Solved Beginner's Help

AtomicTyson · 2010/04/02

[Resolved] Beginner's Help

I cant manage to download DDS on the infected computer because it will not access the internet. I have transferred DDS to the infected computer via my iPod which was used as a flash drive but it will not run all the way. I do not know what a script blocker is so I can not disable it. Please help me so I can comply with the Forum Rules!

broni · 2010/04/02

Let's see, if we can look at your computer booting from an external source.

You will need USB flash drive to move information from bad computer to a working computer.

You need to download two programs.

First

ISO Burner this will allow you to burn REATOGO-X-PE ISO to a cd and make it bootable. Just install the programm, from there on it's fairly automatic (Instructions)

Second

Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 270.3 MB in size so it may take some time to download.

When downloaded double click and this will then open ISOBurner to burn the file to CD

Reboot your system (Non working computer) using the boot CD you just created.

Note. If you do not know how to set your computer to boot from CD follow the steps HERE

Your system should now display a REATOGO-X-PE desktop.

Double-click on the OTLPE icon.

When asked Do you wish to load the remote registry, select Yes

When asked Do you wish to load remote user profile(s) for scanning, select Yes

Ensure the box Automatically Load All Remaining Users is checked and press OK

OTL should now start. Change the following settings

Change Drivers to All

Change Registry to All

Under Custom Scan box paste this in:

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
userinit.exe
explorer.exe
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav

Press Run Scan to start the scan.

When finished, the file will be saved in drive C:\OTL.txt

Copy this file to your USB drive.

Please post the contents of the C:\OTL.txt file in your reply.

AtomicTyson · 2010/04/03

Thankyou very much I got the DDS to work and I appreciate your input

broni · 2010/04/03

Can you post those logs?

AtomicTyson · 2010/04/03

"broni said: ↑

Can you post those logs?
Click to expand...

Yeah sure I didn't know exactly how the style of this forum is but here they are and sorry this is late:

DDS (Ver_10-03-17.01) - NTFSx86
Run by John at 12:19:09.51 on Fri 04/02/2010
Internet Explorer: 7.0.6000.16809 BrowserJavaVersion: 1.6.0_16
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6000.0.1252.1.1033.18.2942.1754 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Oracle\Information Rights Management\Desktop\sealmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\MsiExec.exe
C:\Program Files\STOPzilla!\SZInit.Exe
C:\Users\John\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: STOPzilla Browser Helper Object: {e3215f20-3212-11d6-9f8b-00d0b743919d} - c:\program files\stopzilla!\SZIEBHO.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "c:\users\john\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe
mRun: [LVCOMSX] "c:\program files\common files\logishrd\lcommgr\LVComSX.exe "
mRun: [sealmon.exe] c:\program files\oracle\information rights management\desktop\sealmon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\john\appdata\roaming\mozilla\firefox\profiles\707tt871.default\
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\users\john\appdata\local\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\users\john\appdata\roaming\move networks\plugins\npqmp071500000347.dll
FF - plugin: c:\users\john\appdata\roaming\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\john\appdata\roaming\move networks\plugins\npqmp071701000002.dll
FF - plugin: c:\users\john\appdata\roaming\mozilla\firefox\profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R0 szkg5;szkg5;c:\windows\system32\drivers\SZKG.sys [2009-12-7 61328]
R0 szkgfs;szkgfs;c:\windows\system32\drivers\SZKGFS.sys [2010-2-24 173328]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-9-28 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-9-28 29512]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-3-24 242696]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-12 308064]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2007-6-11 968064]
S0 is3srv;is3srv;c:\windows\system32\drivers\is3srv.sys [2009-12-7 61328]

