Computer Hope
Software => Computer viruses and spyware => Virus and spyware removal => Topic started by: ashton on May 31, 2012, 07:44:28 PM
-
I've had this computer for about 4 years now, and it only started to become really slow in the last year. It is constantly freezing, and closing me out of active programs. In addition, the system is very slow now. I've done several virus scans, and although they often find small things, the problem has never been corrected.
I've followed the steps asked prior to requesting help. The three necessary logs are pasted below:I've had this computer for about 4 years now, and it only started to become really slow in the last year. It is constantly freezing, and closing me out of active programs. In addition, the system is very slow now. I've done several virus scans, and although they often find small things, the problem has never been corrected.
I've followed the steps asked prior to requesting help. The three necessary logs are pasted below. Thank you for any assistance.
SAS:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 05/31/2012 at 05:04 PM
Application Version : 5.0.1150
Core Rules Database Version : 8650
Trace Rules Database Version: 6462
Scan type : Complete Scan
Total Scan Time : 01:13:50
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator
Memory items scanned : 592
Memory threats detected : 0
Registry items scanned : 65464
Registry threats detected : 0
File items scanned : 97554
File threats detected : 0
MBAM:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Database version: v2012.05.31.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
carol :: CAROL-PC [administrator]
5/31/2012 5:23:26 PM
mbam-log-2012-05-31 (17-23-26).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 220257
Time elapsed: 6 minute(s), 23 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 2
HKCR\Interface\{77777777-7777-7777-7777-770077227758} (Adware.GamePlayLab) -> Quarantined and deleted successfully.
HKCR\TypeLib\{44444444-4444-4444-4444-440044224458} (Adware.GamePlayLab) -> Quarantined and deleted successfully.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
DDS:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.1
Run by carol at 18:42:44 on 2012-05-31
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3003.2025 [GMT -7:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Windows\system32\svchost.exe -k HsfXAudioService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\SUPERAntiSpyware\c04aa76d-3d0d-4886-8491-310aaa7437f7.com
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskhost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\msiexec.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://us.mg6.mail.yahoo.com/neo/launch?.rand=88a4nbcku5gua
uDefault_Page_URL = hxxp://www.aol.com/?ncid=customie9
uWindow Title = Windows Internet Explorer provided by AOL
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
mWinlogon: Userinit=userinit.exe,
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
BHO: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
dRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11c_ActiveX.exe -update activex
dRunOnce: [DeleteEngineAfterUpdate] reg DELETE HKCU\Software\AppDataLow\Software\ConduitEngine /f
uPolicies-system: WallpaperStyle = 2
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
dPolicies-system: WallpaperStyle = 2
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C}\34C6162796F6E60243 : DhcpNameServer = 204.14.141.218 204.14.138.10
TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C}\34C6162796F6E60294E6E6 : DhcpNameServer = 10.10.10.254 8.8.8.8
TCP: Interfaces\{8D77C359-BFA5-49BF-A7ED-1E90DB9AFA9C}\D4F64756C60263 : DhcpNameServer = 10.128.128.128
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO-X64: HP Print Enhancer - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
BHO-X64: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
BHO-X64: Zynga - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files (x86)\Zynga\prxtbZyn2.dll
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\carol\AppData\Roaming\Mozilla\Firefox\Profiles\4j11x0zx.default\
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\NP2pEISb.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-4-3 63928]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-6-21 85560]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]
R2 HsfXAudioService;HsfXAudioService;C:\Windows\system32\svchost.exe -k HsfXAudioService [2009-7-13 20992]
R3 CAXHWAZL;CAXHWAZL;C:\Windows\system32\DRIVERS\CAXHWAZL.sys --> C:\Windows\system32\DRIVERS\CAXHWAZL.sys [?]
R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-8-17 227896]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys --> C:\Windows\system32\drivers\IntcHdmi.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-18 257696]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-31 129976]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
.
=============== Created Last 30 ================
.
2012-06-01 01:38:11 -------- d-----w- C:\Program Files (x86)\Oracle
2012-06-01 01:37:47 772504 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2012-05-31 22:33:55 -------- d-----w- C:\Users\carol\AppData\Roaming\OpenOffice.org
2012-05-31 22:29:16 -------- d-----w- C:\Program Files (x86)\OpenOffice.org 3
2012-05-31 22:24:52 -------- d-----w- C:\Program Files\OpenOffice.org 3.4 (en-US) Installation Files
2012-05-31 22:08:14 -------- d-----w- C:\Program Files\CCleaner
2012-05-31 20:49:07 -------- d-----w- C:\Users\carol\AppData\Local\Mozilla
2012-05-31 20:48:04 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2012-05-31 20:45:06 8955792 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{16B64A30-F00B-43DB-ABDF-E71D9741DF0D}\mpengine.dll
2012-05-31 17:44:43 -------- d-----w- C:\Users\carol\AppData\Roaming\Malwarebytes
2012-05-31 17:44:24 -------- d-----w- C:\ProgramData\Malwarebytes
2012-05-31 17:44:21 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-05-31 17:44:20 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-05-31 10:19:49 8955792 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-31 03:56:40 927800 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{022658E1-9CD1-4B44-8B4C-1623FE786263}\gapaengine.dll
2012-05-31 03:41:31 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2012-05-31 03:41:12 -------- d-----w- C:\Program Files\Microsoft Security Client
2012-05-30 01:19:37 8955792 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5042BA61-ABBC-4790-8476-F38DAA4E9F60}\mpengine.dll
2012-05-17 03:28:26 -------- d-----w- C:\Users\carol\dvd
2012-05-17 03:25:11 -------- d-----w- C:\Program Files (x86)\VideoConverter
2012-05-15 23:35:08 -------- d-----w- C:\Users\carol\AppData\Roaming\SUPERAntiSpyware.com
2012-05-15 23:34:29 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2012-05-15 23:34:29 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2012-05-14 21:33:02 -------- d-----w- C:\Program Files (x86)\VideoLAN
2012-05-12 19:43:55 1544704 ----a-w- C:\Windows\System32\DWrite.dll
2012-05-12 19:43:55 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-05-12 19:43:52 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-12 19:43:50 3146240 ----a-w- C:\Windows\System32\win32k.sys
2012-05-12 19:43:49 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-12 19:43:48 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-05-12 19:40:33 75120 ----a-w- C:\Windows\System32\drivers\partmgr.sys
2012-05-12 19:40:09 1918320 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-05-12 19:39:48 1367552 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 19:39:47 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 04:06:21 -------- d-----w- C:\Windows\SysWow64\Adobe
2012-05-12 04:05:20 -------- d--h--w- C:\Windows\AxInstSV
2012-05-04 19:00:58 8769696 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
.
