I cannot access the internet.

[SuperDave]

Can you access the internet in Safe Mode with NetWorking?

Please download SystemLook from one of the links below and save it to your desktop.

Link # 1
Link # 2

Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double-click SystemLook.exe to run it.

Copy the contents of the following codebox into the main textfield.

Code: [Select]

:filefind
wlanapi.dll
Click the Look button to start the scan.

Note: The scan may take some time so please just let it do its work and be patient (or do something else unrelated to the computer).

When finished, a notepad window will open with the results of the scan. Please post the log. The log can also be found on your desktop entitled SystemLook.txt
 

[jim.mar]

SuperDave:  Something new has happened.  This AM when I turned on the machine it refused to operate any programs.   It would open files but that is all.  NO documents, spreadsheets, music  etc....   So, indesperation, I ran system restore using a restore point that I had tried to use before without success.   Viola, the machine seems to be working alright.   Almost..   I can now access the internet but I get unfamiliar error messages once in a while...     I had to uninstall Malwarebytes, Paratologic Driver Cure, and Superantispyware at the suggestion of the system restore program. 

I will insert the SystemLock.txt log next posting.

[jim.mar]

SystemLook.txt log

SystemLook 30.07.11 by jpshortstuff
Log created at 11:48 on 07/02/2012 by JIM
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.

========== filefind ==========

Searching for "wlanapi.dll"
C:\Windows\System32\wlanapi.dll   --a---- 81408 bytes   [23:51 13/07/2009]   [01:16 14/07/2009] B010CF886420EE29C2C276646721D255
C:\Windows\SysWOW64\wlanapi.dll   --a---- 81408 bytes   [23:51 13/07/2009]   [01:16 14/07/2009] B010CF886420EE29C2C276646721D255
C:\Windows\winsxs\amd64_microsoft-windows-wlansvc_31bf3856ad364e35_6.1.7600.16385_none_f83933fa1e9727df\wlanapi.dll   --a---- 114176 bytes   [00:07 14/07/2009]   [01:41 14/07/2009] 357BE883C5236BFC7341CB9E82308908
C:\Windows\winsxs\amd64_microsoft-windows-wlansvc_31bf3856ad364e35_6.1.7601.17514_none_fa6a47c21b85ab79\wlanapi.dll   --a---- 114176 bytes   [00:07 14/07/2009]   [01:41 14/07/2009] 357BE883C5236BFC7341CB9E82308908
C:\Windows\winsxs\wow64_microsoft-windows-wlansvc_31bf3856ad364e35_6.1.7600.16385_none_028dde4c52f7e9da\wlanapi.dll   --a---- 81408 bytes   [23:51 13/07/2009]   [01:16 14/07/2009] B010CF886420EE29C2C276646721D255
C:\Windows\winsxs\wow64_microsoft-windows-wlansvc_31bf3856ad364e35_6.1.7601.17514_none_04bef2144fe66d74\wlanapi.dll   --a---- 81408 bytes   [23:51 13/07/2009]   [01:16 14/07/2009] B010CF886420EE29C2C276646721D255

-= EOF =-

[SuperDave]

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[jim.mar]

ESTscan log

C:\Program Files (x86)\EpicPlay\epicPlayGames.dll   a variant of Win32/Adware.Gamevance.BI application   cleaned by deleting (after the next restart) - quarantined
C:\Users\JIM\AppData\Local\Temp\NODC07B.tmp   a variant of Win32/Adware.Gamevance.BI application   cleaned by deleting (after the next restart) - quarantined
C:\Users\JIM\Downloads\freeripmp3-setup.exe   multiple threats   deleted - quarantined
================================================================================

On line scanner log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK

[SuperDave]

Ok. Try that for a few days and report any unusual occurences.

[jim.mar]

OK, thank you a bunch.   Everything seems to be working alright..  I'll get back to you if anything unusual shows up.   Thanks again.  You guys do a great job and I, for one, appreciate it.

[jim.mar]

OK here it is several hours later.  All day I have been getting messages encouraging me down download some windows updates.   I kept stalling the procedure by clicking on "Postpone".   Finally at about noon (Arizona USA time) I left the machine on and went to lunch.  A couple of hours later I came back and found the machine in exactly the same condition that it was when we started this project.   I could not access Yahoo, Google, or facebook with any of my browsers EXCEPT facebook on chrome.     I switched to a different user logon and when I tried to bring up Internet Explorer, I got Bing.

I immediatley went to sysem restore and resostored it to point that I created yesterday when the machine seemed to  be working.    In retrospect, this machine started acting up when I responded to a promo to update with SP1.   After the computer had supposedly udated itself it started acting up.

