1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Inactive how to delete Alot

Discussion in 'Malware and Virus Removal Archive' started by pegmorell, 2012/05/10.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. 2012/05/10
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    [Inactive] how to delete Alot

    A toolbar named "Alot" has appeared in my Firefox. I use Vista and have Trend Micro Titanium Maximum Security. I tried deleting the listed "Alot Toolbar" in Control Panel, re-booted and it's still there.

    I googled "Delete Alot" and came up with some files to delete it, but Trend Micro says they're dangerous. There are programs to download to get rid of it, but I'm not sure what they are.

    I would like it gone completely. Trend Micro does not list it in their frequently asked questions.
     
    pegmorell,
    #1
  2. 2012/05/10
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    Hi,

    Read this post as indicated at the top of this forum & follow the instructions.
     
    Admin.,
    #2


  3. to hide this advert.

  4. 2012/05/11
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    can't delete Alot

    Windows Vista, Firefox, Trend Micro Titanium, Used Control Panel to remove Alot Toolbar.Alot is still there, though the listing is gone from control panel.

    I did the mban-setup.exe, which ran but closed at the end of scan. Surprise. I did it twice. No log. I looked where you sai, but still no log.

    Same with gmer. there was a message like "didn't find system change" and no log. I was going to do it again to see the exact message, but decided to check in to see if I'm doing something wrong.

    I turned off Windows Firewall. Trend Micro has a booster, but it was off too. If I have another firewall, I don't know it.

    Shall I continue with step 3?
     
    pegmorell,
    #3
  5. 2012/05/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ======================================================

    Go ahead...
     
    broni,
    #4
  6. 2012/05/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Do NOT create another topic in random forum to post another log.

    I'm copying your aswMBR log here.
    Post other logs right in this topic...

    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-05-11 18:16:20
    -----------------------------
    18:16:20.743 OS Version: Windows x64 6.0.6002 Service Pack 2
    18:16:20.743 Number of processors: 4 586 0xF0B
    18:16:20.743 ComputerName: MARGARET-PC UserName: Margaret
    18:16:22.880 Initialize success
    18:16:33.556 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    18:16:33.556 Disk 0 Vendor: WDC_WD6400AAKS-75A7B0 01.03B01 Size: 610480MB BusType: 3
    18:16:33.572 Disk 0 MBR read successfully
    18:16:33.572 Disk 0 MBR scan
    18:16:33.572 Disk 0 Windows XP default MBR code
    18:16:33.572 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63
    18:16:33.587 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 2048 MB offset 98304
    18:16:33.603 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 608383 MB offset 4292608
    18:16:33.634 Disk 0 scanning C:\Windows\system32\drivers
    18:16:40.326 Service scanning
    18:16:52.760 Modules scanning
    18:16:52.760 Disk 0 trace - called modules:
    18:16:52.775 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
    18:16:52.775 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80074a1680]
    18:16:52.791 3 CLASSPNP.SYS[fffffa6000dcdc33] -> nt!IofCallDriver -> [0xfffffa8006121930]
    18:16:52.791 5 acpi.sys[fffffa60008fefde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8006128590]
    18:16:52.806 Scan finished successfully
    18:17:19.701 Disk 0 MBR has been saved successfully to "C:\Users\Margaret\Documents\MBR.dat "
    18:17:19.716 The log file has been saved successfully to "C:\Users\Margaret\Documents\aswMBR.txt "
    18:17:36.728 Disk 0 MBR has been saved successfully to "C:\Users\Margaret\Desktop\MBR.dat "
    18:17:36.744 The log file has been saved successfully to "C:\Users\Margaret\Desktop\aswMBR.txt "
     
    broni,
    #5
  7. 2012/05/11
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    Thanks for moving the log. I guess I wasn't paying attention when I got it into Other software.
     
    pegmorell,
    #6
  8. 2012/05/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Go on....
     