=============== Created Last 30 ================

2010-04-02 17:05:02 1256 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-04-02 17:04:55 1344 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-04-02 17:03:51 0 d-----w- c:\programdata\SITEguard
2010-04-02 17:01:29 0 d-----w- c:\program files\STOPzilla!
2010-04-02 17:01:29 0 d-----w- c:\program files\common files\iS3
2010-04-02 17:01:28 0 d-----w- c:\programdata\STOPzilla!
2010-04-02 16:58:41 0 d-----w- c:\programdata\Malwarebytes
2010-04-02 16:37:56 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-27 02:23:01 0 d-----w- c:\program files\iPod
2010-03-27 02:23:00 0 d-----w- c:\program files\iTunes
2010-03-12 20:39:16 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-03-06 01:16:42 17408 ----a-r- c:\windows\system32\SZIO5.dll
2010-03-06 01:14:16 442368 ----a-r- c:\windows\system32\SZBase5.dll
2010-03-06 01:13:44 540672 ----a-r- c:\windows\system32\SZComp5.dll

==================== Find3M ====================

2010-04-02 16:55:43 34800 ----a-w- c:\programdata\nvModes.dat
2010-03-12 20:39:19 242696 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-12 20:38:28 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-02-24 22:06:36 173328 ----a-r- c:\windows\system32\drivers\SZKGFS.sys
2010-02-18 04:11:47 86016 ----a-w- c:\windows\inf\infstrng.dat
2010-02-18 04:11:47 51200 ----a-w- c:\windows\inf\infpub.dat
2010-02-18 04:11:46 86016 ----a-w- c:\windows\inf\infstor.dat
2010-01-12 06:18:00 962664 ----a-w- c:\windows\system32\nvsvc.dll
2010-01-12 06:18:00 13679720 ----a-w- c:\windows\system32\nvcpl.dll
2010-01-12 06:18:00 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-01-12 06:18:00 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-01-12 04:03:33 9388648 ----a-w- c:\windows\system32\nvd3dum.dll
2010-01-12 04:03:33 68200 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03:33 4077672 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03:33 4061800 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03:33 2243176 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03:33 182888 ----a-w- c:\windows\system32\nvcod189.dll
2010-01-12 04:03:33 14924392 ----a-w- c:\windows\system32\nvoglv32.dll
2010-01-12 04:03:33 1280616 ----a-w- c:\windows\system32\nvapi.dll
2010-01-12 04:03:33 11639400 ----a-w- c:\windows\system32\nvcompiler.dll
2008-12-10 11:04:53 174 --sha-w- c:\program files\desktop.ini
2008-09-29 14:18:11 665600 ----a-w- c:\windows\inf\drvindex.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 12:19:21.06 ===============

And here is the attach:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 9/28/2008 11:08:30 AM
System Uptime: 4/2/2010 9:54:40 AM (3 hours ago)

Motherboard: ECS | | Nettle2
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 6000+ | Socket M2 | 3000/201mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 466 GiB total, 419.781 GiB free.
D: is CDROM (CDFS)
F: is Removable
G: is Removable
H: is Removable
I: is Removable

==== Disabled Device Manager Items =============

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft 6to4 Adapter
Device ID: ROOT\*6TO4MP\0000
Manufacturer: Microsoft
Name: Microsoft 6to4 Adapter
PNP Device ID: ROOT\*6TO4MP\0000
Service: tunnel

Class GUID: {36fc9e60-c465-11cf-8056-444553540000}
Description: USB Mass Storage Device
Device ID: USB\VID_05AC&PID_1260\000A2700192AE38B
Manufacturer: Compatible USB storage device
Name: USB Mass Storage Device
PNP Device ID: USB\VID_05AC&PID_1260\000A2700192AE38B
Service: USBSTOR

Class GUID: {4d36e96d-e325-11ce-bfc1-08002be10318}
Description: PCI Simple Communications Controller
Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200C14F1&REV_00\4&2CF26B65&0&3020
Manufacturer: CXT
Name: PCI Soft Data Fax Modem with SmartCP
PNP Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200C14F1&REV_00\4&2CF26B65&0&3020
Service: Modem

