concerning "system volume information"

Question

necko 0 Light Poster

15 Years Ago

Last week I noticed that my scheduled scan by McAfee was taking much longer than it should. I checked and saw that an endless stream of files named "system volume information" were being scanned. It took six hours. I'm an old man with little knowledge of computers, but I managed to find out that these "system volume" files had some use for "system restore". This week I disabled the system restore function before the scheduled scan and scanning was finished in its regular one hour. But I don't know what prompted McAfee to scan system volume info files all of a sudden and I don't know whether I did right or wrong by disabling system restore. My OS is XP SP3.

windows-nt-2000-xp

2 Contributors
11 Replies
207 Views
1 Day Discussion Span
Latest Post 15 Years Ago Latest Post by Rik_

Rik_ 111 Nearly a Posting Maven

15 Years Ago

You should turn system restore back on immediately and leave it on.

It sounds like you need to clean out your old restore points though.

You can remove old restore points with Disk Cleanup, just click on the More Options tab.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

necko 0 Light Poster · Answer 1 · 2009-08-05T17:38:24+00:00

Thanks a lot Rik! Following your advice, I activated System Restore, deleted previous checkpoints using Disc Cleanup, ran a full scan and "system volume info" files didn't show up. But this doesn't keep me from wondering why McAfee decided to scan those files... Is there a way to find out whether they're infected or not?

Rik_ 111 Nearly a Posting Maven · Answer 2 · 2009-08-05T18:09:13+00:00

Yup, download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

necko 0 Light Poster · Answer 3 · 2009-08-05T19:25:02+00:00

Thank you very much indeed. The "system volume info" files were clean, but two registry data items were infected. Below is the complete log:

Malwarebytes' Anti-Malware 1.40
Database version: 2563
Windows 5.1.2600 Service Pack 3

05-Aug-09 16:02:38
mbam-log-2009-08-05 (16-02-38).txt

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 142914
Time elapsed: 35 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Rik_ 111 Nearly a Posting Maven · Answer 4 · 2009-08-05T19:36:59+00:00

Your machine was infected. If you could post a HJT log I can see if Mbam killed it completely. HJT can be found HERE.

necko 0 Light Poster · Answer 5 · 2009-08-05T20:28:26+00:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:10:01, on 05-Aug-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Well, here it is:
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\etMon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer -

{3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program

Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper -

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft

Office\Office12\GrooveShellExtensions.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -

C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper -

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common

Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO -

{B164E929-A1B6-4A06-B104-2CD0E90A88FF} -

c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper -

{DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program

Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} -

C:\Program Files\Google\Google Gears\Internet

Explorer\0.5.30.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl -

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program

Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar -

{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} -

c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [etMonitor] C:\WINDOWS\etMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft

Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program

Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program

Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program

Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Efe

Selman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe"

/c
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel

FW\Desktop\DesktopWeather.exe"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program

Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office\OSA9.EXE
O8 - Extra context menu item: Microsoft Excel'e &Ver -

res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} -

C:\Program Files\Google\Google Gears\Internet

Explorer\0.5.30.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings -

{09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google

Gears\Internet Explorer\0.5.30.0\gears.dll
O9 - Extra button: OneNote'a Gönder -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: OneNote'a G&önder -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/clien

t/wuweb_site.cab?1215805651994
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/cli

ent/muweb_site.cab?1215805864379
O17 -

HKLM\System\CCS\Services\Tcpip\..\{6FCE415F-51D0-46F3-8D2E-E9CC3D8CEB9D}

: NameServer = 4.2.2.1,4.2.2.2
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD}

- C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -

c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Google Update Service (gupdate1c9b8e5381dd8f0)

(gupdate1c9b8e5381dd8f0) - Google Inc. - C:\Program

Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun

Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -

C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program

Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. -

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. -

c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. -

C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. -

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. -

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. -

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee,

Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: ProtexisLicensing - Unknown owner -

C:\WINDOWS\system32\PSIService.exe

--
End of file - 13361 bytes

Rik_ 111 Nearly a Posting Maven · Answer 6 · 2009-08-05T20:35:39+00:00

In HJT, place a tick next to all O1 - Hosts: entries then click on the "fix checked" button.

