Computer Hope
Software => Computer viruses and spyware => Topic started by: danldo on January 07, 2011, 10:57:31 AM
-
I am running Vista with IE9. I had some malware and I got rid of it, but now went I open Internet Explore a message pops up that says, Adobe Flash Player Installer/uninstaller 10.1 r102 has stopped working.
I have download the uninstall and install adobe program and they run to completion, but it will not work. I get the same message. I have uninstalled IE9 and rebooted, but still have this problem.
Here is the SuperAnti Spyware Log.
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 01/07/2011 at 07:42 AM
Application Version : 4.47.1000
Core Rules Database Version : 6154
Trace Rules Database Version: 3966
Scan type : Complete Scan
Total Scan Time : 02:27:42
Memory items scanned : 610
Memory threats detected : 0
Registry items scanned : 7847
Registry threats detected : 2
File items scanned : 249140
File threats detected : 134
Adware.Gamevance
HKCR\AppId\GamevanceText.DLL
HKCR\AppId\GamevanceText.DLL#AppID
Adware.Casino Games (Golden Palace Casino)
C:\BACKUP\08-01-31 1027AM\PROGRAM FILES\ACTIVISION VALUE\ACTIVISION VALUE CASINO\CASINO.EXE
C:\BACKUP\08-01-31 1027AM\USERS\OWNER\APPDATA\ROAMING\MICROSOFT\INSTALLER\{29B2BDE5-3585-11D5-888A-005004D128A9}\CASINO.EXE
Adware.Tracking Cookie
media.scanscout.com [ C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ESYY3ZJH ]
oddcast.com [ C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\ESYY3ZJH ]
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@247realmedia[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@2o7[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@adbrite[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@adinterax[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@adlegend[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@adrevolver[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][3].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@advertising[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@atdmt[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@atwola[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@bfast[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@bluestreak[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@burstnet[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@casalemedia[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@clickability[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@clickitsa[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@clickondetroit[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@collective-media[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@doubleclick[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@eyewonder[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@fastclick[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@hitbox[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@homefinderconnect[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@imrworldwide[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@insightexpressai[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@interclick[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@mediaplex[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@overture[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@partner2profit[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@questionmarket[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@realmedia[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@revsci[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][4].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@serving-sys[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@serving-sys[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@specificclick[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@statcounter[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@tacoda[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@trafficmp[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@tribalfusion[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\Low\owner@zedo[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@adlegend[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@adrevolver[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@advertising[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@atdmt[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@azjmp[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@bluestreak[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@doubleclick[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@imrworldwide[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@insightexpressai[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@mediaplex[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@nextag[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@questionmarket[1].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@serving-sys[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@tacoda[2].txt
C:\BACKUP\08-01-31 1027AM\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@zedo[2].txt
Trojan.Agent/Gen
C:\USERS\LINDA\APPDATA\ROAMING\INSTALL
-
Here is my Malwarebytes Log.
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5477
Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.7930.16406
1/7/2011 9:43:20 AM
mbam-log-2011-01-07 (09-43-20).txt
Scan type: Quick scan
Objects scanned: 145312
Time elapsed: 4 minute(s), 17 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
-
I tried to download Hijackthis and install, but I get The Sytem cannot open the device or file specified, with the option of retry or cancel
-
I downloaded the executable Hijackthis and this is the log.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:44:12 PM, on 1/7/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.7930.16406)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Linda\Documents\sniper.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.cnn.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = file://c:\windows\system32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
O4 - HKLM\..\Run: [RtHDVCpl] "C:\Windows\RtHDVCpl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe"
O4 - HKLM\..\Run: [WebrootTrayApp] "C:\Program Files\Webroot\Security\Current\Framework\WRTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /install /silent
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Linda\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\Security\current\plugins\antimalware\AEI.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Security\Current\Framework\WRConsumerService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 6109 bytes
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.
Link 1 (http://screen317.spywareinfoforum.org/SecurityCheck.exe)
Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)
* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.
Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
***************************************************
Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.
link # 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link # 2 (http://subs.geekstogo.com/ComboFix.exe)
Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.
Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of security programs that should be disabled and how to disable them.
Right-click combofix.exe and select Run as Administrator and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.
NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.
Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.