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 1 (SP1)
ACD/Labs Software in C:\Program Files\ACDFREE12\
Acrobat.com
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 9.3
Adobe Shockwave Player 11.5
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AusLogics Disk Defrag
AutoUpdate
AVG Free 9.0
Bonjour
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Google Chrome
Guitar Pro 5.2
HijackThis 2.0.2
iTunes
Java(TM) 6 Update 16
Java(TM) 6 Update 7
LG USB Modem driver
Logitech Audio Echo Cancellation Component
Logitech QuickCam Driver Package
Logitech Video Enumerator
Logitech® Camera Driver
Maple 12
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Excel Viewer
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional 2007
Microsoft Office Professional 2007 Subscription
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual J# 2.0 Redistributable Package
Move Media Player
Mozilla Firefox (3.5.8)
MSVCRT
MVision
NVIDIA Display Control Panel
NVIDIA Drivers
Oracle IRM Desktop 5.5.12 10gR3 PR5
Pando Media Booster
QuickTime
Respondus LockDown Browser
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Skypeâ„¢ 3.8
STOPzilla
Symyx Draw
System Requirements Lab
TVUPlayer 2.4.8.2
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office Access 2007 Help (KB957241)
Update for Microsoft Office Excel 2007 Help (KB957242)
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Microsoft Office Outlook 2007 Help (KB957246)
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Publisher 2007 Help (KB957249)
Update for Microsoft Office Word 2007 Help (KB957252)
Update for Microsoft Script Editor Help (KB957253)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb962871)
VC80CRTRedist - 8.0.50727.762
Ventrilo Client
Vuze
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
Windows Media Player Firefox Plugin
WinRAR archiver
WinZip 12.0

==== Event Viewer Messages From Past Week ========

4/2/2010 9:41:52 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service iPod Service with arguments " " in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
4/2/2010 9:24:14 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments " " in order to run the server: {000C101C-0000-0000-C000-000000000046}
4/2/2010 9:22:10 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AvgLdx86 AvgMfx86 AvgTdiX DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr Tcpip tdx Wanarpv6
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:22:10 AM, Error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/2/2010 9:20:50 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
4/2/2010 9:20:50 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
4/2/2010 9:16:13 AM, Error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
4/2/2010 8:58:46 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 spldr Wanarpv6
4/2/2010 8:58:46 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
4/2/2010 8:57:07 AM, Error: EventLog [6008] - The previous system shutdown at 8:56:16 AM on 4/2/2010 was unexpected.
4/2/2010 8:48:16 AM, Error: EventLog [6008] - The previous system shutdown at 8:46:41 AM on 4/2/2010 was unexpected.
4/2/2010 8:44:41 AM, Error: EventLog [6008] - The previous system shutdown at 8:42:30 AM on 4/2/2010 was unexpected.
4/2/2010 8:42:57 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
4/2/2010 8:42:48 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
4/2/2010 8:42:41 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
3/26/2010 3:00:26 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework 3.5 Family Update (KB951847) x86.
3/26/2010 12:09:20 AM, Error: LSM [1050] - Registering with Service Control Manager to monitor Terminal Service status failed with The specified service does not exist as an installed service. , retry in ten minute.
3/26/2010 10:04:44 PM, Error: volmgr [46] - Crash dump initialization failed!
3/26/2010 10:04:37 PM, Error: ACPI [6] - IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot 9, function 0. Please contact your system vendor for technical assistance.
3/26/2010 10:04:37 PM, Error: ACPI [6] - IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot 12, function 0. Please contact your system vendor for technical assistance.
3/26/2010 10:04:37 PM, Error: ACPI [6] - IRQARB: ACPI BIOS does not contain an IRQ for the device in PCI slot 11, function 0. Please contact your system vendor for technical assistance.

==== End Of File ===========================

So actually my current question is this. I keep getting "attacked" by random "malware(?)" that tells me I have viruses when I do not. I keep removing them but they come back with a similar name. Recently the one that is on right now is Vista Security Tool 2010. Any advice?

broni · 2010/04/03

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.pif
* Rkill.exe

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run then...

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Installer under Version 2.0.2
[DO NOT download version 2.0.3 (beta)]
Install, and run it.
Post HijackTHis log.
Do NOT attempt to fix anything!

NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator

AtomicTyson · 2010/04/03

ComboFix 10-04-03.01 - John 04/03/2010 13:38:46.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2942.2277 [GMT -7:00]
Running from: c:\users\John\Desktop\ComboFix.exe
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\CrucialSoft Ltd
c:\recycler\S-1-5-21-1614895754-515967899-682003330-1004
C:\smp.bat
c:\users\John\AppData\Local\av.exe
c:\users\John\AppData\Local\ave.exe
c:\users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\3If3eAH6.jpg
c:\users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\4sRyu0.jpg
c:\users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\vWCLC.jpg
c:\users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\xoB6Qkf8.jpg
c:\users\John\AppData\Local\TempDIR
c:\windows\46131.exe
c:\windows\system32\SIntf16.dll

.
((((((((((((((((((((((((( Files Created from 2010-03-03 to 2010-04-03 )))))))))))))))))))))))))))))))
.

2010-04-03 20:42 . 2010-04-03 20:43 -------- d-----w- c:\users\John\AppData\Local\temp
2010-04-03 20:42 . 2010-04-03 20:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-03 14:32 . 2010-04-03 14:36 182272 --sha-w- c:\users\John\AppData\Local\3915231894.dll
2010-04-02 17:03 . 2010-04-02 17:03 -------- d-----w- c:\programdata\SITEguard
2010-04-02 17:01 . 2010-04-02 17:01 -------- d-----w- c:\program files\Common Files\iS3
2010-04-02 17:01 . 2010-04-02 19:22 -------- d-----w- c:\programdata\STOPzilla!
2010-04-02 16:58 . 2010-04-02 16:58 -------- d-----w- c:\programdata\Malwarebytes
2010-04-02 16:37 . 2010-04-03 14:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-02 14:34 . 2010-04-02 17:03 -------- d-----w- c:\users\John\AppData\Local\tblueiojw
2010-04-01 15:18 . 2010-04-01 15:18 1685784 ----a-w- c:\programdata\avg9\update\backup\avgupd.dll
2010-04-01 15:18 . 2010-04-01 15:18 1035032 ----a-w- c:\programdata\avg9\update\backup\avgupd.exe
2010-04-01 14:38 . 2009-10-16 22:50 2520888 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
2010-04-01 14:38 . 2008-03-05 01:52 286720 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\libcurl.dll
2010-04-01 14:38 . 2007-10-31 16:39 59904 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\zlib1.dll
2010-04-01 14:38 . 2007-05-17 20:58 143360 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\libexpatw.dll
2010-04-01 14:38 . 2006-10-19 00:32 499712 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\msvcp71.dll
2010-04-01 14:38 . 2006-10-19 00:32 348160 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\msvcr71.dll
2010-04-01 14:38 . 2006-10-17 01:44 196608 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\ssleay32.dll
2010-04-01 14:38 . 2006-10-17 01:44 1028096 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\libeay32.dll
2010-03-31 17:39 . 2010-04-02 17:00 181248 --sha-w- c:\users\John\AppData\Local\4288942400.dll
2010-03-27 02:23 . 2010-03-27 02:23 -------- d-----w- c:\program files\iPod
2010-03-27 02:23 . 2010-03-27 02:23 -------- d-----w- c:\program files\iTunes
2010-03-27 02:20 . 2010-03-27 02:20 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-03-12 20:39 . 2010-03-12 20:39 360584 ----a-w- c:\programdata\avg9\update\backup\avgtdix.sys
2010-03-12 20:39 . 2010-03-12 20:39 333192 ----a-w- c:\programdata\avg9\update\backup\avgldx86.sys
2010-03-12 20:39 . 2010-03-12 20:39 28424 ----a-w- c:\programdata\avg9\update\backup\avgmfx86.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-03 20:37 . 2010-02-19 23:02 -------- d-----w- c:\programdata\avg9
2010-04-03 17:55 . 2008-10-16 23:39 0 ----a-w- c:\users\John\AppData\Local\prvlcl.dat
2010-04-03 14:31 . 2009-12-30 05:08 34800 ----a-w- c:\programdata\nvModes.dat
2010-04-02 19:15 . 2010-04-02 17:05 1256 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-04-02 19:00 . 2010-04-02 17:04 1344 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-03-31 18:44 . 2008-10-27 02:25 -------- d-----w- c:\users\John\AppData\Roaming\LimeWire
2010-03-27 05:04 . 2009-08-08 03:32 -------- d-----w- c:\program files\Microsoft Silverlight
2010-03-27 02:23 . 2009-03-07 07:28 -------- d-----w- c:\program files\Common Files\Apple
2010-03-16 14:58 . 2008-09-29 06:28 102488 ----a-w- c:\users\John\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-19 23:02 . 2008-09-28 19:53 -------- d-----w- c:\program files\AVG
2010-02-18 04:41 . 2008-09-29 06:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-18 04:16 . 2008-10-09 05:33 765952 ----a-w- c:\programdata\NexonUS\NGM\NGMDll.dll
2010-02-18 04:16 . 2008-10-09 05:33 401408 ----a-w- c:\programdata\NexonUS\NGM\NGMResource.dll
2010-02-18 04:13 . 2009-12-30 05:06 -------- d-----w- c:\programdata\NVIDIA
2010-02-18 04:12 . 2009-12-30 04:46 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-12 06:18 . 2010-01-12 06:18 962664 ----a-w- c:\windows\system32\nvsvc.dll
2010-01-12 06:18 . 2010-01-12 06:18 13679720 ----a-w- c:\windows\system32\nvcpl.dll
2010-01-12 06:18 . 2010-01-12 06:18 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-01-12 06:18 . 2010-01-12 06:18 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-01-12 04:03 . 2010-02-18 04:10 11586280 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2010-01-12 04:03 . 2010-02-18 04:10 68200 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03 . 2010-02-18 04:10 14924392 ----a-w- c:\windows\system32\nvoglv32.dll
2010-01-12 04:03 . 2010-02-18 04:09 4077672 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03 . 2010-02-18 04:09 2243176 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03 . 2010-02-18 04:09 4061800 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03 . 2010-02-18 04:09 182888 ----a-w- c:\windows\system32\nvcod189.dll
2010-01-12 04:03 . 2010-02-18 04:09 11639400 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 04:03 . 2006-12-19 20:38 1280616 ----a-w- c:\windows\system32\nvapi.dll
2010-01-12 04:03 . 2006-11-02 10:25 9388648 ----a-w- c:\windows\system32\nvd3dum.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2008-09-29 1232896]
"MsnMsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-27 3883856]
"Google Update "= "c:\users\John\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-10-03 133104]
"Pando Media Booster "= "c:\program files\Pando Networks\Media Booster\PMB.exe" [2009-12-28 2935480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX "= "c:\program files\Common Files\LogiShrd\LComMgr\LVComSX.exe" [2006-12-22 244512]
"sealmon.exe "= "c:\program files\Oracle\Information Rights Management\Desktop\sealmon.exe" [2009-03-13 370952]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-02-16 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4 "=wdmaud.drv