Once done, reboot your pc and post a fresh HJT log. This time, can you please turn word wrap off in notepad before you post it.

necko 0 Light Poster · Answer 7 · 2009-08-05T21:09:24+00:00

As you said:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:02:01, on 05-Aug-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\etMon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
O1 - Hosts: 64.15.125.26 sjc-v87.sjc.youtube.com
O1 - Hosts: 64.15.125.27 sjc-v88.sjc.youtube.com
O1 - Hosts: 64.15.125.28 sjc-v89.sjc.youtube.com
O1 - Hosts: 64.15.125.29 sjc-v90.sjc.youtube.com
O1 - Hosts: 64.15.125.30 sjc-v91.sjc.youtube.com
O1 - Hosts: 64.15.125.31 sjc-v92.sjc.youtube.com
O1 - Hosts: 64.15.125.32 sjc-v93.sjc.youtube.com
O1 - Hosts: 64.15.125.33 sjc-v94.sjc.youtube.com
O1 - Hosts: 64.15.125.34 sjc-v95.sjc.youtube.com
O1 - Hosts: 64.15.125.35 sjc-v96.sjc.youtube.com
O1 - Hosts: 64.15.125.36 sjc-v97.sjc.youtube.com
O1 - Hosts: 64.15.125.37 sjc-v98.sjc.youtube.com
O1 - Hosts: 64.15.125.38 sjc-v99.sjc.youtube.com
O1 - Hosts: 64.15.125.39 sjc-v100.sjc.youtube.com
O1 - Hosts: 64.15.125.40 sjc-v101.sjc.youtube.com
O1 - Hosts: 64.15.125.41 sjc-v102.sjc.youtube.com
O1 - Hosts: 64.15.125.42 sjc-v103.sjc.youtube.com
O1 - Hosts: 64.15.125.43 sjc-v104.sjc.youtube.com
O1 - Hosts: 64.15.125.44 sjc-v105.sjc.youtube.com
O1 - Hosts: 64.15.125.45 sjc-v106.sjc.youtube.com
O1 - Hosts: 64.15.125.46 sjc-v107.sjc.youtube.com
O1 - Hosts: 64.15.125.47 sjc-v108.sjc.youtube.com
O1 - Hosts: 64.15.125.48 sjc-v109.sjc.youtube.com
O1 - Hosts: 64.15.125.49 sjc-v110.sjc.youtube.com
O1 - Hosts: 64.15.125.50 sjc-v111.sjc.youtube.com
O1 - Hosts: 64.15.125.51 sjc-v112.sjc.youtube.com
O1 - Hosts: 64.15.125.52 sjc-v113.sjc.youtube.com
O1 - Hosts: 64.15.125.53 sjc-v114.sjc.youtube.com
O1 - Hosts: 64.15.120.144 sjc-v153.sjc.youtube.com
O1 - Hosts: 64.15.120.145 sjc-v154.sjc.youtube.com
O1 - Hosts: 64.15.120.146 sjc-v155.sjc.youtube.com
O1 - Hosts: 64.15.120.147 sjc-v156.sjc.youtube.com
O1 - Hosts: 64.15.120.148 sjc-v157.sjc.youtube.com
O1 - Hosts: 64.15.120.149 sjc-v158.sjc.youtube.com
O1 - Hosts: 64.15.120.150 sjc-v159.sjc.youtube.com
O1 - Hosts: 64.15.120.151 sjc-v160.sjc.youtube.com
O1 - Hosts: 64.15.120.152 sjc-v161.sjc.youtube.com
O1 - Hosts: 64.15.120.153 sjc-v162.sjc.youtube.com
O1 - Hosts: 64.15.120.154 sjc-v163.sjc.youtube.com
O1 - Hosts: 64.15.120.155 sjc-v164.sjc.youtube.com
O1 - Hosts: 64.15.120.156 sjc-v165.sjc.youtube.com
O1 - Hosts: 64.15.120.157 sjc-v166.sjc.youtube.com
O1 - Hosts: 64.15.120.158 sjc-v167.sjc.youtube.com
O1 - Hosts: 64.15.120.159 sjc-v168.sjc.youtube.com
O1 - Hosts: 64.15.120.160 sjc-v169.sjc.youtube.com
O1 - Hosts: 64.15.120.161 sjc-v170.sjc.youtube.com
O1 - Hosts: 64.15.120.162 sjc-v171.sjc.youtube.com
O1 - Hosts: 64.15.120.163 sjc-v172.sjc.youtube.com
O1 - Hosts: 64.15.120.164 sjc-v173.sjc.youtube.com
O1 - Hosts: 64.15.120.165 sjc-v174.sjc.youtube.com
O1 - Hosts: 64.15.120.166 sjc-v175.sjc.youtube.com
O1 - Hosts: 64.15.120.167 sjc-v176.sjc.youtube.com
O1 - Hosts: 64.15.120.168 sjc-v177.sjc.youtube.com
O1 - Hosts: 64.15.120.169 sjc-v178.sjc.youtube.com
O1 - Hosts: 64.15.120.170 sjc-v179.sjc.youtube.com
O1 - Hosts: 64.15.120.171 sjc-v180.sjc.youtube.com
O1 - Hosts: 64.15.120.172 sjc-v181.sjc.youtube.com
O1 - Hosts: 64.15.120.173 sjc-v182.sjc.youtube.com
O1 - Hosts: 64.15.120.174 sjc-v183.sjc.youtube.com
O1 - Hosts: 64.15.120.175 sjc-v184.sjc.youtube.com