==================== Find3M ====================
.
2012-05-31 21:00:46 419488 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-05-31 21:00:44 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-05 01:47:02 687504 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-03-21 03:44:12 98688 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys
2012-03-21 03:44:12 203888 ----a-w- C:\Windows\System32\drivers\MpFilter.sys
.
============= FINISH: 18:43:52.09 ===============
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.
Link 1 (http://screen317.spywareinfoforum.org/SecurityCheck.exe)
Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)
* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.
Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
**********************************************************************
Download Combofix from any of the links below, and save it to your DESKTOP.
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
To prevent your anti-virus application interfering with ComboFix we need to disable it. See here (http://www.pchelpforum.com/anti-virus/110194-how-disable-your-security-applications-4.html) for a tutorial regarding how to do so if you are unsure.
- Close any open windows and double click ComboFix.exe to run it.
You will see the following image:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_disclaimer_ENG.png)
Click I Agree to start the program.
ComboFix will then extract the necessary files and you will see this:
(http://i424.photobucket.com/albums/pp322/digistar/NSIS_extraction.png)
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7
It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
If you did not have it installed, you will see the prompt below. Choose YES.
(http://i424.photobucket.com/albums/pp322/digistar/RcAuto1.gif)
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
(http://i424.photobucket.com/albums/pp322/digistar/whatnext.png)
Click on Yes, to continue scanning for malware.
When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).
Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.
Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.
-
Hello, Dave.
Thank you for your help thus far, here are the requested logs:
Security Check:
Results of screen317's Security Check version 0.99.41
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Enabled!
Microsoft Security Essentials
(On Access scanning disabled!)
Error obtaining update status for antivirus!
`````````Anti-malware/Other Utilities Check:`````````[/u]
Malwarebytes Anti-Malware version 1.61.0.1400
JavaFX 2.1.0
Java(TM) 6 Update 32
Java(TM) 7 Update 4
Adobe Reader X (10.1.3)
Mozilla Firefox (12.0)
````````Process Check: objlist.exe by Laurent````````[/u]
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````[/u]
ComboFix:
ComboFix 12-06-01.03 - carol 06/01/2012 16:09:00.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3003.1976 [GMT -7:00]
Running from: c:\users\carol\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
C:\prefs.js
c:\program files (x86)\CouponAlert_2pEI
c:\program files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEIPlug.dll
c:\program files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEZSETP.dll
c:\program files (x86)\CouponAlert_2pEI\Installr\2.bin\NP2pEISb.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-05-01 to 2012-06-01 )))))))))))))))))))))))))))))))
.
.
2012-06-01 23:20 . 2012-06-01 23:20 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp
2012-06-01 23:20 . 2012-06-01 23:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-01 22:50 . 2012-05-08 17:02 8955792 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9402E9B7-FC4F-4886-8578-13530AAB01A4}\mpengine.dll
2012-06-01 01:38 . 2012-06-01 01:38 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-06-01 01:38 . 2012-06-01 01:38 -------- d-----w- c:\program files (x86)\Oracle
2012-06-01 01:37 . 2012-04-05 01:47 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-05-31 22:33 . 2012-05-31 22:33 -------- d-----w- c:\users\carol\AppData\Roaming\OpenOffice.org
2012-05-31 22:29 . 2012-05-31 22:29 -------- d-----w- c:\program files (x86)\OpenOffice.org 3
2012-05-31 22:24 . 2012-05-31 22:25 -------- d-----w- c:\program files\OpenOffice.org 3.4 (en-US) Installation Files
2012-05-31 22:08 . 2012-05-31 22:08 -------- d-----w- c:\program files\CCleaner
2012-05-31 20:49 . 2012-05-31 20:49 -------- d-----w- c:\users\carol\AppData\Local\Mozilla
2012-05-31 20:48 . 2012-05-31 20:48 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2012-05-31 20:45 . 2012-05-08 17:02 8955792 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\users\carol\AppData\Roaming\Malwarebytes
2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\programdata\Malwarebytes
2012-05-31 17:44 . 2012-04-04 22:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-31 17:44 . 2012-05-31 17:44 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-05-31 03:56 . 2012-05-31 03:55 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{022658E1-9CD1-4B44-8B4C-1623FE786263}\gapaengine.dll
2012-05-31 03:41 . 2012-05-31 03:41 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2012-05-31 03:41 . 2012-05-31 03:42 -------- d-----w- c:\program files\Microsoft Security Client
2012-05-30 01:19 . 2012-05-08 17:02 8955792 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5042BA61-ABBC-4790-8476-F38DAA4E9F60}\mpengine.dll
2012-05-17 03:28 . 2012-05-17 03:28 -------- d-----w- c:\users\carol\dvd
2012-05-17 03:25 . 2012-05-17 03:25 -------- d-----w- c:\program files (x86)\VideoConverter
2012-05-15 23:35 . 2012-05-15 23:35 -------- d-----w- c:\users\carol\AppData\Roaming\SUPERAntiSpyware.com
2012-05-15 23:34 . 2012-05-31 22:49 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-05-15 23:34 . 2012-05-15 23:34 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-05-14 22:00 . 2012-05-19 19:18 -------- d-----w- c:\users\carol\AppData\Roaming\dvdcss
2012-05-14 21:34 . 2012-05-30 14:30 -------- d-----w- c:\users\carol\AppData\Roaming\vlc
