Computer Hope

Software => Computer viruses and spyware => Topic started by: tschriber on December 02, 2008, 07:43:50 AM

Title: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 07:43:50 AM
I am using Vista Home Edition on a Dell Inspiron laptop.  I was trying to upload pics on a family website.  I uploaded a few then wasn't able to anymore.  I was able to select the pics I wanted to upload but when I tried to open them to the uploader, nothing happens.  Then I got a message that said ... snapin.js Failed to Load.  I did a search on this and the only thing that came up was information on a vundo trojan horse virus.  I read more on the topic, but my computer is not doing what the info says it should do if I have the virus except that often pages cannot be found, which I thought was because of my firewall.  Does the message mean that Java is failing to load?  If so, should I uninstall and reinstall?  Does it sound like I have a virus?  My virus scan isn't showing anything.
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 02, 2008, 04:12:53 PM
.js is a Java file. What version of Java do you have installed? The most recent is Sun Java Runtime Environment 6 Update 11 http://www.majorgeeks.com/Sun_Java_Runtime_Environment_d4648.html

You might also check with the Secunia Online Software Inspector to make sure nothing is out of date. http://secunia.com/vulnerability_scanning/online/

Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 05:05:25 PM
I have Java 6 Update 5... so if I update, should that take care of the uploading problem?
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 02, 2008, 05:11:14 PM
Update to the new version then check add/remove programs and uninstall all but Java 6 Update 11.

I'm not sure if it will fix it but it's a place to start.

Post a HijackThis log also so we can have a quick look for infections.

Download TrendMicro HijackThis.exe (http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe) (HJT) to the Desktop.

Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 05:12:47 PM
I tried to update Java but get a message that says  "Another program is being installed.  Please wait until that installation is comlplete, then try installing this software again."  I have gotten that message before, but I am not installing anything.  Thnks, by the way, for the help.  I do appreciate it.
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 02, 2008, 05:14:51 PM
Post the HJT log and we will go from there.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 05:41:09 PM
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:36:48 PM, on 12/2/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/VistaMSNPUplden-us.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{293AEFA6-5DB0-4D09-900D-D8F667B7A710}: NameServer = 198.6.100.218 198.6.1.218
O17 - HKLM\System\CS1\Services\Tcpip\..\{293AEFA6-5DB0-4D09-900D-D8F667B7A710}: NameServer = 198.6.100.218 198.6.1.218
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8273 bytes
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 02, 2008, 05:51:38 PM
Uninstall LimeWire. It doesn't need to run at startup and uses Java. Could be a conflict.

After uninstalling LimeWire restart the computer.'

Download Malwarebytes' Anti-Malware (MBAM) (http://www.besttechie.net/tools/mbam-setup.exe)

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 06:39:26 PM
Malware scan found nothing.  Here is the log.

Malwarebytes' Anti-Malware 1.30
Database version: 1450
Windows 6.0.6000

12/2/2008 7:35:48 PM
mbam-log-2008-12-02 (19-35-48).txt

Scan type: Quick Scan
Objects scanned: 43790
Time elapsed: 2 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 02, 2008, 08:20:22 PM
Try to install the new Java again.

Be sure to close all web browsers before starting the install.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 08:47:04 PM
Java seems to be downloading okay now.  I live in a rural area and have to have dial up so its very slow but it seems to be working.  Does this mean that I won't be able to have Limewire now?  And when I'm finished, do I delete the HijackThis and Anti-malwarebyte programs or keep them around?  Thank you so much for all your help!!!
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 08:57:10 PM
Okay, Java still would not download.  It still says that another program is being installed and I need to wait until that program finishes installing.  I am not installing anything.  What now?
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 02, 2008, 09:15:39 PM
You can put Limewire back on but it doesn't need to be running at startup.