R3 AhnRptTfFRegFNT;AhnRptTfFRegFNT;c:\users\John\AppData\Local\Temp\nsz51B5.tmp\TfFRegNt.sys [x]
S3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2007-06-11 968064]
S4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [x]

--- Other Services/Drivers In Memory ---

*Deregistered* - AvgLdx86
.
Contents of the 'Scheduled Tasks' folder

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2893342972-3071724252-3358957919-1000Core.job
- c:\users\John\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-03 04:22]

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2893342972-3071724252-3358957919-1000UA.job
- c:\users\John\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-03 04:22]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\users\John\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\users\John\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\John\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
AddRemove-HijackThis - E:\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-03 13:43
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2010-04-03 13:44:23
ComboFix-quarantined-files.txt 2010-04-03 20:44

Pre-Run: 450,402,406,400 bytes free
Post-Run: 451,723,722,752 bytes free

- - End Of File - - 53C5C397DFB787FB5D619E0DD2757056

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:53:04 PM, on 4/3/2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16809)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Oracle\Information Rights Management\Desktop\sealmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Windows\system32\notepad.exe
C:\Windows\explorer.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\system32\rundll32.exe
E:\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe "
O4 - HKLM\..\Run: [sealmon.exe] C:\Program Files\Oracle\Information Rights Management\Desktop\sealmon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 3395 bytes

broni · 2010/04/03

Please, uninstall StopZilla as it's regarded as rogue program.