2012-05-14 21:33 . 2012-05-14 21:33 -------- d-----w- c:\program files (x86)\VideoLAN
2012-05-12 19:43 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll
2012-05-12 19:43 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-05-12 19:43 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-12 19:43 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys
2012-05-12 19:43 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-12 19:43 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-05-12 19:40 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-12 19:40 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-12 19:39 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 19:39 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-12 04:06 . 2012-05-12 04:07 -------- d-----w- c:\windows\SysWow64\Adobe
2012-05-12 04:05 . 2012-05-12 04:06 -------- d--h--w- c:\windows\AxInstSV
2012-05-04 19:00 . 2012-05-04 19:00 8769696 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 21:00 . 2012-04-18 13:48 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-31 21:00 . 2011-06-16 23:48 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-05 01:47 . 2011-03-31 19:33 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-03-21 03:44 . 2012-03-21 03:44 98688 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-03-21 03:44 . 2012-03-21 03:44 203888 ----a-w- c:\windows\system32\drivers\MpFilter.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\Zynga\prxtbZyn2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files (x86)\Zynga\prxtbZyn2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-05-30 4786048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"DeleteEngineAfterUpdate"="reg DELETE HKCU\Software\AppDataLow\Software\ConduitEngine" [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"WallpaperStyle"= 2
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-31 257696]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-27 291696]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-29 94264]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys
S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 19:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 21:00]
.
2012-05-30 c:\windows\Tasks\HPCeeScheduleForcarol.job
- c:\program files (x86)\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2009-08-17 21:38]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-17 171520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-27 1271168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://us.mg6.mail.yahoo.com/neo/launch?.rand=88a4nbcku5gua
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=Pavilion&pf=cnnb
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\carol\AppData\Roaming\Mozilla\Firefox\Profiles\4j11x0zx.default\
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\SysWOW64\Macromed\Flash\FlashUtil11c_ActiveX.exe
WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file)
AddRemove-Video Converter - c:\program files (x86)\VideoConverter\Uninstall\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{7B13EC3E-999A-4B70-B9CB-2617B8323822}"=hex:51,66,7a,6c,4c,1d,38,12,50,ef,00,
7f,a8,d7,1e,0e,c6,dd,65,57,bd,6c,7c,36
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
"{BA00B7B1-0351-477A-B948-23E3EE5A73D4}"=hex:51,66,7a,6c,4c,1d,38,12,df,b4,13,
be,63,4d,14,02,c6,5e,60,a3,eb,04,37,c0
"{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,
51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,
07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{3EF64538-8B54-4573-B48F-4D34B0238AB2}"=hex:51,66,7a,6c,4c,1d,38,12,56,46,e5,
3a,66,c5,1d,00,cb,99,0e,74,b5,7d,ce,a6
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,
69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{ABD3B5E1-B268-407B-A150-2641DAB8D898}"=hex:51,66,7a,6c,4c,1d,38,12,8f,b6,c0,
af,5a,fc,15,05,de,46,65,01,df,e6,9c,8c
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,
fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-06-01 16:25:23
ComboFix-quarantined-files.txt 2012-06-01 23:25
.
Pre-Run: 250,109,919,232 bytes free
Post-Run: 251,596,574,720 bytes free
.
- - End Of File - - 4448D23AAE96695D59981DFEF75D1DCD
-
It would appear from the Security Check that your AV program, MSE is not activated. Please check this and make sure it is actually activated.
You can uninstall Java(TM) 6 Update 32. It's no longer needed since it's been upgraded. Please explain to me about the slowness of your computer? Is it slow all the time or just slow starting up? Is is slow while browsing on the internet?
Please download aswMBR.exe (http://public.avast.com/%7Egmerek/aswMBR.exe) ( 511KB ) to your desktop.
Double click the aswMBR.exe to run it
(http://i424.photobucket.com/albums/pp322/digistar/aswMBR_Scan.jpg)
Click the "Scan" button to start scan
Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives
(http://i424.photobucket.com/albums/pp322/digistar/aswMBR_SaveLog.png)
On completion of the scan click save log, save it to your desktop and post in your next reply
**********************************************************
Please download Rooter (http://eric71.geekstogo.com/tools/Rooter.exe) and Save it to your desktop.
- Double click it to start the tool.Vista and Windows7 run as administrator.
- Click Scan.
- Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
-
I temporarily disabled MSE for the ComboFix log, since it says so in the instructions, but it is now enabled again.
I have also went ahead and removed the old Java update.
As for the computer's slowness: every program takes a long time to open/load, and oftentimes programs lag, sometimes frozen for several minutes. This computer shares a wi-fi connection with several others in the home, and they have no issues with freezing while online, with the exception of this one, so I know it's not the internet. Also, when the computer is shutting down, it always says that there is a program running. and I have to do a Force Shutdown; the program that is always active says "Task Host."
Once again, thank you for any help!
