1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive no ip address, task bar changed and google search redirects

Discussion in 'Malware and Virus Removal Archive' started by bootan, 2010/05/27.

Thread Status:
Not open for further replies.
  1. 2010/05/27
    bootan

    bootan Inactive Thread Starter

    Joined:
    2010/05/27
    Messages:
    5
    Likes Received:
    0
    [Inactive] no ip address, task bar changed and google search redirects

    Hi there,

    from reading some of these threads it looks like i have 2 seperate problems. my mcafee internet security expired about 2 months ago and it looks like ive got problems now.
    the google redirecting at search links has been around for 2 weeks or so but i didnt think much of it, i tried a spybot scan and nothing came up.
    today i turned on my pc and i had no internet, my local area connection saids im aquring an ip address and i cant get on the net, i also noticed that my start bar has changed to an older format, and my pc at start up was slow.
    i rang my internet provider thinking something was wrong with their connection at first, i went through a ip config and ip renew with them but that changed nothing.
    when i realised my sisters laptop had connection i figured my pc must of got a virus.......which leads me to here. it seems others have had the same problems as me judging my some of these posts.
    any help would be great. thanks in advance.


    DDS (Ver_10-03-17.01) - NTFSx86
    Run by s at 21:50:54.00 on Thu 27/05/2010
    Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_13
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.230 [GMT 10:00]

    AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\drivers\KodakCCS.exe
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Willems Soft\Simple Reminder\Simple Reminder.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Documents and Settings\s\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com
    uSearch Page = hxxp://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
    uSearch Bar = hxxp://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer = 192.104.67.250 :8080
    uInternet Settings,ProxyOverride = <local>;*.local
    uSearchURL,(Default) = hxxp://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
    uURLSearchHooks: Yahoo!7 Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: IE to GetRight Helper: {31ff080d-12a3-439a-a2ef-4ba95a3148e8} - c:\program files\getright\xx2gr.dll
    BHO: {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - No File
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
    BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
    BHO: 1 (0x1) - No File
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
    TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
    TB: Yahoo!7 Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    uRun: [Simple Reminder] c:\program files\willems soft\simple reminder\Simple Reminder.exe
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [Alcmtr] ALCMTR.EXE
    mRun: [RemoteControl] "c:\program files\cyberlink dvd solution\powerdvd\PDVDServ.exe "
    mRun: [InCD] c:\program files\ahead\incd\InCD.exe
    mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
    mRun: [LGODDFU] "c:\program files\lg_fwupdate\fwupdate.exe" blrun
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [nwiz] nwiz.exe /install
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
    mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4.0\OpwareSE4.exe "
    mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll "
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe "
    mRun: [McENUI] c:\progra~1\mcafee\mhn\McENUI.exe /hide
    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    StartupFolder: c:\documents and settings\all users\start menu\programs\startup\Kodak EasyShare software.lnk.disabled
    StartupFolder: c:\documents and settings\all users\start menu\programs\startup\Kodak software updater.lnk.disabled
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
    IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: Download with GetRight - c:\program files\getright\GRdownload.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html
    IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html
    IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html
    IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html
    IE: Open in new background tab - c:\program files\windows live toolbar\components\en-au\msntabres.dll.mui/229?1a52395c5547483eb537ea57e1d92bba
    IE: Open in new foreground tab - c:\program files\windows live toolbar\components\en-au\msntabres.dll.mui/230?1a52395c5547483eb537ea57e1d92bba
    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\s\applic~1\mozilla\firefox\profiles\hnfsnufr.default\
    FF - prefs.js: browser.startup.homepage - hxxp://greeksoccer.com
    FF - plugin: c:\documents and settings\s\application data\mozilla\firefox\profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
    FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll
    FF - plugin: c:\program files\veetle\player\npvlc.dll
    FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref( "html5.enable ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);

    ============= SERVICES / DRIVERS ===============

    R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-12-22 214664]
    R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-12-22 359952]
    R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-12-22 144704]
    R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [2006-10-25 31104]
    R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-12-22 606736]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-12-22 79816]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-12-22 35272]
    R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-12-22 40552]
    S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [2006-10-25 5824]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-12-22 34248]
    S3 PortlUSB;PortlUSB;c:\windows\system32\drivers\H10USB.sys [2004-6-24 7552]

