045 Chassis Pilot;c:\windows\system32\drivers\ni1045kl.sys [11/11/2008 12:52 PM 11344]
S3 ni1065k;NI PXIe-1065 Chassis Pilot;c:\windows\system32\drivers\ni1065k.sys [11/11/2008 12:53 PM 22608]
S3 ni488lock;NI-488.2 Locking Service;c:\windows\system32\drivers\ni488lock.sys [2/26/2007 11:40 AM 16672]
S3 nicdrk;nicdrk;c:\windows\system32\drivers\nicdrkl.sys [1/2/2009 4:02 PM 11352]
S3 nicsrk;nicsrk;c:\windows\system32\drivers\nicsrkl.sys [2/6/2009 4:28 PM 11336]
S3 nidmxfk;nidmxfk;c:\windows\system32\drivers\nidmxfkl.sys [12/29/2008 4:21 PM 11336]
S3 nidsark;nidsark;c:\windows\system32\drivers\nidsarkl.sys [1/5/2009 8:30 AM 11344]
S3 nidwgk;nidwgk;c:\windows\system32\drivers\nidwgkl.sys [10/9/2007 4:35 PM 11360]
S3 niemrk;niemrk;c:\windows\system32\drivers\niemrkl.sys [2/6/2009 4:28 PM 11336]
S3 niesrk;niesrk;c:\windows\system32\drivers\niesrkl.sys [2/6/2009 4:28 PM 11336]
S3 nigplk;nigplk;c:\windows\system32\drivers\nigplkl.sys [2/23/2007 3:20 PM 11552]
S3 nihsdrk;nihsdrk;c:\windows\system32\drivers\nihsdrkl.sys [10/11/2007 10:51 AM 11352]
S3 niimaqdxk;niimaqdxk;c:\windows\system32\drivers\niimaqdxkl.sys [11/28/2007 8:55 AM 11320]
S3 niimaqk;NI-IMAQ Driver;c:\windows\system32\drivers\niimaqk.sys [8/4/2009 5:44 PM 254000]
S3 nimcdfxkw;NI-Motion Driver for FlexMotion;c:\windows\system32\drivers\nimcdfxkw.sys [8/10/2009 4:51 PM 11360]
S3 nimsdrk;nimsdrk;c:\windows\system32\drivers\nimsdrkl.sys [12/29/2008 4:24 PM 11392]
S3 nimslk;nimslk;c:\windows\system32\drivers\nimslk.dll [11/10/2008 10:36 PM 14464]
S3 nimsrlk;nimsrlk;c:\windows\system32\drivers\nimsrlk.dll [11/10/2008 10:36 PM 151683]
S3 nimxpk;nimxpk;c:\windows\system32\drivers\nimxpkl.sys [12/29/2008 4:18 PM 11368]
S3 ninshsdk;ninshsdk;c:\windows\system32\drivers\ninshsdkl.sys [7/30/2008 8:58 AM 11360]
S3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [12/16/2008 12:57 AM 11904]
S3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [12/16/2008 12:55 AM 11896]
S3 nipsdk;nipsdk;c:\windows\system32\drivers\nipsdkl.sys [12/25/2007 8:47 PM 11392]
S3 nirfsa2k;nirfsa2k;c:\windows\system32\drivers\niRFSA2kl.sys [6/30/2007 10:07 PM 11552]
S3 NiRioRpc;National Instruments RIO Server;c:\windows\system32\NiRioRpc.exe [7/27/2007 4:09 AM 28232]
S3 niscdk;niscdk;c:\windows\system32\drivers\niscdkl.sys [1/5/2009 8:28 AM 11376]
S3 nisdigk;nisdigk;c:\windows\system32\drivers\nisdigkl.sys [2/10/2009 5:19 PM 11352]
S3 nisftk;nisftk;c:\windows\system32\drivers\nisftkl.sys [7/30/2008 8:59 AM 11344]
S3 nisldk;nisldk;c:\windows\system32\drivers\nisldkl.sys [8/3/2007 2:08 PM 11624]
S3 nispdk;nispdk;c:\windows\system32\drivers\nispdkl.sys [1/5/2009 8:28 AM 11376]
S3 nispdkw;nispdkw;c:\windows\system32\drivers\nispdkw.sys [1/5/2009 8:28 AM 11376]
S3 nisrcdk;nisrcdk;c:\windows\system32\drivers\nisrcdkl.sys [11/13/2007 11:26 AM 11352]
S3 nissrk;nissrk;c:\windows\system32\drivers\nissrkl.sys [2/6/2009 4:28 PM 11336]
S3 nistc2k;nistc2k;c:\windows\system32\drivers\nistc2kl.sys [1/2/2009 4:37 PM 11312]
S3 nistcrk;nistcrk;c:\windows\system32\drivers\nistcrkl.sys [1/2/2009 4:40 PM 11360]
S3 niswdk;niswdk;c:\windows\system32\drivers\niswdkl.sys [7/28/2008 2:08 PM 11336]
S3 nitiork;nitiork;c:\windows\system32\drivers\nitiorkl.sys [1/2/2009 4:54 PM 11360]
S3 nitnr2k;nitnr2k;c:\windows\system32\drivers\nitnr2kl.sys [12/1/2007 5:01 PM 11328]
S3 niufurk;niufurk;c:\windows\system32\drivers\niufurkl.sys [2/6/2009 4:28 PM 11368]
S3 NiViFWK;NI-VISA FireWire Driver;c:\windows\system32\drivers\NiViFWKl.sys [6/20/2008 8:28 PM 11384]
S3 NiViPciK;NI-VISA PCI Driver;c:\windows\system32\drivers\NiViPciKl.sys [6/20/2008 8:27 PM 11360]
S3 niwdk;niwdk;c:\windows\system32\drivers\niwdk.sys [11/6/2007 11:35 AM 27136]
S3 niwfrk;niwfrk;c:\windows\system32\drivers\niwfrkl.sys [2/6/2009 4:28 PM 11336]
S3 nixsrk;nixsrk;c:\windows\system32\drivers\nixsrkl.sys [2/6/2009 4:28 PM 11336]
S3 nixsrkw;nixsrkw;c:\windows\system32\drivers\nixsrkw.sys [2/6/2009 4:28 PM 11336]
S3 usb6xxxk;usb6xxxk;\??\c:\windows\system32\drivers\usb6xxxkl.sys --> c:\windows\system32\drivers\usb6xxxkl.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
2010-01-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Robin\Application Data\Mozilla\Firefox\Profiles\4ip4kk5h.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPLV80Win32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPLV82Win32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nplv85win32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nplv86win32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-29 20:10
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(5352)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\lkcitdl.exe
c:\windows\system32\lkads.exe
c:\windows\system32\lktsrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\National Instruments\MAX\nimxs.exe
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\program files\National Instruments\Shared\Security\nidmsrv.exe
c:\windows\system32\nisvcloc.exe
c:\program files\National Instruments\Shared\Tagger\tagsrv.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\SigmaTel\C-Major Audio\WDM\StacSV.exe
c:\windows\stsystra.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Apoint\ApMsgFwd.exe
c:\windows\system32\wscntfy.exe
c:\program files\Apoint\HidFind.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-29 20:21:26 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-30 01:21
Pre-Run: 74,642,132,992 bytes free
Post-Run: 74,635,218,944 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 1AA1DEF9F794D1C286E3B22586BA6E51
Sign In
Create Account