Here are the newly requested logs:
aswMBR:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-01 17:41:08
-----------------------------
17:41:08.316 OS Version: Windows x64 6.1.7601 Service Pack 1
17:41:08.316 Number of processors: 2 586 0x170A
17:41:08.316 ComputerName: CAROL-PC UserName: carol
17:41:08.940 Initialize success
17:41:12.054 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
17:41:12.054 Disk 0 Vendor: TOSHIBA_MK3263GSX FG020C Size: 305245MB BusType: 11
17:41:12.070 Disk 0 MBR read successfully
17:41:12.070 Disk 0 MBR scan
17:41:12.070 Disk 0 unknown MBR code
17:41:12.085 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
17:41:12.101 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 292848 MB offset 409600
17:41:12.132 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 12196 MB offset 600162304
17:41:12.163 Disk 0 scanning C:\Windows\system32\drivers
17:41:26.562 Service scanning
17:41:58.059 Modules scanning
17:41:58.059 Disk 0 trace - called modules:
17:41:58.090 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
17:41:58.106 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800339b060]
17:41:58.106 3 CLASSPNP.SYS[fffff8800116743f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8002ebc060]
17:41:58.121 Scan finished successfully
17:42:06.171 Disk 0 MBR has been saved successfully to "C:\Users\carol\Desktop\MBR.dat"
17:42:06.171 The log file has been saved successfully to "C:\Users\carol\Desktop\aswMBR.txt"
Rooter:
Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully ...
.
Windows 7 Home Edition (6.1.7601) Service Pack 1
[32_bits] - Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
.
[wscsvc] (Security Center) RUNNING (state:4)
[MpsSvc] RUNNING (state:4)
Windows Firewall -> Enabled
Windows Defender -> Enabled
User Account Control (UAC) -> Enabled
.
Internet Explorer 9.0.8112.16421
Mozilla Firefox 12.0 (en-US)
.
C:\ [Fixed-NTFS] .. ( Total:285 Go - Free:234 Go )
D:\ [Fixed-NTFS] .. ( Total:11 Go - Free:1 Go )
E:\ [CD_Rom]
.
Scan : 17:42.25
Path : C:\Users\carol\Desktop\Rooter.exe
User : carol ( Administrator -> YES )
.
----------------------\\ Processes
.
Locked [System Process] (0)
Locked System (4)
______ ????????? (280)
______ ????????? (392)
______ ????????? (444)
______ ????????? (456)
______ ????????? (500)
______ ????????? (516)
______ ????????? (524)
______ ????????? (608)
______ ????????? (676)
______ ????????? (752)
______ ????????? (800)
______ ????????? (912)
______ ????????? (944)
______ ????????? (988)
______ ????????? (596)
______ ????????? (852)
______ ????????? (1188)
______ ????????? (1212)
______ ????????? (1300)
______ ????????? (1308)
______ ????????? (1404)
______ ????????? (1432)
______ ????????? (1468)
______ ????????? (1544)
______ C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1576)
______ ????????? (1632)
______ ????????? (1640)
______ ????????? (1672)
______ ????????? (1768)
______ ????????? (1876)
______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (1892)
______ C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (1972)
______ ????????? (2008)
______ C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (968)
______ ????????? (2060)
______ C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (2480)
______ ????????? (2544)
______ ????????? (2592)
______ ????????? (2052)
______ C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (296)
______ ????????? (1732)
______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (2076)
______ ????????? (1916)
______ ????????? (748)
Locked audiodg.exe (3372)
______ ????????? (2932)
______ ????????? (3684)
______ ????????? (3672)
______ ????????? (3396)
______ C:\Users\carol\Desktop\Rooter.exe (3616)
.
----------------------\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:208666624)
\Device\Harddisk0\Partition2 (Start_Offset:209715200 | Length:307073384448)
\Device\Harddisk0\Partition3 (Start_Offset:307283099648 | Length:12788432896)
.
----------------------\\ Scheduled Tasks
.
C:\Windows\Tasks\Adobe Flash Player Updater.job
C:\Windows\Tasks\HPCeeScheduleForcarol.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\SCHEDLGU.TXT
.
----------------------\\ Registry
.
.
----------------------\\ Files & Folders
.
----------------------\\ Scan completed at 17:42.27
.
C:\Rooter$\Rooter_2.txt - (01/06/2012 | 17:42.27)
-
Sorry, here is the Rooter log, without smileys:
Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully ...
.
Windows 7 Home Edition (6.1.7601) Service Pack 1
[32_bits] - Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
.
[wscsvc] (Security Center) RUNNING (state:4)
[MpsSvc] RUNNING (state:4)
Windows Firewall -> Enabled
Windows Defender -> Enabled
User Account Control (UAC) -> Enabled
.
Internet Explorer 9.0.8112.16421
Mozilla Firefox 12.0 (en-US)
.
C:\ [Fixed-NTFS] .. ( Total:285 Go - Free:234 Go )
D:\ [Fixed-NTFS] .. ( Total:11 Go - Free:1 Go )
E:\ [CD_Rom]
.
Scan : 17:42.25
Path : C:\Users\carol\Desktop\Rooter.exe
User : carol ( Administrator -> YES )
.
----------------------\\ Processes
.
Locked [System Process] (0)
Locked System (4)
______ ????????? (280)
______ ????????? (392)
______ ????????? (444)
______ ????????? (456)
______ ????????? (500)
______ ????????? (516)
______ ????????? (524)
______ ????????? (608)
______ ????????? (676)
______ ????????? (752)
______ ????????? (800)
______ ????????? (912)
______ ????????? (944)
______ ????????? (988)
______ ????????? (596)
______ ????????? (852)
______ ????????? (1188)
______ ????????? (1212)
______ ????????? (1300)
______ ????????? (1308)
______ ????????? (1404)
______ ????????? (1432)
______ ????????? (1468)
______ ????????? (1544)
______ C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1576)
______ ????????? (1632)
______ ????????? (1640)
______ ????????? (1672)
______ ????????? (1768)
______ ????????? (1876)
______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (1892)
______ C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (1972)
______ ????????? (2008)
______ C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (968)
______ ????????? (2060)
______ C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (2480)
______ ????????? (2544)
______ ????????? (2592)
______ ????????? (2052)
______ C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (296)
______ ????????? (1732)
______ C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (2076)
______ ????????? (1916)
______ ????????? (748)
Locked audiodg.exe (3372)
______ ????????? (2932)
______ ????????? (3684)
______ ????????? (3672)
______ ????????? (3396)
______ C:\Users\carol\Desktop\Rooter.exe (3616)
.