Go here https://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/ViewFilteredProducts-SingleVariationTypeFilter

Choose the Windows Offline Installation file and see if you can install that.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 09:44:09 PM
The product requested at that link is not available at the time
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 02, 2008, 10:24:13 PM
Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link #2 (http://subs.geekstogo.com/ComboFix.exe)

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 10:39:21 PM
Okay, going to try the next step.  I did go to the Java website and found the error message I had been getting, 1500 error message.  It said that this could be because of an earlier installation that had been aborted before it was finished and to install microsoft installation clean up utility to clean it but when I try to install it I get the same message and can't install.  Hope this next step works.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 02, 2008, 10:53:06 PM
Okay, I went to Java and found the error message I had been getting... 1500 error message.  It said that this is most likely caused be an earlier installation of a program that was aborted before installation was completed.  It said to install Microsoft installation clean up utility and run it but when I try to install it I get the same message. :-X  I'm going to try the next step but probably won't get to it tonight.  I'm burned out.  I'll try tomorrow.  Thanks again for all of your help.
Title: Re: snapin.js Failed to Load
Post by: BC_Programmer on December 02, 2008, 11:28:52 PM
Quote from: evilfantasy on December 02, 2008, 04:12:53 PM
.js is a Java file. What version of Java do you have installed? The most recent is Sun Java Runtime Environment 6 Update 11 http://www.majorgeeks.com/Sun_Java_Runtime_Environment_d4648.html

You might also check with the Secunia Online Software Inspector to make sure nothing is out of date. http://secunia.com/vulnerability_scanning/online/



.js is javascript, not java- it doesn't use the java run-time and rather is a client-side scripting solution interpreted by the browser. IE uses the Active Scripting Host to interpret all script code, which in turn uses jscript.dll to parse/interpret the javascript files. In a Similar vein, VBScript is not Visual Basic.

Java files would be .java (source) and .class, (as well as .jar, and probably some I missed).


The fix for this problem might be to re-register the jscript.dll file. How it would have gotten unregistered is a mystery.

re-registering would be performed by running the command "regsvr32 jscript.dll"

Title: Re: snapin.js Failed to Load
Post by: tschriber on December 03, 2008, 10:21:11 PM
I have ran the combofix and hifack this but now it won't let me back on the web to post the log.  I am connected to the internet but it will not load a page... any page!
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 03, 2008, 10:31:13 PM
ComboFix 08-12-02.02 - Teresa 2008-12-03 23:02:09.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.1.1033.18.1063 [GMT -6:00]
Running from: c:\users\Teresa\Desktop\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2008-11-04 to 2008-12-04  )))))))))))))))))))))))))))))))
.