    broni,
    #7
  9. 2012/05/11
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
    Run by Margaret at 20:57:43 on 2012-05-11
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6132.3858 [GMT -7:00]
    .
    AV: Titanium Maximum Security *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
    SP: Titanium Maximum Security *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RAVCpl64.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\WindowsMobile\wmdSync.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Windows\ehome\ehtray.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
    C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
    C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
    C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Registry Mechanic\RMTray.exe
    C:\Program Files (x86)\Skype\Phone\Skype.exe
    C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
    C:\Program Files (x86)\WinTV\Ir.exe
    C:\Program Files (x86)\Digital Line Detect\DLG.exe
    C:\Program Files (x86)\Stardock\Impulse\Now\ImpulseNow.exe
    C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
    C:\Windows\Samsung\PanelMgr\SSMMgr.exe
    C:\Windows\Samsung\PanelMgr\caller64.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\SysWOW64\UTSCSI.EXE
    C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio64.exe
    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
    C:\Windows\system32\svchost.exe -k WindowsMobile
    C:\Windows\ehome\ehsched.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\ehome\ehRecvr.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Users\Margaret\Desktop\aswMBR.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uSearch Page = hxxp://www.google.com
    uStart Page = hxxp://www.yahoo.com
    uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8
    uWindow Title = Windows Internet Explorer provided by Yahoo!
    mStart Page = hxxp://www.yahoo.com
    mDefault_Page_URL = hxxp://www.yahoo.com
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
    uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
    mWinlogon: Userinit=userinit.exe
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg32.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    BHO: TSToolbarBHO: {43c6d902-a1c5-45c9-91f6-fd9e90337e18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll
    BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll
    TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
    TB: Trend Micro Toolbar: {ccac5586-44d7-4c43-b64a-f042461a97d2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB: {968631B6-4729-440D-9BF4-251F5593EC9A} - No File
    uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
    uRun: [EPSON Stylus Photo RX595 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATICLA.EXE /FU "C:\Windows\TEMP\E_SE178.tmp" /EF "HKCU "
    uRun: [cdloader] "C:\Users\Margaret\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
    uRun: [RegistryMechanic] C:\Program Files (x86)\Registry Mechanic\RMTray.exe /H
    uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
    uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
    mRun: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
    mRun: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe /autorun
    mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
    mRun: [RecoverFromReboot] C:\Windows\Temp\RecoverFromReboot.exe
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe "
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
    mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    StartupFolder: C:\Users\Margaret\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\IMPULS~1.LNK - C:\Program Files (x86)\Stardock\Impulse\Now\ImpulseNow.exe
    StartupFolder: C:\Users\Margaret\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
    StartupFolder: C:\Users\Margaret\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\AUTOST~1.LNK - C:\Program Files (x86)\WinTV\Ir.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DIGITA~1.LNK - C:\Program Files (x86)\Digital Line Detect\DLG.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
    Trusted Zone: nexon.net\card
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
    TCP: DhcpNameServer = 68.94.156.1 68.94.157.1
    TCP: Interfaces\{8693CA0E-17A1-421C-BA80-1E375C5DC24C} : DhcpNameServer = 68.94.156.1 68.94.157.1
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
    Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
    Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg32.dll
    Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll
    Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll
    BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
    BHO-X64: 0x1 - No File
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg32.dll
    BHO-X64: Trend Micro NSC BHO - No File
    BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    BHO-X64: TSToolbarBHO: {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll
    BHO-X64: Trend Micro Toolbar BHO - No File
    BHO-X64: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
    BHO-X64: NCO 2.0 IE BHO - No File
    BHO-X64: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
    BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO-X64: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: SkypeIEPluginBHO - No File
    BHO-X64: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll
    BHO-X64: TmBpIeBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll
    TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn4\yt.dll
    TB-X64: Trend Micro Toolbar: {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll
    TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB-X64: {968631B6-4729-440D-9BF4-251F5593EC9A} - No File
    mRun-x64: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
    mRun-x64: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe /autorun
    mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
    mRun-x64: [RecoverFromReboot] C:\Windows\Temp\RecoverFromReboot.exe
    mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe "
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
    mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Margaret\AppData\Roaming\Mozilla\Firefox\Profiles\6ylrgk08.default\