----------------------\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:208666624)
\Device\Harddisk0\Partition2 (Start_Offset:209715200 | Length:307073384448)
\Device\Harddisk0\Partition3 (Start_Offset:307283099648 | Length:12788432896)
.
----------------------\\ Scheduled Tasks
.
C:\Windows\Tasks\Adobe Flash Player Updater.job
C:\Windows\Tasks\HPCeeScheduleForcarol.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\SCHEDLGU.TXT
.
----------------------\\ Registry
.
.
----------------------\\ Files & Folders
.
----------------------\\ Scan completed at 17:42.27
.
C:\Rooter$\Rooter_2.txt - (01/06/2012 | 17:42.27)
-
i think I see one problem.
Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.
Link 1 (http://download.bleepingcomputer.com/rootrepeal/MBRCheck.exe)
Link 2 (http://ad13.geekstogo.com/MBRCheck.exe)
Link 3 (http://www.kernelmode.info/MBRCheck.exe)
•Double-click on MBRCheck.exe to run it.
•It will open a black window...please do not fix anything (if it gives you an option).
•When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.
•A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
•Please copy and paste the contents of that log in your next reply.
-
All right~ the log is pasted below:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: Wistron
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP G60 Notebook PC
Logical Drives Mask: 0x0000001c
Kernel Drivers (total 228):
0x02C11000 \SystemRoot\system32\ntoskrnl.exe
0x031F9000 \SystemRoot\system32\hal.dll
0x00B96000 \SystemRoot\system32\kdcom.dll
0x00CF2000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00D41000 \SystemRoot\system32\PSHED.dll
0x00D55000 \SystemRoot\system32\CLFS.SYS
0x00C00000 \SystemRoot\system32\CI.dll
0x00EE9000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F8D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F9C000 \SystemRoot\system32\drivers\ACPI.sys
0x00FF3000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00E00000 \SystemRoot\system32\drivers\msisadrv.sys
0x00E0A000 \SystemRoot\system32\drivers\pci.sys
0x00E3D000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00E4A000 \SystemRoot\system32\drivers\isapnp.sys
0x00E53000 \SystemRoot\system32\drivers\mpio.sys
0x00E7D000 \SystemRoot\System32\drivers\partmgr.sys
0x00E92000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00E9B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00EA7000 \SystemRoot\system32\drivers\volmgr.sys
0x01028000 \SystemRoot\System32\drivers\volmgrx.sys
0x01084000 \SystemRoot\system32\drivers\intelide.sys
0x0108C000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x0109C000 \SystemRoot\system32\drivers\aliide.sys
0x010A3000 \SystemRoot\system32\drivers\amdide.sys
0x010AA000 \SystemRoot\system32\drivers\cmdide.sys
0x010B2000 \SystemRoot\System32\drivers\mountmgr.sys
0x010CC000 \SystemRoot\system32\drivers\msdsm.sys
0x010F2000 \SystemRoot\system32\drivers\nvraid.sys
0x0111A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x0114A000 \SystemRoot\system32\drivers\pciide.sys
0x01151000 \SystemRoot\system32\drivers\viaide.sys
0x01206000 \SystemRoot\system32\drivers\iaStorV.sys
0x01324000 \SystemRoot\system32\drivers\atapi.sys
0x0132D000 \SystemRoot\system32\drivers\ataport.SYS
0x01357000 \SystemRoot\system32\DRIVERS\lsi_sas.sys
0x01374000 \SystemRoot\system32\DRIVERS\storport.sys
0x013D7000 \SystemRoot\system32\drivers\msahci.sys
0x013E2000 \SystemRoot\system32\drivers\HpSAMD.sys
0x01159000 \SystemRoot\system32\DRIVERS\adp94xx.sys
0x014DB000 \SystemRoot\system32\DRIVERS\adpahci.sys
0x01531000 \SystemRoot\system32\DRIVERS\adpu320.sys
0x01560000 \SystemRoot\system32\drivers\amdsata.sys
0x0157E000 \SystemRoot\system32\DRIVERS\amdsbs.sys
0x015C5000 \SystemRoot\system32\drivers\amdxata.sys
0x015D0000 \SystemRoot\system32\DRIVERS\arc.sys
0x01400000 \SystemRoot\system32\DRIVERS\arcsas.sys
0x0141B000 \SystemRoot\system32\DRIVERS\elxstor.sys
0x014A2000 \SystemRoot\system32\DRIVERS\iirsp.sys
0x014B3000 \SystemRoot\system32\DRIVERS\lsi_fc.sys
0x015E9000 \SystemRoot\system32\DRIVERS\lsi_sas2.sys
0x011D4000 \SystemRoot\system32\DRIVERS\lsi_scsi.sys
0x011F3000 \SystemRoot\system32\DRIVERS\megasas.sys
0x016FD000 \SystemRoot\system32\DRIVERS\MegaSR.sys
0x017A1000 \SystemRoot\system32\DRIVERS\nfrd960.sys
0x017B1000 \SystemRoot\system32\drivers\nvstor.sys
0x01837000 \SystemRoot\system32\DRIVERS\ql2300.sys
0x01600000 \SystemRoot\system32\DRIVERS\ql40xx.sys
0x019DB000 \SystemRoot\system32\DRIVERS\SiSRaid2.sys
0x01800000 \SystemRoot\system32\DRIVERS\sisraid4.sys
0x01818000 \SystemRoot\system32\DRIVERS\stexstor.sys
0x0165F000 \SystemRoot\system32\DRIVERS\vsmraid.sys
0x01689000 \SystemRoot\system32\drivers\fltmgr.sys
0x01822000 \SystemRoot\system32\drivers\fileinfo.sys
0x00DB3000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0x01A0A000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01C22000 \SystemRoot\System32\Drivers\msrpc.sys
0x01C80000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01C9B000 \SystemRoot\System32\Drivers\cng.sys
0x01D0D000 \SystemRoot\System32\drivers\pcw.sys
0x01D1E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x01ECB000 \SystemRoot\system32\drivers\ndis.sys
0x01E00000 \SystemRoot\system32\drivers\NETIO.SYS