2008-12-03 22:32 . 2008-12-03 22:32   <DIR>   d--------   c:\windows\Sun
2008-12-02 19:23 . 2008-12-02 19:23   <DIR>   d--------   c:\users\Teresa\AppData\Roaming\Malwarebytes
2008-12-02 19:23 . 2008-12-02 19:23   <DIR>   d--------   c:\users\All Users\Malwarebytes
2008-12-02 19:23 . 2008-12-02 19:23   <DIR>   d--------   c:\programdata\Malwarebytes
2008-12-02 19:23 . 2008-12-02 19:23   <DIR>   d--------   c:\program files\Malwarebytes' Anti-Malware
2008-12-02 19:23 . 2008-10-22 16:10   38,496   --a------   c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-02 19:23 . 2008-10-22 16:10   15,504   --a------   c:\windows\System32\drivers\mbam.sys
2008-12-02 18:36 . 2008-12-02 18:36   <DIR>   d--------   c:\program files\Trend Micro
2008-11-29 04:36 . 2008-11-29 04:36   <DIR>   d--------   c:\users\All Users\Symantec
2008-11-29 04:36 . 2008-11-29 04:36   <DIR>   d--------   c:\programdata\Symantec
2008-11-27 16:42 . 2008-11-27 16:42   <DIR>   d--------   c:\users\Teresa\AppData\Roaming\CyberLink
2008-11-26 22:28 . 2008-10-21 21:43   241,152   --a------   c:\windows\System32\PortableDeviceApi.dll
2008-11-26 22:28 . 2008-10-21 21:43   160,768   --a------   c:\windows\System32\PortableDeviceTypes.dll
2008-11-26 22:28 . 2008-10-21 21:43   95,232   --a------   c:\windows\System32\PortableDeviceClassExtension.dll
2008-11-26 22:27 . 2008-08-27 21:24   712,192   --a------   c:\windows\System32\WindowsCodecs.dll
2008-11-26 22:27 . 2008-08-27 21:24   425,472   --a------   c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 22:27 . 2008-08-27 21:24   347,136   --a------   c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 22:06 . 2008-10-20 23:16   1,645,568   --a------   c:\windows\System32\connect.dll
2008-11-23 23:32 . 2008-12-03 22:34   <DIR>   d--------   c:\program files\Norton Security Scan
2008-11-23 23:32 . 2008-11-29 08:39   <DIR>   d--------   c:\program files\Common Files\Symantec Shared
2008-11-23 22:43 . 2008-12-01 21:02   <DIR>   d--------   c:\users\All Users\Google Updater
2008-11-23 22:43 . 2008-12-01 21:02   <DIR>   d--------   c:\programdata\Google Updater
2008-11-14 09:34 . 2008-10-16 15:13   1,809,944   --a------   c:\windows\System32\wuaueng.dll
2008-11-14 09:34 . 2008-10-16 14:56   1,524,736   --a------   c:\windows\System32\wucltux.dll
2008-11-14 09:34 . 2008-10-16 15:12   561,688   --a------   c:\windows\System32\wuapi.dll
2008-11-14 09:34 . 2008-10-16 14:55   83,456   --a------   c:\windows\System32\wudriver.dll
2008-11-14 09:34 . 2008-10-16 15:09   51,224   --a------   c:\windows\System32\wuauclt.exe
2008-11-14 09:34 . 2008-10-16 15:09   43,544   --a------   c:\windows\System32\wups2.dll
2008-11-14 09:34 . 2008-10-16 15:08   34,328   --a------   c:\windows\System32\wups.dll
2008-11-14 09:33 . 2008-10-16 14:08   162,064   --a------   c:\windows\System32\wuwebv.dll
2008-11-14 09:33 . 2008-10-16 13:56   31,232   --a------   c:\windows\System32\wuapp.exe
2008-11-13 19:54 . 2008-09-09 21:25   1,341,440   --a------   c:\windows\System32\msxml6.dll
2008-11-13 19:54 . 2008-09-09 21:21   2,048   --a------   c:\windows\System32\msxml6r.dll
2008-11-13 19:46 . 2008-08-25 19:11   211,456   --a------   c:\windows\System32\drivers\mrxsmb10.sys
2008-11-13 19:41 . 2008-09-04 22:48   1,194,496   --a------   c:\windows\System32\msxml3.dll
2008-11-13 19:41 . 2008-09-04 22:45   2,048   --a------   c:\windows\System32\msxml3r.dll
2008-11-07 15:58 . 2008-08-05 21:19   1,244,672   --a------   c:\windows\System32\mcmde.dll
2008-11-07 15:58 . 2008-08-05 21:27   428,032   --a------   c:\windows\System32\EncDec.dll
2008-11-07 15:58 . 2008-08-05 21:21   292,352   --a------   c:\windows\System32\psisdecd.dll
2008-11-07 15:58 . 2008-08-05 21:21   217,088   --a------   c:\windows\System32\psisrndr.ax
2008-11-07 15:58 . 2008-08-05 21:26   177,152   --a------   c:\windows\System32\mpg2splt.ax
2008-11-07 15:58 . 2008-08-05 21:20   80,896   --a------   c:\windows\System32\MSNP.ax
2008-11-07 15:58 . 2008-08-05 21:19   68,608   --a------   c:\windows\System32\Mpeg2Data.ax
2008-11-07 15:58 . 2008-08-05 21:19   57,856   --a------   c:\windows\System32\MSDvbNP.ax

