1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive Downloaded Hijakthis and notepad log will not show up

Discussion in 'Malware and Virus Removal Archive' started by hel, 2010/06/12.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. 2010/06/12
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    [Inactive] Downloaded Hijakthis and notepad log will not show up

    Hi,

    I recently downloaded hijak here: http://free.antivirus.com/hijackthis/
    and I wanted to scan and receive the log afterward so that I could post it up here. However, the log isn't showing up in notepad when the scan is over. Notepad pops up as normal, but it's just blank. What could be wrong with this?

    I have the contents of the logs if anyone will ask.

    Thanks.
     
    hel,
    #1
  2. 2010/06/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Start with describing your computer issues.
    Then...

    Read this post, then post the requested log(s).
     
    broni,
    #2


  3. to hide this advert.

  4. 2010/06/12
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    Okay.

    My computer freezes frequently, and restarts without an explanation as to why it's going to. I've tried deleting things like programs that I do not use anymore, but there are other accounts on this computer that I don't have access to because it used to be shared.

    Here are the logs:

    DDS (Ver_10-03-17.01) - NTFSX64
    Run by New at 17:25:40.19 on Sat 06/12/2010
    Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_20
    Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.4094.2328 [GMT -4:00]


    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
    C:\Windows\system32\agr64svc.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
    C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
    C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
    C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
    C:\Windows\system32\lxcicoms.exe
    C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
    C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
    C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
    C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x64\eDSLoader.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files (x86)\Linksys\Linksys Wireless Manager\LinksysWirelessManager64.exe
    C:\Program Files (x86)\Lexmark 7300 Series\lxcimon.exe
    C:\Program Files (x86)\Lexmark 7300 Series\ezprint.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files (x86)\AIM\aim.exe
    C:\Users\New\AppData\Local\Google\Update\GoogleUpdate.exe
    C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
    C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
    C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Acer\Empowering Technology\eDataSecurity\x86\eDSMSNLoader32.exe
    C:\Windows\system32\vssvc.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Users\New\Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.aol.com/?src=aim&ncid=snsusaimc00000001
    uSearch Page = hxxp://www.google.com
    mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=1&o=vp64&d=1006&m=aspire_x1700
    mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=1&o=vp64&d=1006&m=aspire_x1700
    mLocal Page = c:\windows\syswow64\blank.htm
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    mURLSearchHooks: H - No File
    mWinlogon: Userinit=userinit.exe
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: {547395D9-934A-CED6-B851-F238C86079E5} - No File
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files (x86)\common files\mcafee\systemcore\ScriptSn.20100518082516.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
    BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files (x86)\msn\toolbar\3.0.1203.0\msneshellx.dll
    BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files (x86)\ask.com\GenericAskToolbar.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
    BHO: {DDD38B53-8FB2-27B4-36B9-FD312993EE27} - No File
    BHO: {F31C8969-83E7-A513-2E11-CB6D1837C2CB} - No File
    TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files (x86)\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
    TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files (x86)\msn\toolbar\3.0.1203.0\msneshellx.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
    TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files (x86)\ask.com\GenericAskToolbar.dll
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    uRun: [cdloader] "c:\users\new\appdata\roaming\mjusbsp\cdloader2.exe" MAGICJACK
    uRun: [msnmsgr] "c:\program files (x86)\windows live\messenger\msnmsgr.exe" /background
    uRun: [Messenger (Yahoo!)] "c:\program files (x86)\yahoo!\messenger\YahooMessenger.exe" -quiet
    uRun: [Aim] "c:\program files (x86)\aim\aim.exe" /d locale=en-US