0x01E60000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x020B1000 \SystemRoot\System32\drivers\tcpip.sys
0x022B4000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x022FE000 \SystemRoot\system32\DRIVERS\wd.sys
0x02306000 \SystemRoot\system32\drivers\volsnap.sys
0x02352000 \SystemRoot\System32\Drivers\spldr.sys
0x0235A000 \SystemRoot\system32\drivers\sbp2port.sys
0x02377000 \SystemRoot\System32\drivers\rdyboost.sys
0x023B1000 \SystemRoot\System32\Drivers\mup.sys
0x023C3000 \SystemRoot\System32\drivers\hwpolicy.sys
0x02000000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0203A000 \SystemRoot\system32\DRIVERS\disk.sys
0x023CC000 \SystemRoot\system32\drivers\cdrom.sys
0x023F6000 \SystemRoot\System32\Drivers\Null.SYS
0x02088000 \SystemRoot\System32\Drivers\Beep.SYS
0x0208F000 \SystemRoot\System32\drivers\vga.sys
0x01E8B000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x0209D000 \SystemRoot\System32\drivers\watchdog.sys
0x01EB0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x01EB9000 \SystemRoot\system32\drivers\rdpencdd.sys
0x01EC2000 \SystemRoot\system32\drivers\rdprefmp.sys
0x01FBE000 \SystemRoot\System32\Drivers\Msfs.SYS
0x01FC9000 \SystemRoot\System32\Drivers\Npfs.SYS
0x01FDA000 \SystemRoot\system32\DRIVERS\tdx.sys
0x01D28000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x01D35000 \SystemRoot\system32\drivers\afd.sys
0x01BAD000 \SystemRoot\System32\DRIVERS\netbt.sys
0x01DBE000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x01DC9000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x01DD2000 \SystemRoot\system32\DRIVERS\pacer.sys
0x01C00000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x019E9000 \SystemRoot\system32\DRIVERS\netbios.sys
0x017DC000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x016D5000 \SystemRoot\system32\drivers\termdd.sys
0x01C16000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
0x01BF2000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
0x0463F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x04690000 \SystemRoot\system32\drivers\nsiproxy.sys
0x0469C000 \SystemRoot\system32\drivers\mssmbios.sys
0x046A7000 \SystemRoot\System32\drivers\discache.sys
0x046B6000 \SystemRoot\System32\Drivers\dfsc.sys
0x046D4000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x046E5000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x0470B000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x04721000 \SystemRoot\system32\drivers\wmiacpi.sys
0x05229000 \SystemRoot\system32\DRIVERS\igdkmd64.sys
0x05C4C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x05D40000 \SystemRoot\System32\drivers\dxgmms1.sys
0x05D86000 \SystemRoot\system32\drivers\usbuhci.sys
0x05D93000 \SystemRoot\system32\drivers\USBPORT.SYS
0x05DE9000 \SystemRoot\system32\drivers\usbehci.sys
0x05200000 \SystemRoot\system32\drivers\HDAudBus.sys
0x0472A000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x04818000 \SystemRoot\system32\DRIVERS\athrx.sys
0x04A62000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x04A6F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x04A8D000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x04A99000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x04AA8000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x04AF1000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04AF3000 \SystemRoot\system32\drivers\mouclass.sys
0x04B02000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x04B07000 \SystemRoot\system32\drivers\CompositeBus.sys
0x04B17000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x04B2D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04B51000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04B5D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04B8C000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04BA7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04BC8000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04BE2000 \SystemRoot\system32\drivers\swenum.sys
0x04763000 \SystemRoot\system32\drivers\ks.sys
0x04BE4000 \SystemRoot\system32\DRIVERS\umbus.sys
0x047A6000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04800000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x03688000 \SystemRoot\system32\drivers\CHDRT64.sys
0x03736000 \SystemRoot\system32\drivers\portcls.sys
0x03773000 \SystemRoot\system32\drivers\drmk.sys
0x03795000 \SystemRoot\system32\drivers\ksthunk.sys
0x0379B000 \SystemRoot\system32\DRIVERS\CAXHWAZL.sys
0x04C0E000 \SystemRoot\system32\DRIVERS\CAX_DPV.sys
0x04E29000 \SystemRoot\system32\DRIVERS\CAX_CNXT.sys
0x04EF4000 \SystemRoot\system32\drivers\modem.sys
0x04F03000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x04F2A000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x04F47000 \SystemRoot\System32\Drivers\usbvideo.sys
0x04F75000 \SystemRoot\System32\Drivers\crashdmp.sys
0x04F83000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x04F8F000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x04F9A000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00080000 \SystemRoot\System32\win32k.sys
0x04FAD000 \SystemRoot\System32\drivers\Dxapi.sys
0x04FB9000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00450000 \SystemRoot\System32\TSDDD.dll
0x006F0000 \SystemRoot\System32\cdd.dll
0x008A0000 \SystemRoot\System32\ATMFD.DLL