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\users\John\AppData\Local\3915231894.dll
c:\users\John\AppData\Local\4288942400.dll


Folder::

Driver::
AhnRptTfFRegFNT


Registry::

RegLockDel::
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

A new HijackThis log.

AtomicTyson · 2010/04/03

If I have already uninstalled Stopzilla how do I get rid of it?

broni · 2010/04/03

Oh, OK. Let me give you different Combofix script. Hold on...

broni · 2010/04/03

Here you go:

Code:

File::
c:\users\John\AppData\Local\3915231894.dll
c:\users\John\AppData\Local\4288942400.dll


Folder::
c:\programdata\SITEguard
c:\program files\Common Files\iS3
c:\programdata\STOPzilla!


Driver::
AhnRptTfFRegFNT

Registry::

DirLook::
c:\users\John\AppData\Local\tblueiojw

RegLockDel::

AtomicTyson · 2010/04/03

ComboFix 10-04-03.01 - John 04/03/2010 15:00:33.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2942.2293 [GMT -7:00]
Running from: c:\users\John\Desktop\ComboFix.exe
Command switches used :: c:\users\John\Desktop\CFScript.txt
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point

FILE ::
"c:\users\John\AppData\Local\3915231894.dll "
"c:\users\John\AppData\Local\4288942400.dll "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\iS3
c:\program files\Common Files\iS3\Anti-Spyware\sgdfull.rsf
c:\programdata\SITEguard
c:\programdata\SITEguard\siteguard.db
c:\programdata\STOPzilla!
c:\programdata\STOPzilla!\modules_scanned.db
c:\programdata\STOPzilla!\sgdefs.db
c:\programdata\STOPzilla!\sgdwc.db
c:\programdata\STOPzilla!\userdata.db
c:\programdata\STOPzilla!\zilla5.log
c:\users\John\AppData\Local\3915231894.dll
c:\users\John\AppData\Local\4288942400.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AHNRPTTFFREGFNT
-------\Service_AhnRptTfFRegFNT

((((((((((((((((((((((((( Files Created from 2010-03-03 to 2010-04-03 )))))))))))))))))))))))))))))))
.