    =============== Created Last 30 ================

    2010-05-15 00:08:09 254 ----a-w- c:\windows\system32\MRT.INI
    2010-04-30 08:28:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Longbow Digital Arts

    ==================== Find3M ====================

    2010-03-09 11:09:18 430080 ----a-w- c:\windows\system32\vbscript.dll
    2007-08-07 23:39:24 2277376 ----a-w- c:\program files\PictureRipper4.exe
    2004-10-01 05:00:16 40960 ----a-w- c:\program files\Uninstall_CDS.exe

    ============= FINISH: 21:53:03.17 ===============


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 25/10/2006 5:02:32 PM
    System Uptime: 27/05/2010 8:01:43 PM (1 hours ago)

    Motherboard: ASUSTeK Computer INC. | | M2V
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3600+ | SOCKET AM2 | 1999/200mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 298 GiB total, 49.804 GiB free.
    D: is CDROM ()
    E: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: PCI Device
    Device ID: PCI\VEN_11AB&DEV_6121&SUBSYS_82121043&REV_B0\4&81B20F9&0&0018
    Manufacturer:
    Name: PCI Device
    PNP Device ID: PCI\VEN_11AB&DEV_6121&SUBSYS_82121043&REV_B0\4&81B20F9&0&0018
    Service:

    ==== System Restore Points ===================

    RP1034: 28/02/2010 10:18:50 AM - System Checkpoint
    RP1035: 1/03/2010 4:33:41 PM - System Checkpoint
    RP1036: 3/03/2010 2:59:38 PM - System Checkpoint
    RP1037: 4/03/2010 4:50:42 PM - System Checkpoint
    RP1038: 5/03/2010 6:03:37 PM - System Checkpoint
    RP1039: 6/03/2010 7:23:37 PM - System Checkpoint
    RP1040: 8/03/2010 12:16:07 PM - System Checkpoint
    RP1041: 9/03/2010 2:01:08 PM - System Checkpoint
    RP1042: 10/03/2010 3:47:27 PM - System Checkpoint
    RP1043: 11/03/2010 5:09:36 PM - System Checkpoint
    RP1044: 11/03/2010 10:27:25 PM - Software Distribution Service 3.0
    RP1045: 13/03/2010 12:36:14 PM - System Checkpoint
    RP1046: 14/03/2010 7:22:37 PM - System Checkpoint
    RP1047: 15/03/2010 7:35:00 PM - System Checkpoint
    RP1048: 16/03/2010 8:59:27 PM - System Checkpoint
    RP1049: 18/03/2010 8:48:39 PM - System Checkpoint
    RP1050: 20/03/2010 10:31:25 AM - System Checkpoint
    RP1051: 21/03/2010 3:45:49 PM - System Checkpoint
    RP1052: 22/03/2010 4:24:47 PM - System Checkpoint
    RP1053: 23/03/2010 6:10:34 PM - System Checkpoint
    RP1054: 24/03/2010 7:11:10 PM - System Checkpoint
    RP1055: 25/03/2010 7:31:56 PM - System Checkpoint
    RP1056: 27/03/2010 9:52:04 AM - System Checkpoint
    RP1057: 28/03/2010 9:53:54 AM - System Checkpoint