    FF - prefs.js: browser.search.selectedEngine - ALOT Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.alothome.com/en
    FF - prefs.js: keyword.URL - hxxp://search.alot.com/web?src_id=30028&client_id=8c6904b878f434f436680a98&camp_id=4713&install_time=2012-05-09T16:10:10Z&pr=auto&tb_version=1.0.17000(G)&q=
    FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
    FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
    FF - component: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1464\6.6.1079\firefoxextension\components\TmFFExt.dll
    FF - component: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\ToolbarFFHelper.dll
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
    FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPCIG.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npViewpoint.dll
    FF - plugin: C:\Program Files (x86)\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    FF - plugin: c:\program files\real\realplayer\Netscape6\nppl3260.dll
    FF - plugin: c:\program files\real\realplayer\Netscape6\nprjplug.dll
    FF - plugin: c:\program files\real\realplayer\Netscape6\nprpjplug.dll
    FF - plugin: C:\Users\Margaret\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
    FF - plugin: C:\Users\Margaret\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: network.cookie.cookieBehavior - 0
    FF - user.js: privacy.clearOnShutdown.cookies - false
    FF - user.js: security.warn_viewing_mixed - false
    FF - user.js: security.warn_viewing_mixed.show_once - false
    FF - user.js: security.warn_submit_insecure - false
    FF - user.js: security.warn_submit_insecure.show_once - false
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
    R2 Amsp;Trend Micro Solution Platform;C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe [2010-9-16 256336]
    R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-5-11 654408]
    R2 SSPORT;SSPORT;\??\C:\Windows\system32\Drivers\SSPORT.sys --> C:\Windows\system32\Drivers\SSPORT.sys [?]
    R2 tmevtmgr;tmevtmgr;C:\Windows\system32\DRIVERS\tmevtmgr.sys --> C:\Windows\system32\DRIVERS\tmevtmgr.sys [?]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe [2008-8-5 24652]
    R3 CAXHWBS2;CAXHWBS2;C:\Windows\system32\DRIVERS\CAXHWBS2.sys --> C:\Windows\system32\DRIVERS\CAXHWBS2.sys [?]
    R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate1ca711b95076331;Google Update Service (gupdate1ca711b95076331);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-11-29 133104]
    S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-11-29 133104]
    S3 lvpopf64;Logitech POP Suppression Filter;C:\Windows\system32\DRIVERS\lvpopf64.sys --> C:\Windows\system32\DRIVERS\lvpopf64.sys [?]
    S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?]
    S3 LVUVC64;Logitech HD Webcam C270(UVC);C:\Windows\system32\DRIVERS\lvuvc64.sys --> C:\Windows\system32\DRIVERS\lvuvc64.sys [?]
    S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-25 129976]
    S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
    S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2010-4-16 89920]
    .
    =============== File Associations ===============
    .
    JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
    .
    =============== Created Last 30 ================
    .
    2012-05-11 20:28:02 -------- d-----w- C:\Users\Margaret\AppData\Roaming\Malwarebytes
    2012-05-11 20:27:47 -------- d-----w- C:\ProgramData\Malwarebytes
    2012-05-11 20:27:46 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2012-05-11 20:27:46 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-05-11 02:40:43 1423744 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2012-05-11 02:38:40 4699520 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2012-05-11 02:38:40 2766848 ----a-w- C:\Windows\System32\win32k.sys
    2012-05-08 15:10:44 8917360 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{AEB81B33-B707-463E-AF5A-4D6AA03467F5}\mpengine.dll
    2012-04-25 19:37:59 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
    2012-04-25 19:37:53 157352 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
    2012-04-25 19:37:53 129976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
    2012-04-12 14:29:16 78848 ----a-w- C:\Windows\System32\imagehlp.dll
    2012-04-12 14:29:16 5632 ----a-w- C:\Windows\System32\wmi.dll
    2012-04-12 14:29:16 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
    2012-04-12 14:29:16 219136 ----a-w- C:\Windows\System32\wintrust.dll
    2012-04-12 14:29:16 172032 ----a-w- C:\Windows\SysWow64\wintrust.dll
    2012-04-12 14:29:16 16384 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
    2012-04-12 14:29:16 157696 ----a-w- C:\Windows\SysWow64\imagehlp.dll
    .
    ==================== Find3M ====================
    .
    2012-03-20 23:34:30 72576 ----a-w- C:\Windows\System32\drivers\partmgr.sys
    2012-03-01 15:39:45 327680 ----a-w- C:\Windows\System32\d3d10_1core.dll
    2012-03-01 15:39:45 196096 ----a-w- C:\Windows\System32\d3d10_1.dll
    2012-03-01 14:46:01 219648 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
    2012-03-01 14:46:01 160768 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
    2012-02-29 14:40:31 2002944 ----a-w- C:\Windows\System32\d3d10warp.dll
    2012-02-29 14:09:35 834048 ----a-w- C:\Windows\System32\d2d1.dll
    2012-02-29 14:08:47 1172480 ----a-w- C:\Windows\SysWow64\d3d10warp.dll
    2012-02-29 14:06:08 1556480 ----a-w- C:\Windows\System32\DWrite.dll
    2012-02-29 13:44:50 683008 ----a-w- C:\Windows\SysWow64\d2d1.dll
    2012-02-29 13:41:40 1069056 ----a-w- C:\Windows\SysWow64\DWrite.dll
    2012-02-28 06:56:48 2311168 ----a-w- C:\Windows\System32\jscript9.dll
    2012-02-28 06:49:56 1390080 ----a-w- C:\Windows\System32\wininet.dll
    2012-02-28 06:48:57 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl
    2012-02-28 06:42:55 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
    2012-02-28 01:18:55 1799168 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2012-02-28 01:11:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
    2012-02-28 01:11:07 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll
    2012-02-28 01:03:16 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2012-02-23 17:18:36 279656 ------w- C:\Windows\System32\MpSigStub.exe
    .
    ============= FINISH: 20:58:29.04 ===============
     