2010-04-03 22:04 . 2010-04-03 22:07 -------- d-----w- c:\users\John\AppData\Local\temp
2010-04-03 22:04 . 2010-04-03 22:04 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-04-03 22:04 . 2010-04-03 22:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-03 21:59 . 2010-04-03 21:59 -------- d-----w- C:\32788R22FWJFW
2010-04-02 16:58 . 2010-04-02 16:58 -------- d-----w- c:\programdata\Malwarebytes
2010-04-02 16:37 . 2010-04-03 14:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-02 14:34 . 2010-04-02 17:03 -------- d-----w- c:\users\John\AppData\Local\tblueiojw
2010-04-01 15:18 . 2010-04-01 15:18 1685784 ----a-w- c:\programdata\avg9\update\backup\avgupd.dll
2010-04-01 15:18 . 2010-04-01 15:18 1035032 ----a-w- c:\programdata\avg9\update\backup\avgupd.exe
2010-04-01 14:38 . 2009-10-16 22:50 2520888 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
2010-04-01 14:38 . 2008-03-05 01:52 286720 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\libcurl.dll
2010-04-01 14:38 . 2007-10-31 16:39 59904 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\zlib1.dll
2010-04-01 14:38 . 2007-05-17 20:58 143360 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\libexpatw.dll
2010-04-01 14:38 . 2006-10-19 00:32 499712 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\msvcp71.dll
2010-04-01 14:38 . 2006-10-19 00:32 348160 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\msvcr71.dll
2010-04-01 14:38 . 2006-10-17 01:44 196608 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\ssleay32.dll
2010-04-01 14:38 . 2006-10-17 01:44 1028096 ----a-w- c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\libeay32.dll
2010-03-27 02:23 . 2010-03-27 02:23 -------- d-----w- c:\program files\iPod
2010-03-27 02:23 . 2010-03-27 02:23 -------- d-----w- c:\program files\iTunes
2010-03-27 02:20 . 2010-03-27 02:20 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-03-12 20:39 . 2010-03-12 20:39 360584 ----a-w- c:\programdata\avg9\update\backup\avgtdix.sys
2010-03-12 20:39 . 2010-03-12 20:39 333192 ----a-w- c:\programdata\avg9\update\backup\avgldx86.sys
2010-03-12 20:39 . 2010-03-12 20:39 28424 ----a-w- c:\programdata\avg9\update\backup\avgmfx86.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-03 22:07 . 2009-12-30 05:08 34800 ----a-w- c:\programdata\nvModes.dat
2010-04-03 21:58 . 2010-02-19 23:02 -------- d-----w- c:\programdata\avg9
2010-04-03 17:55 . 2008-10-16 23:39 0 ----a-w- c:\users\John\AppData\Local\prvlcl.dat
2010-04-02 19:15 . 2010-04-02 17:05 1256 ----a-w- c:\windows\system32\drivers\kgpfr2.cfg
2010-04-02 19:00 . 2010-04-02 17:04 1344 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-03-31 18:44 . 2008-10-27 02:25 -------- d-----w- c:\users\John\AppData\Roaming\LimeWire
2010-03-27 05:04 . 2009-08-08 03:32 -------- d-----w- c:\program files\Microsoft Silverlight
2010-03-27 02:23 . 2009-03-07 07:28 -------- d-----w- c:\program files\Common Files\Apple
2010-03-16 14:58 . 2008-09-29 06:28 102488 ----a-w- c:\users\John\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-19 23:02 . 2008-09-28 19:53 -------- d-----w- c:\program files\AVG
2010-02-18 04:41 . 2008-09-29 06:22 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-18 04:16 . 2008-10-09 05:33 765952 ----a-w- c:\programdata\NexonUS\NGM\NGMDll.dll
2010-02-18 04:16 . 2008-10-09 05:33 401408 ----a-w- c:\programdata\NexonUS\NGM\NGMResource.dll
2010-02-18 04:13 . 2009-12-30 05:06 -------- d-----w- c:\programdata\NVIDIA
2010-02-18 04:12 . 2009-12-30 04:46 -------- d-----w- c:\program files\NVIDIA Corporation
2010-01-12 06:18 . 2010-01-12 06:18 962664 ----a-w- c:\windows\system32\nvsvc.dll
2010-01-12 06:18 . 2010-01-12 06:18 13679720 ----a-w- c:\windows\system32\nvcpl.dll
2010-01-12 06:18 . 2010-01-12 06:18 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-01-12 06:18 . 2010-01-12 06:18 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-01-12 04:03 . 2010-02-18 04:10 11586280 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2010-01-12 04:03 . 2010-02-18 04:10 68200 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03 . 2010-02-18 04:10 14924392 ----a-w- c:\windows\system32\nvoglv32.dll
2010-01-12 04:03 . 2010-02-18 04:09 4077672 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03 . 2010-02-18 04:09 2243176 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03 . 2010-02-18 04:09 4061800 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03 . 2010-02-18 04:09 182888 ----a-w- c:\windows\system32\nvcod189.dll
2010-01-12 04:03 . 2010-02-18 04:09 11639400 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 04:03 . 2006-12-19 20:38 1280616 ----a-w- c:\windows\system32\nvapi.dll
2010-01-12 04:03 . 2006-11-02 10:25 9388648 ----a-w- c:\windows\system32\nvd3dum.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\John\AppData\Local\tblueiojw ----