    RP1058: 29/03/2010 6:06:47 PM - System Checkpoint
    RP1059: 30/03/2010 6:26:33 PM - System Checkpoint
    RP1060: 31/03/2010 9:04:07 PM - System Checkpoint
    RP1061: 1/04/2010 4:06:56 PM - Software Distribution Service 3.0
    RP1062: 2/04/2010 7:42:31 PM - System Checkpoint
    RP1063: 3/04/2010 7:52:06 PM - System Checkpoint
    RP1064: 4/04/2010 9:47:14 PM - System Checkpoint
    RP1065: 5/04/2010 10:28:29 PM - System Checkpoint
    RP1066: 7/04/2010 6:07:09 PM - System Checkpoint
    RP1067: 9/04/2010 7:16:03 PM - System Checkpoint
    RP1068: 10/04/2010 8:18:07 PM - System Checkpoint
    RP1069: 11/04/2010 9:19:32 PM - System Checkpoint
    RP1070: 14/04/2010 2:30:39 PM - Software Distribution Service 3.0
    RP1071: 15/04/2010 3:58:22 PM - System Checkpoint
    RP1072: 15/04/2010 9:29:58 PM - Software Distribution Service 3.0
    RP1073: 17/04/2010 1:08:25 PM - System Checkpoint
    RP1074: 18/04/2010 7:49:30 PM - System Checkpoint
    RP1075: 19/04/2010 8:21:22 PM - System Checkpoint
    RP1076: 21/04/2010 4:18:52 PM - System Checkpoint
    RP1077: 22/04/2010 4:47:48 PM - System Checkpoint
    RP1078: 23/04/2010 7:13:42 PM - System Checkpoint
    RP1079: 24/04/2010 7:20:08 PM - System Checkpoint
    RP1080: 25/04/2010 7:56:36 PM - System Checkpoint
    RP1081: 26/04/2010 8:13:24 PM - System Checkpoint
    RP1082: 27/04/2010 8:39:14 PM - System Checkpoint
    RP1083: 29/04/2010 5:19:44 PM - System Checkpoint
    RP1084: 1/05/2010 10:18:00 AM - System Checkpoint
    RP1085: 6/05/2010 6:41:13 PM - System Checkpoint
    RP1086: 7/05/2010 6:52:25 PM - System Checkpoint
    RP1087: 8/05/2010 7:22:30 PM - System Checkpoint
    RP1088: 9/05/2010 9:19:26 PM - System Checkpoint
    RP1089: 11/05/2010 3:56:41 PM - System Checkpoint
    RP1090: 13/05/2010 5:54:48 PM - System Checkpoint
    RP1091: 14/05/2010 6:46:23 PM - System Checkpoint
    RP1092: 15/05/2010 9:53:20 AM - Software Distribution Service 3.0
    RP1093: 15/05/2010 2:02:07 PM - Software Distribution Service 3.0
    RP1094: 16/05/2010 8:00:47 PM - System Checkpoint
    RP1095: 17/05/2010 8:22:51 PM - System Checkpoint
    RP1096: 18/05/2010 8:36:23 PM - System Checkpoint
    RP1097: 20/05/2010 4:32:55 PM - System Checkpoint
    RP1098: 21/05/2010 6:40:56 PM - System Checkpoint
    RP1099: 22/05/2010 7:55:06 PM - System Checkpoint
    RP1100: 23/05/2010 9:14:51 PM - System Checkpoint
    RP1101: 24/05/2010 9:52:13 PM - System Checkpoint
    RP1102: 25/05/2010 10:23:10 PM - System Checkpoint
    RP1103: 27/05/2010 5:00:31 PM - System Checkpoint