    pegmorell,
    #8
  10. 2012/05/11
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    I have zipped the file "attach.txt to attach.zip, but I don't know how to get it into the Reply window. When I try to move it, it thinks I want to open it. Help please.
     
    pegmorell,
    #9
  11. 2012/05/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Out instruction (pay attention) specifically say not to zip anything but post Attach.txt as a straight text file.
     
    broni,
    #10
  12. 2012/05/11
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    duplicate
     
    Last edited by a moderator: 2012/05/12
    pegmorell,
    #11
  13. 2012/05/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You posted DDS.txt for the second time.
    I need Attach.txt log.

    [​IMG]
     
    broni,
    #12
  14. 2012/05/11
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    alot logs

    duplicate
     
    Last edited by a moderator: 2012/05/12
    pegmorell,
    #13
  15. 2012/05/11
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    attach.txt

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume3
    Install Date: 6/17/2008 6:10:31 PM
    System Uptime: 5/11/2012 2:15:10 PM (6 hours ago)
    .
    Motherboard: Dell Inc. | | 0FM586
    Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/266mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 594 GiB total, 201.75 GiB free.
    D: is FIXED (NTFS) - 2 GiB total, 1.002 GiB free.
    E: is CDROM ()
    G: is Removable
    H: is Removable
    I: is Removable
    J: is Removable
    K: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP1701: 4/15/2012 12:01:01 PM - TITANUIMRES[0x10001101]
    RP1702: 4/16/2012 8:29:01 AM - Windows Update
    RP1703: 4/17/2012 7:45:02 AM - Windows Update
    RP1704: 4/17/2012 7:50:39 AM - Windows Update
    RP1705: 4/18/2012 8:18:27 AM - Windows Update
    RP1706: 4/18/2012 9:27:55 PM - Scheduled Checkpoint
    RP1707: 4/19/2012 8:09:08 AM - Windows Update
    RP1708: 4/20/2012 7:38:44 AM - Windows Update
    RP1709: 4/20/2012 7:43:38 AM - Windows Update
    RP1710: 4/21/2012 7:52:48 AM - Windows Update
    RP1711: 4/22/2012 8:25:19 AM - Windows Update
    RP1712: 4/23/2012 7:28:53 AM - Windows Update
    RP1713: 4/24/2012 2:49:06 PM - Windows Update
    RP1714: 4/24/2012 2:55:34 PM - Windows Update
    RP1715: 4/25/2012 7:55:22 AM - Windows Update
    RP1716: 4/26/2012 7:14:17 AM - Windows Update
    RP1717: 4/27/2012 8:05:58 AM - Windows Update
    RP1718: 4/27/2012 8:11:52 AM - Windows Update
    RP1719: 4/28/2012 8:03:54 AM - Windows Update
    RP1720: 4/29/2012 7:58:47 AM - Windows Update
    RP1721: 4/30/2012 8:03:32 AM - Windows Update
    RP1722: 5/1/2012 7:57:06 AM - Windows Update
    RP1723: 5/1/2012 8:03:29 AM - Windows Update
    RP1724: 5/2/2012 8:08:22 AM - Windows Update
    RP1725: 5/3/2012 8:15:27 AM - Windows Update
    RP1726: 5/4/2012 8:33:28 AM - Windows Update
    RP1727: 5/4/2012 8:40:26 AM - Windows Update
    RP1728: 5/5/2012 9:39:26 AM - Windows Update
    RP1729: 5/6/2012 12:23:27 PM - Windows Update
    RP1730: 5/7/2012 3:32:19 AM - Windows Update
    RP1731: 5/8/2012 8:01:11 AM - Windows Update