    uRun: [Google Update] "c:\users\new\appdata\local\google\update\GoogleUpdate.exe" /c
    uRunOnce: [Shockwave Updater] c:\windows\syswow64\adobe\shockwave 11\SwHelper_1150600.exe -Update -1150600 - "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; eSobiSubscriber 2.0.4.16; .NET CLR 3.5.30729; .NET CLR 3.0.30729; MSN OptimizedIE8;ENUS)" - "http://www.isketch.net/isketch.shtml "
    uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p
    mRun: [PCMMediaSharing] "c:\program files (x86)\acer arcade live\acer homemedia connect\kernel\dms\PCMMediaSharing.exe "
    mRun: [BkupTray] "c:\program files (x86)\newtech infosystems\nti backup now 5\BkupTray.exe "
    mRun: [eRecoveryService]
    mRun: [Acer Product Registration] "c:\program files (x86)\acer\acer registration\ACE1.exe" /startup
    mRun: [Acer Assist Launcher] "c:\program files (x86)\acer\acer assist\launcher.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 8.0\reader\Reader_sl.exe "
    mRun: [nmctxth] "c:\program files (x86)\common files\pure networks shared\platform\nmctxth.exe "
    mRun: [SunJavaUpdateSched] "c:\program files (x86)\common files\java\java update\jusched.exe "
    mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files (x86)\itunes\iTunesHelper.exe "
    StartupFolder: c:\users\new\appdata\roaming\micros~1\windows\startm~1\programs\startup\frostw~1.lnk - c:\program files (x86)\frostwire\FrostWire.exe
    StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files (x86)\mcafee security scan\2.0.181\SSScheduler.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} - hxxp://sympatico.zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\McIEPlg.dll
    Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files (x86)\common files\pure networks shared\platform\puresp4.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~2\mcafee\sitead~1\McIEPlg.dll
    BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\MSKAPB~1.DLL
    BHO-X64: McAfee Phishing Filter - No File
    BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20100518082516.dll
    BHO-X64: scriptproxy - No File
    BHO-X64: ShowBarObj Class: {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - c:\program files (x86)\acer\empowering technology\edatasecurity\x64\ActiveToolBand.dll
    BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~2\mcafee\sitead~1\x64\mcieplg.dll
    TB-X64: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - c:\program files (x86)\acer\empowering technology\edatasecurity\x64\eDStoolbar.dll
    TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~2\mcafee\sitead~1\x64\mcieplg.dll
    TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun-x64: [Acer Empowering Technology Monitor] c:\program files\acer\empowering technology\SysMonitor.exe
    mRun-x64: [EmpoweringTechnology] c:\program files\acer\empowering technology\Framework.Launcher.exe boot
    mRun-x64: [eDataSecurity Loader] "c:\program files (x86)\acer\empowering technology\edatasecurity\x64\eDSloader.exe "
    mRun-x64: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun-x64: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe
    mRun-x64: [Linksys Wireless Manager] "c:\program files (x86)\linksys\linksys wireless manager\LinksysWirelessManager.exe" /cm /min /lcid 1033
    mRun-x64: [LXCICATS] rundll32 c:\windows\system32\spool\drivers\x64\3\LXCItime.dll,RunDLLEntry
    mRun-x64: [lxcimon.exe] "c:\program files (x86)\lexmark 7300 series\lxcimon.exe "
    mRun-x64: [EzPrint] "c:\program files (x86)\lexmark 7300 series\ezprint.exe "

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\new\appdata\roaming\mozilla\firefox\profiles\5cb4rfi5.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://aimzones.aol.com/homepage
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
    FF - component: c:\program files (x86)\mcafee\siteadvisor\components\McFFPlg.dll
    FF - component: c:\program files (x86)\mozilla firefox\components\Scriptff.dll
    FF - plugin: c:\program files (x86)\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files (x86)\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files (x86)\google\update\1.2.183.23\npGoogleOneClick8.dll
    FF - plugin: c:\program files (x86)\mozilla firefox\extensions\npmozax@real.com\plugins\npmozax.dll
    FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdnu.dll
    FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npraclient.dll
    FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npViewpoint.dll
    FF - plugin: c:\program files (x86)\viewpoint\viewpoint media player\npViewpoint.dll
    FF - plugin: c:\programdata\realarcade\npraclient.dll
    FF - plugin: c:\users\new\appdata\local\google\update\1.2.183.23\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true);user_pref(protocol-handler.warn-external.dnUpdate, false
    FF - user.js: browser.sessionstore.resume_from_crash - false