    ==== Installed Programs ======================

    7-Zip 4.57
    AAC Decoder
    ACDSee 5.0 PowerPack
    Acrobat.com
    Adobe Acrobat 5.0
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9
    Adobe Shockwave Player 11
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft PhotoStudio 5.5
    Athlon 64 Processor Driver
    Attansic Ethernet Utility
    Attansic L1 Gigabit Ethernet Driver
    AutoUpdate
    Avery® Wizard 2.1 for Microsoft® Word 2002
    AVS DVDMenu Editor 1.2.1.19
    AVS Video Tools 5.6
    Azureus
    Bonjour
    Canon MP Navigator 3.0
    Canon MP160
    Canon Utilities Easy-PhotoPrint
    CardRd81
    CCHelp
    CCScore
    Click'N Design 3D (V5)
    Command & Conquer The First Decade
    CR2
    Critical Update for Windows Media Player 11 (KB959772)
    DHCP Convertor
    Digital Media Converter 2.78
    DivX Codec
    DivX Content Uploader
    DivX Converter
    DivX Player
    DivX Plus DirectShow Filters
    DivX Version Checker
    DivX Web Player
    DivXMuXWizz
    doPDF 6.1 printer
    DVD Solution
    DX-Ball 2
    Easy-WebPrint
    ESSAdpt
    ESSANUP
    ESSBrwr
    ESSCAM
    ESSCDBK
    ESScore
    ESSCT
    ESSgui
    ESShelp
    ESSini
    ESSPCD
    ESSPDock
    ESSSONIC
    ESSTUTOR
    ESSvpaht
    ESSvpot
    FLV Player
    GetRight
    Gogglebox TV
    Google Earth
    Google Pinyin IME
    H.264 Decoder
    High Definition Audio Driver Package - KB888111
    HLPCCTR
    HLPIndex
    HLPPDOCK
    HLPRFO
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    iCD CoolBeLa
    InCD
    iTunes
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 8
    Java(TM) 6 Update 13
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Kodak EasyShare software
    KSU
    LG ODD Auto Firmware Update
    LiveUpdate 3.0 (Symantec Corporation)
    LiveUpdate Notice (Symantec Corporation)
    Mavis Beacon Teaches Typing
    McAfee SecurityCenter
    MetaFrame Presentation Server Web Client for Win32
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office XP Professional with FrontPage
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    mIRC
    MKV Splitter
    Mozilla Firefox (3.6.3)
    MP3 WAV Converter 3.18
    Mpeg2Decoder 1.3
    mpowerplayer
    MSN
    MSVC80_x86
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6 Service Pack 2 (KB954459)
    Multimedia Launcher
    NavDesk 2009
    Nero OEM
    NetDiag
    Netscape Browser (remove only)
    Nokia Connectivity Cable Driver
    Notifier
    NVIDIA Drivers
    OGA Notifier 1.7.0105.35.0
    OneCare Advisor (Windows Live Toolbar)
    OTtBP
    OTtBPSDK
    Oz Insight All-In-One Newsreader
    PartyPoker
    PC Connectivity Solution
    PCDLNCH
    Picture Ripper 4
    Platform
    PokerStars.net
    Popup Blocker (Windows Live Toolbar)
    PowerDVD
    PowerProducer
    PSP Toolkit 1.1
    QuickTime
    RALPH-Jana Screen Saver
    RealPlayer
    Realtek High Definition Audio Driver
    Rhapsody Player Engine
    ScanSoft OmniPage SE 4.0
    Security Update for CAPICOM (KB931906)
    Security Update for Windows Media Encoder (KB954156)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950759)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953838)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956390)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958215)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960714)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974455)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB976325)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB981349)
    SFR
    SFR2
    Shockwave
    Simple Reminder 1.0
    Smart Menus (Windows Live Toolbar)
    SopCast 1.1.2
    Spybot - Search & Destroy
    Tabbed Browsing (Windows Live Toolbar)
    TVAnts 1.0
    Ulead Video ToolBox 2.0 Plus Nokia Edition
    UltimateDefrag V1 FREE Public Domain Version
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Update for Windows XP (KB976749)
    Update for Windows XP (KB978207)
    Update for Windows XP (KB980182)
    UUSee ÃøÂçµÃ§ÃŠÃ“ [4.4.1214.20]
    UUSee ²¥·Ã…²Ã¥¼Ã¾»Ã¹´¡°Ã¼ 4.4.0.74
    VC80CRTRedist - 8.0.50727.762
    VCAMCEN
    Veetle TV 0.9.15
    VIA Platform Device Manager
    VideoLAN VLC media player 0.8.6e
    VobSub v2.23 (Remove Only)
    VPRINTOL
    WebFldrs XP
    Windows Driver Package - Nokia Modem (10/12/2007 3.6)
    Windows Imaging Component
    Windows Live Favorites for Windows Live Toolbar
    Windows Live Messenger
    Windows Live Outlook Toolbar (Windows Live Toolbar)
    Windows Live Sign-in Assistant
    Windows Live Toolbar
    Windows Live Toolbar Extension (Windows Live Toolbar)
    Windows Live Toolbar Feed Detector (Windows Live Toolbar)
    Windows Media Encoder 9 Series
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player Firefox Plugin
    Windows XP Service Pack 3
    WinRAR archiver
    WinZip 12.1
    Wolfenstein 3D
    Yahoo! Software Update
    Yahoo!7 Messenger
    Yahoo!7 Toolbar
    Your Uninstaller! 2008 Version 6.2
    YouTube Downloader 2.5.3