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 04:35   ---------   d-----w   c:\users\Teresa\AppData\Roaming\LimeWire
2008-12-03 01:05   ---------   d-----w   c:\program files\LimeWire
2008-11-29 15:24   ---------   d-----w   c:\program files\Common Files\Adobe
2008-11-24 04:50   ---------   d-----w   c:\program files\Google
2008-11-24 02:56   ---------   d-----w   c:\programdata\McAfee
2008-11-24 02:56   ---------   d-----w   c:\program files\McAfee
2008-11-16 21:52   1,368   ----a-w   c:\users\Teresa\AppData\Roaming\wklnhst.dat
2008-10-21 03:18   ---------   d-----w   c:\programdata\Dell
2008-10-20 15:12   ---------   d-----w   c:\program files\Windows Mail
2008-10-02 03:49   826,368   ----a-w   c:\windows\System32\wininet.dll
2008-10-02 03:49   56,320   ----a-w   c:\windows\System32\iesetup.dll
2008-10-02 03:49   52,736   ----a-w   c:\windows\AppPatch\iebrshim.dll
2008-10-02 03:48   26,624   ----a-w   c:\windows\System32\ieUnatt.exe
2008-09-18 04:35   3,505,208   ----a-w   c:\windows\System32\ntkrnlpa.exe
2008-09-18 04:35   3,470,904   ----a-w   c:\windows\System32\ntoskrnl.exe
2008-09-18 02:03   2,027,520   ----a-w   c:\windows\System32\win32k.sys
2008-08-21 22:22   174   --sha-w   c:\program files\desktop.ini
2008-07-15 14:16   76   --sh--r   c:\windows\CT4CET.bin
2008-09-02 22:51   16,384   --sha-w   c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-09-02 22:51   32,768   --sha-w   c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-09-02 22:51   16,384   --sha-w   c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-23 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-24 159744]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-12-02 36864]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-01-01 405504]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-28 133656]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-05-19 3444736]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-07-15 29744]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-10 67488]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-07-15 50688]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-02-22 1193240]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-07-15 08:29 10536 c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{801B9625-A24B-45D4-8FBE-6420E1EAF859}"= c:\program files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect
"{00BCA362-2EB9-496E-8083-B3AEE8DCDC5F}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{42C42AD2-512B-493B-B732-C15ACB7E560E}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{A0C5762B-6DFB-429C-842D-028D124D4FF6}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{8B8C92C1-A8DD-4F82-A861-6F7EB28D0043}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{9EB28302-AE7A-4588-AD6A-5BF87ED34129}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{A3D04AF9-C798-4511-A5FC-DBCC9682FCC5}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{1C936232-0EEB-4ADA-9003-AF0B8F7AE7AB}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-10 124832]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2008-07-15 73728]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\DRIVERS\OEM02Dev.sys [2008-07-15 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\DRIVERS\OEM02Vfx.sys [2008-07-15 7424]
S3 GoToAssist;GoToAssist;"c:\program files\Citrix\GoToAssist\514\g2aservice.exe" Start=service [2008-07-15 16680]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-12-02 c:\windows\Tasks\Norton Security Scan for Teresa.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-03 23:04:09
Windows 6.0.6000  NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-12-03 23:04:58
ComboFix-quarantined-files.txt  2008-12-04 05:04:55

Pre-Run: 69,888,073,728 bytes free
Post-Run: 69,935,267,840 bytes free

154   --- E O F ---   2008-12-02 00:57:55



Title: Re: snapin.js Failed to Load
Post by: tschriber on December 03, 2008, 10:33:54 PM
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:36:48 PM, on 12/2/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/VistaMSNPUplden-us.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{293AEFA6-5DB0-4D09-900D-D8F667B7A710}: NameServer = 198.6.100.218 198.6.1.218
O17 - HKLM\System\CS1\Services\Tcpip\..\{293AEFA6-5DB0-4D09-900D-D8F667B7A710}: NameServer = 198.6.100.218 198.6.1.218
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8273 bytes
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 03, 2008, 10:48:27 PM
BC_Programmer,

To do that do I go to Accessories, Command Prompt... then what do I type?
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 03, 2008, 10:54:29 PM

Go Start > Run, type in:

cmd

Click OK.

Run following commands, hitting Enter after each one:

regsvr32 jscript.dll
regsvr32 vbscript.dll
regsvr32 /i mshtml.dll

Restart the PC and see if it works.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 04, 2008, 07:22:27 PM
i tried that and it didn't work.  are there any spaces when typing in the commands?
Title: Re: snapin.js Failed to Load
Post by: evilfantasy on December 04, 2008, 08:37:58 PM
Just copy each line and to paste it press ctrl and V both at the same time.
Title: Re: snapin.js Failed to Load
Post by: tschriber on December 04, 2008, 08:57:23 PM
After pasteing the first two commands, I got this message....The module "jscript.dll" was loaded but the call to DllRegisterServer failed with error code 0x80004005

I got this message after entering the last command...The module "mshtml.dll" was loaded but the entry-point DllRegisterServer was not found.

Make sure that "mshtml.dll" is a valid DLL or OCX file then try again.