    ============= SERVICES / DRIVERS ===============

    R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-1-5 528616]
    R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-5-18 75288]
    R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-5-18 279752]
    R1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [2010-5-18 66040]
    R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files (x86)\acer arcade live\acer homemedia connect\kernel\dms\CLMSServer.exe [2009-3-13 269448]
    R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files (x86)\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384]
    R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2009-3-13 24576]
    R2 lxci_device;lxci_device;c:\windows\system32\lxcicoms.exe -service --> c:\windows\system32\lxcicoms.exe -service [?]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; "c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-18 355440]
    R2 McMPFSvc;McAfee Personal Firewall; "c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-18 355440]
    R2 McNaiAnn;McAfee VirusScan Announcer; "c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-18 355440]
    R2 McProxy;McAfee Proxy Service; "c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-18 355440]
    R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-5-18 199032]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-5-18 244840]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-5-18 148520]
    R2 MOBKbackup;McAfee Online Backup;c:\program files (x86)\mcafee online backup\MOBKbackup.exe [2010-2-5 231224]
    R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-26 45056]
    R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-26 131072]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files (x86)\viewpoint\common\ViewpointService.exe [2009-7-31 24652]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-5-18 62416]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-5-18 189880]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-5-18 440688]
    S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2010-5-13 136176]
    S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-8-5 89920]
    S3 dhdusb.NTamd64;Dynex Wireless G USB Network Adapter Service;c:\windows\system32\drivers\bcmusbdhdlh64.sys [2009-6-19 253944]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648]
    S3 ITEIO.SYS;ITEIO.SYS;c:\windows\system32\drivers\ITEIO.sys [2006-10-10 13144]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-5-18 93840]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-6-20 40904]
    S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-6-20 49480]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-8-21 19456]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-8-21 9216]
    S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-6-20 29184]
    S3 netr28ux;Belkin USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28ux.sys [2008-10-29 811008]
    S3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\drivers\netr28x.sys [2009-3-13 405504]
    S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-3-13 56352]
    S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-20 19968]
    S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl64.sys [2009-8-28 49152]
    S3 WUSB54GCv3;Compact Wireless-G USB Network Adapter;c:\windows\system32\drivers\WUSB54GCv3.sys [2009-10-31 797184]

    ============== File Associations ===============

    JSEFile=c:\windows\syswow64\WScript.exe "%1" %*
    regfile= "regedit.exe" "%1 "