    ==== Event Viewer Messages From Past Week ========

    27/05/2010 7:17:10 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the mcmscsvc service.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Time service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Management Instrumentation service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the System Restore Service service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Server service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Secondary Logon service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Network Connections service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Help and Support service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Error Reporting Service service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Distributed Link Tracking Client service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Cryptographic Services service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the COM+ Event System service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Automatic Updates service to connect.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7001] - The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7001] - The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The Help and Support service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The Cryptographic Services service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The COM+ Event System service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:17:10 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:16:03 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    27/05/2010 7:16:02 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    27/05/2010 7:01:30 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 7:01:29 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
    27/05/2010 7:00:52 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
    27/05/2010 7:00:52 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 6:27:53 PM, error: Service Control Manager [7022] - The Windows Image Acquisition (WIA) service hung on starting.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Workstation service to connect.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Wireless Zero Configuration service to connect.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Audio service to connect.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Task Scheduler service to connect.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Shell Hardware Detection service to connect.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7000] - The Workstation service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7000] - The Wireless Zero Configuration service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7000] - The Windows Audio service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 6:26:27 PM, error: Service Control Manager [7000] - The Task Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 4:45:50 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Themes service to connect.
    27/05/2010 4:45:50 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the DHCP Client service to connect.
    27/05/2010 4:45:50 PM, error: Service Control Manager [7000] - The Themes service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    27/05/2010 4:45:50 PM, error: Service Control Manager [7000] - The DHCP Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    25/05/2010 8:13:10 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service.
    25/05/2010 8:12:03 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    25/05/2010 8:12:03 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.

    ==== End Of File ===========================
     
  2. 2010/05/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Uninstall McAfee, using McAfee Consumer Product Removal Tool: http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml
    Uninstall Norton's leftover, using Norton Removal Tool: http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

    Download and install ONE of these:
    - Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
    - Avira free antivirus: http://www.free-av.com/en/download/1/avira_antivir_personal__free_antivirus.html

    ===============================================================

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     

  3. to hide this advert.

  4. 2010/05/28
    bootan

    bootan Inactive Thread Starter

    Joined:
    2010/05/27
    Messages:
    5
    Likes Received:
    0
    Did everything above. removed my mcafee and norton. i installed avast antivirus. i ran combofix.
    my internet is working again, google searches dont redirect (ive tried a couple of times now). the only thing that hasnt changed back to normal is that my start bar is still grey and the old type, and my pc seems to be running slow.

    here is combofix's log:

    ComboFix 10-05-27.02 - s 28/05/2010 18:57:32.1.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.303 [GMT 10:00]
    Running from: c:\documents and settings\s\Desktop\qq\ComboFix.exe
    AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\s\Application Data\alot
    c:\documents and settings\s\Application Data\alot\Resources\Button_0\images\alot_icon_35x16.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Button_1\images\alot_search_24x16.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Button_2\images\default_252_alot_casual_games.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Button_3\images\default_393_widget_crossword.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Button_4\images\default_392_widget_sudoku.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Button_5\images\default_253_alot_casual_moregames.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Button_6\images\default_339_alot_casual_featured.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Button_7\images\default_255_alot_mrkt_rocket.bmp
    c:\documents and settings\s\Application Data\alot\Resources\Shared\images\alot_brand.png
    c:\documents and settings\s\Application Data\alot\toolbar.xml
    c:\documents and settings\s\Cookies\MM2048.DAT
    c:\documents and settings\s\Local Settings\Temporary Internet Files\BL_H10.rom
    c:\documents and settings\s\Local Settings\Temporary Internet Files\bootloader.inf
    c:\documents and settings\s\Local Settings\Temporary Internet Files\firmware.inf
    c:\documents and settings\s\Local Settings\Temporary Internet Files\update.inf
    c:\documents and settings\s\Recent\Thumbs.db
    C:\install.exe
    c:\windows\system32\SHELLLNK.TLB

    Infected copy of c:\windows\system32\drivers\redbook.sys was found and disinfected
    Restored copy from - Kitty had a snack :p
    .
    ((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-28 )))))))))))))))))))))))))))))))
    .