((((((((((((((((((((((((((((( SnapShot@2010-04-03_20.43.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-28 19:48 . 2010-04-03 20:59 35744 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2010-04-03 22:08 44628 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-28 18:16 . 2010-04-03 22:08 10108 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2893342972-3071724252-3358957919-1000_UserData.bin
- 2010-04-03 14:28 . 2010-04-03 14:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-04-03 22:06 . 2010-04-03 22:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-04-03 14:28 . 2010-04-03 14:28 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-04-03 22:06 . 2010-04-03 22:06 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2010-04-03 21:02 621314 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-04-03 14:34 621314 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2010-04-03 21:02 104662 c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2010-04-03 14:34 104662 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2008-09-29 1232896]
"MsnMsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-27 3883856]
"Google Update "= "c:\users\John\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-10-03 133104]
"Pando Media Booster "= "c:\program files\Pando Networks\Media Booster\PMB.exe" [2009-12-28 2935480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LVCOMSX "= "c:\program files\Common Files\LogiShrd\LComMgr\LVComSX.exe" [2006-12-22 244512]
"sealmon.exe "= "c:\program files\Oracle\Information Rights Management\Desktop\sealmon.exe" [2009-03-13 370952]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-02-16 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4 "=wdmaud.drv

S3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2007-06-11 968064]

.
Contents of the 'Scheduled Tasks' folder

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2893342972-3071724252-3358957919-1000Core.job
- c:\users\John\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-03 04:22]

2010-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2893342972-3071724252-3358957919-1000UA.job
- c:\users\John\AppData\Local\Google\Update\GoogleUpdate.exe [2009-10-03 04:22]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\users\John\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\users\John\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\John\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\users\John\AppData\Roaming\Mozilla\Firefox\Profiles\707tt871.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\iTunes\iTunes.exe
c:\windows\servicing\TrustedInstaller.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2010-04-03 15:10:35 - machine was rebooted
ComboFix-quarantined-files.txt 2010-04-03 22:10
ComboFix2.txt 2010-04-03 20:44

Pre-Run: 450,552,012,800 bytes free
Post-Run: 451,591,102,464 bytes free

- - End Of File - - AE3B72724D2C4CE537C503251F0D7303

After doing that I can't do anything. I click anything and it says the program file and then Illegal operation attempted on a registry key that has been marked for deletion.

broni · 2010/04/03

Very good

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Click OK (Vista users - press Enter).
Restart computer.

===============================================================

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***

STEP 1. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 2.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

AtomicTyson · 2010/04/03

"broni said: ↑

Very good

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Click OK (Vista users - press Enter).
Restart computer.

===============================================================

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***

STEP 1. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 2.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Click to expand...

Says Illegal operation and marked for deletion when I try to uninstall combofix

broni · 2010/04/03

Restart computer and try again.

AtomicTyson · 2010/04/03

"broni said: ↑

Restart computer and try again.
Click to expand...

Ok I got to the set up for the malwarebytes and there is an error saying its missing a file and wont finish updating. Any suggestions?

broni · 2010/04/03

Bad download maybe.
Download fresh copy and reinstall.

AtomicTyson · 2010/04/04

"broni said: ↑

Bad download maybe.
Download fresh copy and reinstall.
Click to expand...

I keep getting the following errors:

Malwarebytes' Anti-Malware
An error has occurred: Please report this error code to our support team.

MBAM_ERROR_EXPANDING_VARIABLES (0, 48)

Then it starts updating and then:

Malwarebytes' Anti-Malware
An error has occurred. Please report this error code to our support team.

MBAM_ERORR_LOAD_DATABASE (3,0)

The system cannot find the path specified.

Then the set up closes and I get the first error again.

Done this 3 times with restarting and reinstalling.

broni · 2010/04/04

Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

AtomicTyson · 2010/04/04

"broni said: ↑

Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.
Click to expand...

I scanned in safe mode and rebooted. Now everything I try to open gives me a prompt asking me which program should i use to open it. Therefore I am having trouble getting the log

Edit:
Ok I found a way to get into it and just for future help your instructions for getting the log is a bit off.
There is just a Statistics/Log Tab that you can click without going into preferences and then there is a list of logs that you can highlight I believe and then hit View Log.
Unfortunately, when I hit the View Log button, the Saved scan log will not open for some reason or another.

Edit #2:
Nevermind just based on the way I accessed SuperAntiSpyware it seemed confusing. Its just because I am having difficulty opening things I went a different route

Log in or Sign up

Solved Beginner's Help

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

Share This Page

Log in or Sign up

Solved Beginner's Help

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

broni Moderator Malware Analyst

AtomicTyson Inactive Thread Starter

Share This Page

Useful Searches