    =============== Created Last 30 ================

    2010-06-10 22:52:50 65536 ------w- c:\windows\system32\Ikeext.etl
    2010-06-08 22:08:28 84480 ----a-w- c:\windows\system32\asycfilt.dll
    2010-06-08 22:08:28 67072 ----a-w- c:\windows\syswow64\asycfilt.dll
    2010-06-08 22:08:19 2752000 ----a-w- c:\windows\system32\win32k.sys
    2010-06-07 23:49:35 0 d-----w- C:\PowerCinema
    2010-06-03 21:22:23 0 d-----w- c:\program files\iPod
    2010-06-03 21:22:19 0 d-----w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
    2010-06-03 21:22:19 0 d-----w- c:\program files\iTunes
    2010-06-03 21:22:19 0 d-----w- c:\program files (x86)\iTunes
    2010-06-03 21:16:31 0 d-----w- c:\program files\Bonjour
    2010-06-03 21:16:31 0 d-----w- c:\program files (x86)\Bonjour
    2010-05-29 15:37:40 0 d-----w- c:\program files (x86)\Ask.com
    2010-05-29 15:37:26 0 d-----w- c:\program files (x86)\uTorrent
    2010-05-26 19:43:04 0 d-----w- c:\program files (x86)\common files\Software Update Utility
    2010-05-26 10:36:04 2048 ----a-w- c:\windows\syswow64\tzres.dll
    2010-05-26 10:36:03 2048 ----a-w- c:\windows\system32\tzres.dll
    2010-05-23 23:17:20 0 d-----w- c:\program files (x86)\WildGames
    2010-05-23 22:43:01 0 d-----w- c:\programdata\JollyBear
    2010-05-20 16:45:09 0 d-----w- c:\programdata\Ezprint
    2010-05-20 16:44:40 0 d-----w- c:\program files\Lx_cats
    2010-05-20 16:43:23 0 d-----w- c:\program files\Lexmark 7300 Series
    2010-05-20 16:43:00 625664 ----a-w- c:\windows\system32\lxciutil.dll
    2010-05-20 16:43:00 305152 ----a-w- c:\windows\system32\lxcihcp.dll
    2010-05-20 16:43:00 238592 ----a-w- c:\windows\system32\lxciinpa.dll
    2010-05-20 16:43:00 226816 ----a-w- c:\windows\system32\lxciiesc.dll
    2010-05-20 16:43:00 194048 ----a-w- c:\windows\system32\lxciinst.dll
    2010-05-20 16:43:00 17395 ----a-w- c:\windows\system32\LexFiles.ulf
    2010-05-20 16:17:32 0 d-----w- c:\program files (x86)\Lexmark 7300 Series
    2010-05-20 16:16:28 0 d-----w- C:\Program Files (x86) (x86)
    2010-05-18 20:21:17 0 d-----w- c:\program files (x86)\CCleaner
    2010-05-18 12:26:24 0 d-----w- c:\program files (x86)\McAfeeMOBK
    2010-05-18 12:26:23 65536 --sha-w- c:\users\new\ntuser.dat{4285fa68-6275-11df-a5fa-0021976a90b4}.TM.blf
    2010-05-18 12:26:23 524288 --sha-w- c:\users\new\ntuser.dat{4285fa68-6275-11df-a5fa-0021976a90b4}.TMContainer00000000000000000002.regtrans-ms
    2010-05-18 12:26:23 524288 --sha-w- c:\users\new\ntuser.dat{4285fa68-6275-11df-a5fa-0021976a90b4}.TMContainer00000000000000000001.regtrans-ms
    2010-05-18 12:26:20 66040 ----a-w- c:\windows\system32\drivers\MOBK.sys
    2010-05-18 12:26:19 0 d-----w- c:\program files (x86)\McAfee Online Backup
    2010-05-18 12:25:36 0 d-----w- c:\program files (x86)\McAfee.com
    2010-05-18 12:25:16 9984 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
    2010-05-18 12:25:16 0 d-----w- c:\program files (x86)\common files\McAfee
    2010-05-18 12:25:12 279752 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
    2010-05-18 12:25:11 93840 ----a-w- c:\windows\system32\drivers\mferkdet.sys
    2010-05-18 12:25:11 75288 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
    2010-05-18 12:25:11 62416 ----a-w- c:\windows\system32\drivers\cfwids.sys
    2010-05-18 12:25:11 440688 ----a-w- c:\windows\system32\drivers\mfefirek.sys
    2010-05-18 12:25:11 189880 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2010-05-18 12:25:07 0 d-----w- c:\program files\McAfee.com
    2010-05-18 12:25:07 0 d-----w- c:\program files\McAfee
    2010-05-18 12:25:07 0 d-----w- c:\program files\common files\McAfee
    2010-05-18 00:02:01 0 d-----w- c:\users\new\appdata\roaming\Malwarebytes
    2010-05-18 00:01:51 24664 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-05-18 00:01:51 0 d-----w- c:\programdata\Malwarebytes
    2010-05-18 00:01:51 0 d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