0x04FC7000 \SystemRoot\system32\drivers\luafv.sys
0x04E00000 \SystemRoot\system32\drivers\WudfPf.sys
0x04FEA000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x04D82000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x04DD5000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x04DE8000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x032B3000 \SystemRoot\system32\drivers\HTTP.sys
0x0337C000 \SystemRoot\system32\DRIVERS\bowser.sys
0x0339A000 \SystemRoot\System32\drivers\mpsdrv.sys
0x033B2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x03200000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x0324E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x03272000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0x06A83000 \SystemRoot\system32\drivers\peauth.sys
0x06B29000 \SystemRoot\System32\Drivers\secdrv.SYS
0x06B34000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x06B65000 \SystemRoot\System32\drivers\tcpipreg.sys
0x06B77000 \SystemRoot\system32\DRIVERS\XAudio64.sys
0x06B7F000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0700B000 \SystemRoot\System32\DRIVERS\srv.sys
0x77AC0000 \Windows\System32\ntdll.dll
0x47F50000 \Windows\System32\smss.exe
0xFFDE0000 \Windows\System32\apisetschema.dll
0xFF9A0000 \Windows\System32\autochk.exe
0xFFCF0000 \Windows\System32\advapi32.dll
0xFEF60000 \Windows\System32\shell32.dll
0xFEE50000 \Windows\System32\msctf.dll
0xFEE00000 \Windows\System32\ws2_32.dll
0x778B0000 \Windows\System32\iertutil.dll
0xFED60000 \Windows\System32\msvcrt.dll
0xFED50000 \Windows\System32\nsi.dll
0xFED40000 \Windows\System32\lpk.dll
0x77750000 \Windows\System32\wininet.dll
0xFED20000 \Windows\System32\sechost.dll
0xFEC50000 \Windows\System32\usp10.dll
0x77650000 \Windows\System32\user32.dll
0xFEBE0000 \Windows\System32\gdi32.dll
0x77500000 \Windows\System32\urlmon.dll
0x773E0000 \Windows\System32\kernel32.dll
0xFEA00000 \Windows\System32\setupapi.dll
0xFE9E0000 \Windows\System32\imagehlp.dll
0xFE960000 \Windows\System32\difxapi.dll
0xFE8E0000 \Windows\System32\shlwapi.dll
0xFE7B0000 \Windows\System32\rpcrt4.dll
0x77C90000 \Windows\System32\normaliz.dll
0xFE780000 \Windows\System32\imm32.dll
0x77C80000 \Windows\System32\psapi.dll
0xFE720000 \Windows\System32\Wldap32.dll
0xFE680000 \Windows\System32\comdlg32.dll
0xFE5A0000 \Windows\System32\oleaut32.dll
0xFE500000 \Windows\System32\clbcatq.dll
0xFE2F0000 \Windows\System32\ole32.dll
0xFE180000 \Windows\System32\crypt32.dll
0xFE140000 \Windows\System32\wintrust.dll
0xFE120000 \Windows\System32\devobj.dll
0xFE0E0000 \Windows\System32\cfgmgr32.dll
0xFE070000 \Windows\System32\KernelBase.dll
0xFDFD0000 \Windows\System32\comctl32.dll
0xFDFC0000 \Windows\System32\msasn1.dll
Processes (total 51):
0 System Idle Process
4 System
280 C:\Windows\System32\smss.exe
396 csrss.exe
448 C:\Windows\System32\wininit.exe
460 csrss.exe
504 C:\Windows\System32\services.exe
520 C:\Windows\System32\lsass.exe
532 C:\Windows\System32\lsm.exe
612 C:\Windows\System32\winlogon.exe
676 C:\Windows\System32\svchost.exe
756 C:\Windows\System32\svchost.exe
804 C:\Program Files\Microsoft Security Client\MsMpEng.exe
900 C:\Windows\System32\svchost.exe
948 C:\Windows\System32\svchost.exe
992 C:\Windows\System32\svchost.exe
596 C:\Windows\System32\svchost.exe
440 C:\Windows\System32\svchost.exe
1172 C:\Windows\System32\dwm.exe
1308 C:\Windows\explorer.exe
1356 C:\Windows\System32\wlanext.exe
1364 C:\Windows\System32\conhost.exe
1428 C:\Windows\System32\spoolsv.exe
1456 C:\Windows\System32\svchost.exe
1520 C:\Program Files\SUPERAntiSpyware\SASCore64.exe
1584 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
1620 C:\Windows\System32\svchost.exe
1656 C:\Windows\System32\svchost.exe
1708 C:\Windows\System32\taskhost.exe
1860 C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
1912 C:\Windows\System32\svchost.exe
1956 C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
1996 C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
1304 C:\Program Files\Java\jre6\bin\jusched.exe
1276 C:\Windows\System32\igfxpers.exe
1264 C:\Program Files\Microsoft Security Client\msseces.exe
1492 C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
1828 C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
2256 C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2292 C:\Windows\System32\svchost.exe
2336 C:\Windows\System32\svchost.exe
3052 C:\Windows\System32\SearchIndexer.exe
2128 C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
972 WmiPrvSE.exe
3152 C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
3672 C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
2512 C:\Program Files\Windows Media Player\wmpnetwk.exe
1048 C:\Windows\System32\audiodg.exe
740 C:\Users\carol\Desktop\MBRCheck.exe
1108 C:\Windows\System32\conhost.exe
3764 C:\Windows\System32\dllhost.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c800000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000047`8b800000 (NTFS)
PhysicalDrive0 Model Number: TOSHIBAMK3263GSX, Rev: FG020C
Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: AC2C3A9AC297D1BBF7F1A54596ACBEDDD7F164E 6
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Done!
-
We need to fix the Master Boot Record (http://en.wikipedia.org/wiki/Master_boot_record) using aswMBR now.