    RP1732: 5/8/2012 8:09:33 AM - Windows Update
    RP1733: 5/9/2012 7:29:11 AM - Windows Update
    RP1734: 5/10/2012 10:41:20 AM - Scheduled Checkpoint
    RP1735: 5/11/2012 7:53:27 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.4.6
    AIM 6
    Apple Application Support
    Apple Software Update
    ArcSoft PhotoImpression 6
    CANON iMAGE GATEWAY Task for ZoomBrowser EX
    Canon Internet Library for ZoomBrowser EX
    Canon MOV Decoder
    Canon Utilities CameraWindow
    Canon Utilities CameraWindow DC
    Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    Canon Utilities Digital Photo Professional 3.5
    Canon Utilities MyCamera
    Canon Utilities MyCamera DC
    Canon Utilities PhotoStitch
    Canon Utilities RemoteCapture DC
    Canon Utilities RemoteCapture Task for ZoomBrowser EX
    Canon Utilities ZoomBrowser EX
    Canon ZoomBrowser EX Memory Card Utility
    Cisco Connect
    Compatibility Pack for the 2007 Office system
    Cooking Dash (remove only)
    Dell Getting Started Guide
    Digital Line Detect
    Disney Toontown Online
    EPSON RX595 User's Guide
    EPSON Scan
    Fences
    Fences (Free)
    Finding Nemo: Nemo's Underwater World of Fun Special Edition
    Google Chrome
    Google Earth Plug-in
    Google Toolbar for Internet Explorer
    Google Update Helper
    Hauppauge English Help Files and Resources
    Hauppauge MCE XP/Vista Software Encoder (2.0.26057)
    Hauppauge WinTV
    Hauppauge WinTV Infrared Remote
    Hauppauge WinTV Scheduler
    Hauppauge WinTV Soft PVR
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    iPhone Configuration Utility
    Japanese Fonts Support For Adobe Reader 9
    Java Auto Updater
    Java(TM) 6 Update 29
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Jigsaw Puzzles - Parks of the World
    magicJack
    magicJack Recovery Tool 1.0
    Malwarebytes Anti-Malware version 1.61.0.1400
    Microsoft Office 2007 Service Pack 3 (SP3)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office File Validation Add-In
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    Move Media Player
    Mozilla Firefox 12.0 (x86 en-US)
    Mozilla Maintenance Service
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    NetWaiting
    OpenOffice.org Installer 1.0
    Quicken 2008
    QuickTime
    RealPlayer
    Realtek High Definition Audio Driver
    Registry Mechanic 8.0
    Roxio Creator Audio
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio Update Manager
    Safari
    Samsung CLP-310 Series
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
    Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
    Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
    Skype Toolbars
    Skype™ 5.1
    Spelling Dictionaries Support For Adobe Reader 8
    Stardock Impulse
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 Help (KB963665)
    Viewpoint Media Player
    VLC media player 1.1.6
    Windows Live installer
    Windows Live Messenger
    Windows Media Player Firefox Plugin
    Yahoo! Software Update
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    5/4/2012 8:30:57 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds)