    ==================== Find3M ====================

    2010-06-03 21:17:06 86016 ----a-w- c:\windows\inf\infstor.dat
    2010-06-03 21:17:06 51200 ----a-w- c:\windows\inf\infpub.dat
    2010-06-03 21:17:06 143360 ----a-w- c:\windows\inf\infstrng.dat
    2010-05-26 17:23:46 48128 ----a-w- c:\windows\system32\atmlib.dll
    2010-05-26 17:06:41 34304 ----a-w- c:\windows\syswow64\atmlib.dll
    2010-05-26 15:10:41 366080 ----a-w- c:\windows\system32\atmfd.dll
    2010-05-26 14:47:41 289792 ----a-w- c:\windows\syswow64\atmfd.dll
    2010-05-06 14:36:38 270208 ------w- c:\windows\system32\MpSigStub.exe
    2010-05-04 06:56:19 1147904 ----a-w- c:\windows\system32\wininet.dll
    2010-05-04 06:51:49 132096 ----a-w- c:\windows\system32\iesysprep.dll
    2010-05-04 06:51:48 77312 ----a-w- c:\windows\system32\iesetup.dll
    2010-05-04 05:59:21 916480 ----a-w- c:\windows\syswow64\wininet.dll
    2010-05-04 05:59:11 1209344 ----a-w- c:\windows\syswow64\urlmon.dll
    2010-05-04 05:58:07 206848 ----a-w- c:\windows\syswow64\occache.dll
    2010-05-04 05:56:49 611840 ----a-w- c:\windows\syswow64\mstime.dll
    2010-05-04 05:56:28 5950976 ----a-w- c:\windows\syswow64\mshtml.dll
    2010-05-04 05:56:25 599040 ----a-w- c:\windows\syswow64\msfeeds.dll
    2010-05-04 05:56:25 55296 ----a-w- c:\windows\syswow64\msfeedsbs.dll
    2010-05-04 05:55:56 25600 ----a-w- c:\windows\syswow64\jsproxy.dll
    2010-05-04 05:55:42 71680 ----a-w- c:\windows\syswow64\iesetup.dll
    2010-05-04 05:55:42 1985536 ----a-w- c:\windows\syswow64\iertutil.dll
    2010-05-04 05:55:42 164352 ----a-w- c:\windows\syswow64\ieui.dll
    2010-05-04 05:55:42 109056 ----a-w- c:\windows\syswow64\iesysprep.dll
    2010-05-04 05:55:41 55808 ----a-w- c:\windows\syswow64\iernonce.dll
    2010-05-04 05:55:41 184320 ----a-w- c:\windows\syswow64\iepeers.dll
    2010-05-04 05:55:41 11076096 ----a-w- c:\windows\syswow64\ieframe.dll
    2010-05-04 05:55:37 387584 ----a-w- c:\windows\syswow64\iedkcs32.dll
    2010-05-04 05:01:59 162816 ----a-w- c:\windows\system32\ieUnatt.exe
    2010-05-04 04:31:05 133632 ----a-w- c:\windows\syswow64\ieUnatt.exe
    2010-05-04 04:30:58 173056 ----a-w- c:\windows\syswow64\ie4uinit.exe
    2010-05-04 04:30:19 13312 ----a-w- c:\windows\syswow64\msfeedssync.exe
    2010-04-29 11:59:59 97420 ----a-w- c:\windows\fonts\leelawdb.ttf
    2010-04-27 21:16:24 528616 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2010-04-27 21:16:24 121504 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2010-04-12 21:29:27 153376 ----a-w- c:\windows\syswow64\javaws.exe
    2010-04-12 21:29:26 145184 ----a-w- c:\windows\syswow64\javaw.exe
    2010-04-12 21:29:25 145184 ----a-w- c:\windows\syswow64\java.exe
    2010-04-12 21:29:19 411368 ----a-w- c:\windows\syswow64\deployJava1.dll
    2010-04-08 17:33:00 95520 ----a-w- c:\windows\system32\dnssd.dll
    2010-04-08 17:33:00 119584 ----a-w- c:\windows\system32\dns-sd.exe
    2010-04-08 17:20:02 91424 ----a-w- c:\windows\syswow64\dnssd.dll
    2010-04-08 17:20:02 107808 ----a-w- c:\windows\syswow64\dns-sd.exe
    2009-11-17 08:20:21 665600 ----a-w- c:\windows\inf\drvindex.dat
    2008-01-21 03:21:59 174 --sha-w- c:\program files\desktop.ini
    2008-01-21 03:21:59 174 --sha-w- c:\program files (x86)\desktop.ini
    2006-11-02 15:14:56 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
    2006-11-02 15:14:56 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
    2006-11-02 15:14:56 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
    2006-11-02 15:14:56 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
    2006-11-02 10:52:12 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
    2006-11-02 10:52:12 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
    2006-11-02 10:52:10 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
    2006-11-02 10:52:10 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
    2009-10-16 21:36:00 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
    2009-07-02 20:32:06 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat
    2009-10-16 10:43:54 245760 --sha-w- c:\windows\syswow64\%appdata%\microsoft\windows\ietldcache\index.dat