O1 - Hosts: 64.15.120.176 sjc-v185.sjc.youtube.com
O1 - Hosts: 64.15.120.177 sjc-v186.sjc.youtube.com
O1 - Hosts: 64.15.120.178 sjc-v187.sjc.youtube.com
O1 - Hosts: 64.15.120.179 sjc-v188.sjc.youtube.com
O1 - Hosts: 64.15.120.180 sjc-v189.sjc.youtube.com
O1 - Hosts: 64.15.120.181 sjc-v190.sjc.youtube.com
O1 - Hosts: 64.15.127.133 sjc-v191.sjc.youtube.com
O1 - Hosts: 64.15.127.134 sjc-v192.sjc.youtube.com
O1 - Hosts: 64.15.127.135 sjc-v193.sjc.youtube.com
O1 - Hosts: 64.15.127.136 sjc-v194.sjc.youtube.com
O1 - Hosts: 64.15.127.137 sjc-v195.sjc.youtube.com
O1 - Hosts: 64.15.127.138 sjc-v196.sjc.youtube.com
O1 - Hosts: 64.15.127.139 sjc-v197.sjc.youtube.com
O1 - Hosts: 64.15.127.140 sjc-v198.sjc.youtube.com
O1 - Hosts: 64.15.127.141 sjc-v199.sjc.youtube.com
O1 - Hosts: 64.15.127.142 sjc-v200.sjc.youtube.com
O1 - Hosts: 64.15.127.165 sjc-v201.sjc.youtube.com
O1 - Hosts: 64.15.127.166 sjc-v202.sjc.youtube.com
O1 - Hosts: 64.15.127.167 sjc-v203.sjc.youtube.com
O1 - Hosts: 64.15.127.168 sjc-v204.sjc.youtube.com
O1 - Hosts: 64.15.127.169 sjc-v205.sjc.youtube.com
O1 - Hosts: 64.15.127.170 sjc-v206.sjc.youtube.com
O1 - Hosts: 64.15.127.171 sjc-v207.sjc.youtube.com
O1 - Hosts: 64.15.127.172 sjc-v208.sjc.youtube.com
O1 - Hosts: 64.15.127.173 sjc-v209.sjc.youtube.com
O1 - Hosts: 64.15.127.174 sjc-v210.sjc.youtube.com
O1 - Hosts: 64.15.127.197 sjc-v211.sjc.youtube.com
O1 - Hosts: 64.15.127.198 sjc-v212.sjc.youtube.com
O1 - Hosts: 64.15.127.199 sjc-v213.sjc.youtube.com
O1 - Hosts: 64.15.127.200 sjc-v214.sjc.youtube.com
O1 - Hosts: 64.15.127.201 sjc-v215.sjc.youtube.com
O1 - Hosts: 64.15.127.202 sjc-v216.sjc.youtube.com
O1 - Hosts: 64.15.127.203 sjc-v217.sjc.youtube.com
O1 - Hosts: 64.15.127.204 sjc-v218.sjc.youtube.com
O1 - Hosts: 64.15.127.205 sjc-v219.sjc.youtube.com
O1 - Hosts: 64.15.127.206 sjc-v220.sjc.youtube.com
O1 - Hosts: 64.15.127.229 sjc-v221.sjc.youtube.com
O1 - Hosts: 64.15.127.230 sjc-v222.sjc.youtube.com
O1 - Hosts: 64.15.127.231 sjc-v223.sjc.youtube.com
O1 - Hosts: 64.15.127.232 sjc-v224.sjc.youtube.com
O1 - Hosts: 64.15.127.233 sjc-v225.sjc.youtube.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [etMonitor] C:\WINDOWS\etMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Efe Selman\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Microsoft Excel'e &Ver - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll
O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1215805651994
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1215805864379
O17 - HKLM\System\CCS\Services\Tcpip\..\{6FCE415F-51D0-46F3-8D2E-E9CC3D8CEB9D}: NameServer = 4.2.2.1,4.2.2.2
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Google Update Service (gupdate1c9b8e5381dd8f0) (gupdate1c9b8e5381dd8f0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 13541 bytes

Rik_ 111 Nearly a Posting Maven · Answer 8 · 2009-08-05T21:13:06+00:00

It seems your hosts file is messed up. I am afraid that sorting that is beyond my ability. You need to wait for someone more experienced to come along.

Actually, it might be best if you start a new thread in the malware section. It is located HERE.

necko 0 Light Poster · Answer 9 · 2009-08-05T21:50:27+00:00

Thank you Rik. You tried your best to help me. I better start a new thread in malware section.

Rik_ 111 Nearly a Posting Maven · Answer 10 · 2009-08-05T22:38:50+00:00

Rik_ 111 Nearly a Posting Maven

15 Years Ago

Cool. :)