    2010-05-28 08:35 . 2010-05-06 20:33 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2010-05-28 08:35 . 2010-05-06 20:39 164048 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2010-05-28 08:35 . 2010-05-06 20:34 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2010-05-28 08:35 . 2010-05-06 20:39 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2010-05-28 08:35 . 2010-05-06 20:33 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2010-05-28 08:35 . 2010-05-06 20:33 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2010-05-28 08:35 . 2010-05-06 20:33 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2010-05-28 08:35 . 2010-05-06 20:59 38848 ----a-w- c:\windows\system32\avastSS.scr
    2010-05-28 08:35 . 2010-05-06 20:59 165032 ----a-w- c:\windows\system32\aswBoot.exe
    2010-05-28 08:35 . 2010-05-28 08:35 -------- d-----w- c:\program files\Alwil Software
    2010-05-28 08:35 . 2010-05-28 08:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2010-05-06 10:14 . 2009-10-16 05:50 2520888 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
    2010-05-06 10:14 . 2008-03-04 08:52 286720 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\libcurl.dll
    2010-05-06 10:14 . 2007-10-30 23:39 59904 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\zlib1.dll
    2010-05-06 10:14 . 2007-05-17 03:58 143360 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\libexpatw.dll
    2010-05-06 10:14 . 2006-10-18 07:32 499712 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\msvcp71.dll
    2010-05-06 10:14 . 2006-10-18 07:32 348160 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\msvcr71.dll
    2010-05-06 10:14 . 2006-10-16 08:44 196608 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\ssleay32.dll
    2010-05-06 10:14 . 2006-10-16 08:44 1028096 ----a-w- c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\libeay32.dll
    2010-04-30 08:28 . 2010-04-30 08:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Longbow Digital Arts

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-05-28 08:32 . 2006-10-25 07:00 -------- d-----w- c:\program files\lg_fwupdate
    2010-05-28 08:32 . 2006-10-25 06:39 -------- d-----w- c:\program files\Symantec
    2010-05-28 08:30 . 2006-10-25 06:39 -------- d-----w- c:\program files\Common Files\Symantec Shared
    2010-05-26 08:44 . 2007-02-23 23:51 -------- d-----w- c:\documents and settings\s\Application Data\Azureus
    2010-05-08 08:57 . 2007-02-23 23:51 -------- d-----w- c:\program files\Azureus
    2010-04-27 06:56 . 2008-12-30 08:33 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-04-25 01:14 . 2007-09-29 11:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-04-25 01:10 . 2007-09-29 11:23 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-04-20 11:21 . 2009-01-22 07:55 -------- d-----w- c:\program files\PokerStars.NET
    2010-04-14 04:23 . 2009-11-12 22:10 79488 ----a-w- c:\documents and settings\s\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2010-04-04 10:26 . 2009-12-30 06:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2010-03-09 11:09 . 2004-08-04 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
    2007-08-07 23:39 . 2007-09-29 05:06 2277376 ----a-w- c:\program files\PictureRipper4.exe
    2004-10-01 05:00 . 2006-10-25 06:54 40960 ----a-w- c:\program files\Uninstall_CDS.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Simple Reminder "= "c:\program files\Willems Soft\Simple Reminder\Simple Reminder.exe" [2006-02-24 851968]
    "Messenger (Yahoo!) "= "c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2009-11-10 5244216]
    "SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL "= "RTHDCPL.EXE" [2006-04-17 16143872]
    "RemoteControl "= "c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
    "InCD "= "c:\program files\Ahead\InCD\InCD.exe" [2006-03-14 1397760]
    "NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "LGODDFU "= "c:\program files\lg_fwupdate\fwupdate.exe" [2009-01-03 548864]
    "NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2005-12-14 7323648]
    "nwiz "= "nwiz.exe" [2005-12-14 1519616]
    "NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2005-12-14 86016]
    "SSBkgdUpdate "= "c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 155648]
    "OpwareSE4 "= "c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 69632]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-03-08 148888]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
    "avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Kodak EasyShare software.lnk.disabled [2006-11-22 1807]
    Kodak software updater.lnk.disabled [2008-8-14 1996]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=" "