    ============= FINISH: 17:26:43.98 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-03-17.01)

    Microsoft® Windows Vistaâ„¢ Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 10/10/2006 8:29:33 AM
    System Uptime: 6/12/2010 5:21:21 PM (0 hours ago)

    Motherboard: Acer | | Aspire X1700
    Processor: Intel(R) Pentium(R) Dual CPU E2220 @ 2.40GHz | CPU 1 | 2403/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 287 GiB total, 221.379 GiB free.
    D: is FIXED (NTFS) - 290 GiB total, 259.759 GiB free.
    F: is CDROM ()
    G: is Removable
    H: is Removable

    ==== Disabled Device Manager Items =============

    Class GUID: {4d36e96f-e325-11ce-bfc1-08002be10318}
    Description: Microsoft PS/2 Mouse
    Device ID: ACPI\PNP0F03\4&3032039E&0
    Manufacturer: Microsoft
    Name: Microsoft PS/2 Mouse
    PNP Device ID: ACPI\PNP0F03\4&3032039E&0
    Service: i8042prt

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: 802.11b/g/n PCI Wireless Network Adapter
    Device ID: ROOT\NET\0000
    Manufacturer:
    Name: 802.11b/g/n PCI Wireless Network Adapter
    PNP Device ID: ROOT\NET\0000
    Service: netr28x

    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: 802.11b/g/n Wireless Network Adapter
    Device ID: ROOT\UNKNOWN\0000
    Manufacturer:
    Name: 802.11b/g/n Wireless Network Adapter
    PNP Device ID: ROOT\UNKNOWN\0000
    Service: netr28x

    ==== System Restore Points ===================

    RP589: 6/10/2010 9:25:31 AM - Windows Update
    RP590: 6/10/2010 7:11:27 PM - Windows Update
    RP591: 6/11/2010 1:25:23 PM - Windows Update
    RP592: 6/11/2010 1:41:13 PM - Windows Update