- Double click aswMBR.exe to run it like before
- Once the scan finishes click FixMBR to remove the infection as illustrated below
(http://i424.photobucket.com/albums/pp322/digistar/aswMBR_FixMBR.jpg)
- Once the scan finishes click Save log to save the log to your Desktop
(http://i424.photobucket.com/albums/pp322/digistar/aswMBR_SaveLog.png)
- Copy and paste the contents of aswMBR.txt back here for review
.
-
The new log:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-02 12:52:40
-----------------------------
12:52:40.841 OS Version: Windows x64 6.1.7601 Service Pack 1
12:52:40.841 Number of processors: 2 586 0x170A
12:52:40.857 ComputerName: CAROL-PC UserName: carol
12:52:41.668 Initialize success
12:52:44.725 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:52:44.725 Disk 0 Vendor: TOSHIBA_MK3263GSX FG020C Size: 305245MB BusType: 11
12:52:44.757 Disk 0 MBR read successfully
12:52:44.757 Disk 0 MBR scan
12:52:44.757 Disk 0 Windows 7 default MBR code
12:52:44.772 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
12:52:44.788 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 292848 MB offset 409600
12:52:44.803 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 12196 MB offset 600162304
12:52:44.850 Disk 0 scanning C:\Windows\system32\drivers
12:52:52.900 Service scanning
12:53:22.899 Modules scanning
12:53:22.899 Disk 0 trace - called modules:
12:53:22.945 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
12:53:22.945 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003379060]
12:53:23.460 3 CLASSPNP.SYS[fffff8800111b43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8002e8f680]
12:53:23.460 Scan finished successfully
12:53:27.643 Verifying
12:53:37.689 Disk 0 Windows 601 MBR fixed successfully
12:55:15.002 Disk 0 MBR has been saved successfully to "C:\Users\carol\Desktop\MBR.dat"
12:55:15.080 The log file has been saved successfully to "C:\Users\carol\Desktop\aswMBR2.txt"
-
That looks good. How's your computer running now?
I'd like to scan your machine with ESET OnlineScan
•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan (http://eset.com/onlinescan)
•Click the (http://i424.photobucket.com/albums/pp322/digistar/esetOnline.png) button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on (http://i424.photobucket.com/albums/pp322/digistar/esetSmartInstall.png) to download the ESET Smart Installer. Save it to your desktop.
- Double click on the (http://i424.photobucket.com/albums/pp322/digistar/esetSmartInstallDesktopIcon-1.png) icon on your desktop.
•Check (http://i424.photobucket.com/albums/pp322/digistar/esetAcceptTerms.png)
•Click the (http://i424.photobucket.com/albums/pp322/digistar/esetStart.png) button.
•Accept any security warnings from your browser.
•Check (http://i424.photobucket.com/albums/pp322/digistar/esetScanArchives.png)
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push (http://i424.photobucket.com/albums/pp322/digistar/esetListThreats.png)
•Push (http://i424.photobucket.com/albums/pp322/digistar/esetExport.png), and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the (http://i424.photobucket.com/albums/pp322/digistar/esetBack.png) button.
•Push (http://i424.photobucket.com/albums/pp322/digistar/esetFinish.png)
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt
-
Thanks, Dave. Here is the list of threats that I saved from the scan:
ESETScan:
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEIPlug.dll.vir Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\2pEZSETP.dll.vir Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Program Files (x86)\CouponAlert_2pEI\Installr\2.bin\NP2pEISb.dll.vir Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined
-
That looks good. If there are no other issues, we can do some cleanup.
To uninstall ComboFix
- Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
- In the field, type in ComboFix /uninstall
(http://i424.photobucket.com/albums/pp322/digistar/Combofix_uninstall_image.jpg)
(Note: Make sure there's a space between the word ComboFix and the forward-slash.)
- Then, press Enter, or click OK.
- This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
***************************************************
Clean out your temporary internet files and temp files.
Download TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe) to your desktop.
Double-click TFC.exe to run it.
Note: If you are running on Vista, right-click on the file and choose Run As Administrator
TFC will close all programs when run, so make sure you have saved all your work before you begin.
* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.
Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
***************************************************
Looking over your log it seems you don't have any evidence of a third party firewall.
Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.
Remember only install ONE firewall
1) Comodo Personal Firewall (http://www.majorgeeks.com/Comodo_Personal_Firewall_d5033.html) (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor (http://www.majorgeeks.com/Online_Armor_Free_d4872.html)
3) Agnitum Outpost (http://www.majorgeeks.com/Outpost_Firewall_Free_d1056.html)
4) PC Tools Firewall Plus (http://www.majorgeeks.com/PC_Tools_Firewall_Plus_d5470.html)
If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
****************************************************
Go to Microsoft Windows Update (http://windowsupdate.microsoft.com/) and get all critical updates.
----------
I suggest using WOT - Web of Trust (http://www.mywot.com/). WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.
SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer (http://www.bleepingcomputer.com/forums/tutorial49.html) from Spyware and Malware
* If you don't know what ActiveX controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. (http://www.safer-networking.org/en/spybotsd/index.html) Guide: Use Spybot's Immunize Feature (http://www.bleepingcomputer.com/tutorials/tutorial43.html#immunize) to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ (http://www.safer-networking.org/en/faq/index.html)
Check out Keeping Yourself Safe On The Web (http://evilfantasy.wordpress.com/2008/05/20/keeping-yourself-safe-on-the-web/) for tips and free tools to help keep you safe in the future.
Also see Slow Computer? It may not be Malware (http://evilfantasy.wordpress.com/2008/05/24/slow-computer-it-may-not-be-malware/) for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!
-
Thanks for all your help, Dave, I really appreciate it~
-
Thanks for all your help, Dave, I really appreciate it~
You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.