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "ctfmon.exe "=c:\windows\system32\ctfmon.exe
    "iPlusAgent "= "c:\program files\iriver\iriver plus\iAgent.exe "
    "PowerBar "=
    "Yahoo! Pager "= "c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\MSN Messenger\\livecall.exe "=
    "c:\\Program Files\\uusee\\UUSeePlayer.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [28/05/2010 6:35 PM 164048]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28/05/2010 6:35 PM 19024]
    R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [25/10/2006 4:38 PM 31104]
    S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [25/10/2006 4:29 PM 5824]
    S3 PortlUSB;PortlUSB;c:\windows\system32\drivers\H10USB.sys [24/06/2004 2:52 PM 7552]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer = 192.104.67.250 :8080
    uInternet Settings,ProxyOverride = <local>;*.local
    uSearchURL,(Default) = hxxp://g.ninemsn.com.au/0SEENAU/SAOS01?FORM=TOOLBR
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    IE: Download with GetRight - c:\program files\GetRight\GRdownload.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/229?1a52395c5547483eb537ea57e1d92bba
    IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-au\msntabres.dll.mui/230?1a52395c5547483eb537ea57e1d92bba
    IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
    FF - ProfilePath - c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\
    FF - prefs.js: browser.startup.homepage - hxxp://greeksoccer.com
    FF - plugin: c:\documents and settings\s\Application Data\Mozilla\Firefox\Profiles\hnfsnufr.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
    FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Veetle\Player\npvlc.dll
    FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
    FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    .
    - - - - ORPHANS REMOVED - - - -

    Notify-WgaLogon - (no file)
    AddRemove-DHCP Convertor - c:\docume~1\s\LOCALS~1\Temp\_ISTMP2.DIR\_ISTMP0.DIR\..\..\Uninst.isu



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-05-28 19:10
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2010-05-28 19:14:49
    ComboFix-quarantined-files.txt 2010-05-28 09:14

    Pre-Run: 53,144,104,960 bytes free
    Post-Run: 53,820,796,928 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

    - - End Of File - - 545E6BF41CBD3050C22FFA65FB89D931
     
  5. 2010/05/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I'm glad to hear better news :)

    By "start bar" do you mean a whole taskbar located at the bottom of your screen?

    Please, delete manually following folders:
    c:\program files\Symantec
    c:\program files\Common Files\Symantec Shared

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start> "Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall "
    Click OK (Vista users - press Enter).
    Restart computer.

    Make sure to update Avast and run full scan.
    Report on any findings.
     
  6. 2010/05/28
    bootan

    bootan Inactive Thread Starter

    Joined:
    2010/05/27
    Messages:
    5
    Likes Received:
    0
    Did all this as above, deleted those 2 folders, uninstalled combofix and restarted. updated avast and did both a quick scan and full scan. they found 4 threats (3 in quick scan and 1 in full scan). they were:

    win32 alureon-FZ
    win32 spyware-gen(spy)
    win32:Tdss-DV(trj) found in youtube downloader

    WMA: Wimad(Drp) found in a mp3 song

    nothing really changed since last post. internet fine, but yes the botton task bar is still grey and just looks differnet to what i had before, and the pc is still slow. maybe i need to defrag?

    thanks for your help thus far!!!
     
  7. 2010/05/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    We'll try to figure out taskbar issue little bit later.
    The main target for now is to make sure, your computer is totally clean.

    Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) to your desktop.

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform quick scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    Be sure to restart the computer.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
     
  8. 2010/05/29
    bootan

    bootan Inactive Thread Starter

    Joined:
    2010/05/27
    Messages:
    5
    Likes Received:
    0
    Did everything above and removed a threat that was found. here is the log. And thankyou again for your speedy responses!!!

    mbam log:

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4153

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 6.0.2900.5512

    29/05/2010 2:55:33 PM
    mbam-log-2010-05-29 (14-55-33).txt

    Scan type: Quick scan
    Objects scanned: 121612
    Time elapsed: 7 minute(s), 4 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Documents and Settings\s\Cookies\MM256.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
     
  9. 2010/05/29
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're welcome :)

    1. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.


    2. Go to Kaspersky website and perform an online antivirus scan.

    1. Disable your active antivirus program.
    2. Read through the requirements and privacy statement and click on Accept button.
    3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    4. When the downloads have finished, click on Settings.
    5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    6. Click on My Computer under Scan.
    7. Once the scan is complete, it will display the results. Click on View Scan Report.
    8. You will see a list of infected items there. Click on Save Report As....
    9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.


    Download HijackThis:
    http://free.antivirus.com/hijackthis/
    by clicking on Installer under Version 2.0.4
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator
     
  10. 2010/06/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Are you still out there?
     
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.