    ==== Installed Programs ======================

    Acer Arcade Live Main Page
    Acer Assist
    Acer DV Magician
    Acer DVDivine
    Acer eDataSecurity Management
    Acer Empowering Technology
    Acer eRecovery Management
    Acer eSettings Management
    Acer GameZone Console DTV 2.0.1.1
    Acer HomeMedia
    Acer HomeMedia Connect
    Acer HomeMedia Trial Creator
    Acer Registration
    Acer ScreenSaver
    Acer SlideShow DVD
    Acer VideoMagician
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 8.1.6
    Adobe Shockwave Player 11.5
    AIM 7
    Apple Application Support
    Apple Software Update
    ASIO4ALL
    Ask Toolbar
    AviSynth 2.5
    AVS Update Manager 1.0
    AVS Video Converter 6
    AVS4YOU Software Navigator 1.3
    Belkin F6D4050 Enhanced Wireless USB Adapter
    CCleaner
    Compatibility Pack for the 2007 Office system
    DivX Web Player
    Download Updater (AOL LLC)
    EA Network Play System
    eSobi v2
    FL Studio 8
    FlySim 1.0
    FrostWire 4.20.6
    Google Chrome
    Google Earth Plug-in
    Google Update Helper
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    IrfanView (remove only)
    Java Auto Updater
    Java(TM) 6 Update 20
    Jumpcut Video Downloader 3.15
    K-Lite Codec Pack 5.1.0 (Basic)
    Lexmark 7300 Series
    LightScribe 1.4.142.1
    McAfee Online Backup
    McAfee Security Scan Plus
    McAfee Total Protection
    Microsoft Choice Guard
    Microsoft Office Suite Activation Assistant
    Microsoft Office Word Viewer 2003
    Microsoft Silverlight
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    Mozilla Firefox (3.0.19)
    MSN Toolbar
    MSVCRT
    MSXML 4.0 SP2 (KB973688)
    NTI Backup Now 5
    NTI Backup Now Standard
    NTI JewelCase Maker Hot Fix
    NTI Media Maker 8
    NTI Photo Maker Hot Fix
    Picasa 3
    PoiZone
    Pro Bass Fishing 2003
    Pure Networks Platform
    QuickTime
    Random Dice Roller
    RealArcade
    Realtek High Definition Audio Driver
    SATMath
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    VC80CRTRedist - 8.0.50727.762
    Viewpoint Media Player
    WildTangent Games
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Yahoo! Messenger
    Yahoo! Software Update

    ==== Event Viewer Messages From Past Week ========

    6/8/2010 4:32:06 PM, Error: EventLog [6008] - The previous system shutdown at 4:27:39 PM on 6/8/2010 was unexpected.
    6/8/2010 3:55:39 PM, Error: EventLog [6008] - The previous system shutdown at 3:52:31 PM on 6/8/2010 was unexpected.
    6/7/2010 6:20:28 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.0.103 for the Network Card with network address 0021976A90B4 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
    6/7/2010 10:07:10 PM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.
    6/12/2010 5:22:21 PM, Error: Service Control Manager [7000] - The Broadcom Wireless LAN Tray Service service failed to start due to the following error: The system cannot find the file specified.
    6/11/2010 1:25:47 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Works 8 (KB977304).
    6/10/2010 9:25:39 AM, Error: volsnap [20] - The shadow copies of volume C: were aborted because of a failed free space computation.
    6/10/2010 9:16:01 PM, Error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
    6/10/2010 9:16:00 PM, Error: nvstor64 [5] - A parity error was detected on \Device\RaidPort0.
    6/10/2010 8:22:23 PM, Error: EventLog [6008] - The previous system shutdown at 8:20:04 PM on 6/10/2010 was unexpected.
    6/10/2010 8:17:12 AM, Error: EventLog [6008] - The previous system shutdown at 1:34:30 AM on 6/10/2010 was unexpected.

    ==== End Of File ===========================
     
    hel,
    #3
  5. 2010/06/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) to your desktop.

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform quick scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    Be sure to restart the computer.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    ==============================================================

    Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    Print these instructions out.

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Under "Configuration and Preferences ", click the Preferences button.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    o Close browsers before scanning.
    o Scan for tracking cookies.
    o Terminate memory threats before quarantining.
    * Click the "Close" button to leave the control center screen.
    * Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, under "Complete Scan ", choose Perform Complete Scan.
    * Click "Next" to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK ".
    * Make sure everything has a checkmark next to it and click "Next ".
    * A notification will appear that "Quarantine and Removal is Complete ". Click "OK" and then click the "Finish" button to return to the main menu.
    * If asked if you want to reboot, click "Yes ".
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    o Click Preferences, then click the Statistics/Logs tab.
    o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    o Please copy and paste the Scan Log results in your next reply with a new HijackThis log.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    ==============================================================

    Download OTL to your Desktop.

    * Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    * Under the Custom Scan box paste this in:



    netsvcs
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    CREATERESTOREPOINT



    * Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
    broni,
    #4
  6. 2010/06/13
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc…) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

    References for the risk of these programs are here, and here.