    while waiting for the Windows Font Cache Service service to connect.
    5/4/2012 8:30:57 AM, Error: Service Control Manager [7000] - The Windows Font Cache Service service failed

    to start due to the following error: The service did not respond to the start or control request in a

    timely fashion.
    5/11/2012 8:13:59 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds)

    while waiting for the Windows Search service to connect.
    5/11/2012 8:13:59 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start

    due to the following error: The service did not respond to the start or control request in a timely

    fashion.
    5/11/2012 8:12:34 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows

    failed to install the following update with error 0x80070643: Security Update for Microsoft Works 9

    (KB2680317).
    5/11/2012 7:57:37 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting

    to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-

    5C22C517CE39}
    5/11/2012 2:17:19 PM, Error: Service Control Manager [7000] - The DgiVecp service failed to start due to

    the following error: The system cannot find the file specified.
    .
    ==== End Of File ===========================
     
    pegmorell,
    #14
  16. 2012/05/12
    Evan Omo

    Evan Omo Computer Support Technician Staff

    Joined:
    2006/09/10
    Messages:
    7,919
    Likes Received:
    511
    Peg, stop creating new threads just to post new logs. Post any new logs in your existing thread. Broni is going to have to merge this thread with your orignal thread so please pay attention and keep your logs to one thread.

    Thanks.
     
    Evan Omo,
    #15
  17. 2012/05/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/


    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • Super should automatically the program definitions. If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    • Close SUPERAntiSpyware.
    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    • Open SUPERAntiSpyware.
    • Click on "Preferences" button.
    • Click the "Scanning Control" tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
    • Click the "Home" button to leave the control center screen.
    • Back on the main screen checkmark "Complete scan" and click "Scan your computer ".
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK ".
    • Make sure everything has a checkmark next to it and click "Next ".
    • A notification will appear that "Quarantine and Removal is Complete ". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes ".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Copy and paste the Scan Log results in your next reply with a new HijackThis log.
    • Click Close to exit the program.

    Post SUPERAntiSpyware log.
     
    broni,
    #16
  18. 2012/05/12
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    I guess I misread this. What else do I need to do? I realize I'm not the best client (or whatever I am) but I do appreciate your help.

    STEP 5.

    Start a new topic in our Malware and Virus Removal forum and provide following logs:

    Malwarebytes (MBAM)
    GMER
    MBRCheck
    DDS(2 logs)
     
    pegmorell,
    #17
  19. 2012/05/12
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    I wish I was a t the beach
     
    Last edited: 2012/05/12
    pegmorell,
    #18
  20. 2012/05/12
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    step 5 says create a new thread and post 4 files. What should I do next?
     
    pegmorell,
    #19
  21. 2012/05/12
    pegmorell

    pegmorell Inactive Thread Starter

    Joined:
    2005/04/09
    Messages:
    75
    Likes Received:
    0
    step 5 said to create a new topic and send longs. I sent the ones I had. What should I do now?
     
    pegmorell,
    #20
Page 1 of 2
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...