    I would strongly recommend that you uninstall them, and read the links above for educational value!

    Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.
     
    Admin.,
    #5
  7. 2010/06/13
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    Hey,

    I downloaded malwarebytes and it seems to keep freezing each time it gets to a certain point in the scan. Are there any other ways to go about this?

    Thanks for the help.
     
    hel,
    #6
  8. 2010/06/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I assume, you've read Arie's post?

    Now...

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.pif
    * Rkill.exe


    • * Double-click on the Rkill desktop icon to run the tool.
      * If using Vista or Windows 7 right-click on it and choose Run As Administrator.
      * A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
      * If not, delete the file, then download and use the one provided in Link 2.
      * If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
      * Do not reboot until instructed.
      * If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run then try to immediately run the following.

    Now download and run exeHelper.


    • * Please download exeHelper from Raktor to your desktop.
      * Double-click on exeHelper.com to run the fix.
      * A black window should pop up, press any key to close once the fix is completed.
      * A log file named log.txt will be created in the directory where you ran exeHelper.com
      * Attach the log.txt file to your next message.

    Note: If the window shows a message that says "Error deleting file ", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

    ===========================================================

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #7
  9. 2010/06/13
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    Yes, I have read the message.



    exeHelper will not open after I saved it to my desktop. I've run rkill just fine. But, this won't work.
     
    hel,
    #8
  10. 2010/06/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    See, if you can run OTL (my reply #4).
     
    broni,
    #9
  11. 2010/06/13
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    That will not work either.
     
    hel,
    #10
  12. 2010/06/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Let's see, if we can look at your computer booting from an external source.

    Please download OTLPE (filesize 120,9 MB)

    • When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
    • Reboot your system using the boot CD you just created.
      • Note : If you do not know how to set your computer to boot from CD follow the steps here
    • Your system should now display a REATOGO-X-PE desktop.
    • Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
    • Double-click on the OTLPE icon.
    • Ensure the box "Automatically Load All Remaining Users" is checked and press OK
    • OTL should now start.
    • Press Run Scan to start the scan.
    • When finished, the file will be saved in drive C:\OTL.txt
    • Copy this file to your USB drive if you do not have internet connection on this system
    • Please post the contents of the OTL.txt file in your reply.
     
    broni,
    #11
  13. 2010/06/13
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    Alright. Thank you for the help.

    I have to go and get a blank CD and don't want to keep you waiting for my reply. So, I will be back when I have the CD and I've tried it out.
     
    hel,
    #12
  14. 2010/06/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Not a problem :)
     
    broni,
    #13
  15. 2010/06/15
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    My apologies for the long wait. I had other matters to attend to.

    After trying to burn the information onto the CD with the program about 2 times, it failed.

    Is there any other direction to go from here?

    There's nothing wrong with the CD at all; It's blank.
     
    hel,
    #14
  16. 2010/06/15
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I need more details.
    What exactly did fail?
     
    broni,
    #15
  17. 2010/06/16
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    It says:

    Please insert a disc into drive E. The blank disc is already inside. I've took it out and reinserted it again and again, and it still won't read. I'm 100% sure it's blank.
     
    hel,
    #16
  18. 2010/06/16
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Try another computer to create OTLPE CD.
     
    broni,
    #17
  19. 2010/06/17
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    I do not have another computer.
     
    hel,
    #18
  20. 2010/06/17
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ask a friend, or family member. I don't see any other way to create that CD and we need it.
     
    broni,
    #19
  21. 2010/06/23
    hel

    hel Inactive Thread Starter

    Joined:
    2010/06/12
    Messages:
    11
    Likes Received:
    0
    Well, just wanted to come back and say there is no where for me to go and I appreciate your help. But you can close the topic now. There's no where for me to go to fix this computer, hopefully I'll get a new one relatively soon.

    Thanks again.
     
    hel,
    #20
Page 1 of 2
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...