It seems to be working now but not as fast as before, especially with certain web sites.    ie Google, yahoo  etc.  I am going to shut it down now for the day.   Hope this is informative,  JIM

[SuperDave]

Ok. Please try this: Go directly to MS to check for your updates.

Microsoft Windows Update and get all critical updates.

[jim.mar]

This AM my computer is telling me that it wants to do some more updating.  This is what was going on the last two times it fouled up.   Meanwhile I went to check my updates and found two failed updates occurring about the time I started having trouble.   

1)
Windows Internet Explorer 9 for Windows 7 for x64-based Systems

Installation date: ‎1/‎23/‎2012 5:42 PM

Installation status: Failed

Error details: Code C355

Update type: Important

Windows Internet Explorer 9 delivers web sites and applications that look and perform like native PC applications through the power of Windows.

          Fast: Internet Explorer 9 is all-around fast.  Designed to take full advantage of your PC’s hardware through Windows, Internet Explorer 9 delivers graphically rich and immersive experiences that are as fast and responsive as native applications installed on your PC.

          Clean: Internet Explorer puts the focus on the Web sites you love with a clean look and increased viewing area that makes your Web sites shine.  Intuitive and seamless integration with Windows 7 provides one-click access to Web applications pinned directly to your Taskbar.

          Trusted: Internet Explorer is the trusted way to the Web because it has a robust set of built-in security, privacy and reliability technologies that keep you safer and your browsing experience uninterrupted.

          Interoperable: Support for HTML5 and modern Web standards architected to take advantage of the GPU means that the same mark-up not only works across the Web, but runs faster and delivers a richer experience through Windows and  Internet Explorer 9.

More information:
http://go.microsoft.com/fwlink/?LinkId=71727

Help and Support:
http://go.microsoft.com/fwlink/?LinkId=71719

and 2)

Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 and Windows Server 2008 R2 SP1 for x64-based Systems (KB2572077)

Installation date: ‎1/‎24/‎2012 5:34 PM

Installation status: Failed

Error details: Code 8024200D

Update type: Important

A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it. You can help protect your system by installing this update from Microsoft. After you install this update, you may have to restart your system.

More information:
http://go.microsoft.com/fwlink/?LinkID=225499

Help and Support:
http://support.microsoft.com

QUESTION:   How do I stop the persistant requests to update Windows  ? ?

Ok. Please try this: Go directly to MS to check for your updates.

Microsoft Windows Update and get all critical updates.

Do you want me to post all of the update info back to Jan 23 ? ?

[SuperDave]

Do you want me to post all of the update info back to Jan 23 ? ?

No, not necessary. I suspect that your computer has become infected again. Please update and run SAS and MBAM again and post the logs.

[jim.mar]

OKAY here are the logs:

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.01.13.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
JIM :: ROSIE [administrator]

Protection: Disabled

2/15/2012 12:46:34 PM
mbam-log-2012-02-15 (12-46-34).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 447092
Time elapsed: 42 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

============================================================

2012/02/15 11:06:44 -0700   ROSIE   JIM   MESSAGE   Starting protection
2012/02/15 11:06:46 -0700   ROSIE   JIM   MESSAGE   Protection started successfully
2012/02/15 11:06:49 -0700   ROSIE   JIM   MESSAGE   Starting IP protection
2012/02/15 11:06:52 -0700   ROSIE   JIM   MESSAGE   IP Protection started successfully
2012/02/15 11:11:56 -0700   ROSIE   JIM   MESSAGE   Executing scheduled update:  Daily
2012/02/15 11:24:03 -0700   ROSIE   JIM   ERROR   Scheduled update failed:  Timeout failed with error code 0
2012/02/15 12:40:16 -0700   ROSIE   JIM   MESSAGE   Stopping IP protection
2012/02/15 12:41:48 -0700   ROSIE   JIM   MESSAGE   IP Protection stopped
2012/02/15 14:38:54 -0700   ROSIE   JIM   MESSAGE   Starting protection
2012/02/15 14:38:56 -0700   ROSIE   JIM   MESSAGE   Protection started successfully
2012/02/15 14:38:59 -0700   ROSIE   JIM   MESSAGE   Starting IP protection
2012/02/15 14:39:02 -0700   ROSIE   JIM   MESSAGE   IP Protection started successfully
2012/02/15 14:48:20 -0700   ROSIE   JIM   MESSAGE   Executing scheduled update:  Daily
2012/02/15 15:00:27 -0700   ROSIE   JIM   ERROR   Scheduled update failed:  Timeout failed with error code 0
==================================================

UPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/15/2012 at 02:02 PM

Application Version : 4.46.1000

Core Rules Database Version : 5907
Trace Rules Database Version: 3719

Scan type       : Quick Scan
Total Scan Time : 00:19:03

Memory items scanned      : 596
Memory threats detected   : 0
Registry items scanned    : 2818
Registry threats detected : 1
File items scanned        : 23278
File threats detected     : 30

Malware.Trace
   (x86) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon#Taskman

Trojan.Dropper/SVCHost-Fake
   C:\PROGRAM FILES (X86)\MALWAREBYTES' ANTI-MALWARE\CHAMELEON\SVCHOST.EXE

Adware.Tracking Cookie
   .bizrate.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .bizrate.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .bizrate.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .bizrate.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .backingtracksonline.co.uk [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .backingtracksonline.co.uk [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .backingtracksonline.co.uk [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .yieldmanager.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .atdmt.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .atdmt.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .advertising.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .doubleclick.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .imrworldwide.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .imrworldwide.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   ad.yieldmanager.com [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
   .revsci.net [ C:\Users\JIM\AppData\Local\Google\Chrome\User Data\Default\Cookies ]

[SuperDave]

Ok. Let's try ComboFix again. Delete the version you have on your desktop and download a new version.Instructions in Reply #20

[jim.mar]

Thanks SuperDave:    OK, Here is the ComboFix log MIS the snapshot data.

ComboFix 12-02-17.02 - JIM 02/17/2012   9:26.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4095.2568 [GMT -7:00]
Running from: J:\PCHelpForum.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: PC Tools Firewall Plus *Enabled* {175D0B73-9F8F-2CA9-8BF1-62277A276DC9}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
.
.
(((((((((((((((((((((((((   Files Created from 2012-01-17 to 2012-02-17  )))))))))))))))))))))))))))))))
.
.
2012-02-17 16:35 . 2012-02-17 16:35   --------   d-----w-   c:\users\vue 3\AppData\Local\temp
2012-02-17 16:35 . 2012-02-17 16:35   --------   d-----w-   c:\users\Terri\AppData\Local\temp
2012-02-17 16:35 . 2012-02-17 16:35   --------   d-----w-   c:\users\Public\AppData\Local\temp
2012-02-17 16:35 . 2012-02-17 16:35   --------   d-----w-   c:\users\Guest\AppData\Local\temp
2012-02-17 16:35 . 2012-02-17 16:35   --------   d-----w-   c:\users\Default\AppData\Local\temp
2012-02-17 16:24 . 2012-01-17 11:39   8602168   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{3CA369CB-150D-494C-BC67-D65B62A2B1EF}\mpengine.dll
2012-02-15 20:31 . 2012-02-15 20:31   --------   d-----w-   c:\users\JIM\AppData\Roaming\SUPERAntiSpyware.com
2012-02-15 20:31 . 2012-02-15 20:31   --------   d-----w-   c:\programdata\!SASCORE
2012-02-15 20:31 . 2012-02-16 19:14   --------   d-----w-   c:\program files\SUPERAntiSpyware
2012-02-10 01:12 . 2012-02-10 01:12   --------   d-----w-   c:\users\Terri\AppData\Roaming\Share-to-Web Upload Folder
2012-02-03 19:50 . 2012-02-03 19:50   --------   d-----w-   c:\programdata\Kaspersky Lab
2012-01-25 19:56 . 2012-01-25 19:58   --------   d-----w-   c:\users\JIM\AppData\Roaming\DriverCure
2012-01-25 19:55 . 2012-02-16 19:13   --------   d-----w-   c:\program files (x86)\Common Files\ParetoLogic
2012-01-25 19:55 . 2012-02-06 15:29   --------   d-----w-   c:\programdata\DriverCure
2012-01-25 19:55 . 2012-01-25 19:55   --------   d-----w-   c:\programdata\ParetoLogic
2012-01-25 19:55 . 2012-02-16 19:13   --------   d-----w-   c:\program files (x86)\ParetoLogic
2012-01-25 19:19 . 2004-10-22 20:42   577536   ----a-w-   c:\windows\SysWow64\ANIWZCS2.dll
2012-01-25 19:19 . 2004-10-22 20:42   131072   ----a-w-   c:\windows\SysWow64\WlanApp.dll
2012-01-25 19:19 . 2004-10-22 20:42   1163337   ----a-w-   c:\windows\SysWow64\odSupp_M.dll
2012-01-25 19:19 . 2004-10-22 20:42   57407   ----a-w-   c:\windows\SysWow64\ANICtl.dll
2012-01-25 19:19 . 2004-10-22 20:42   49152   ----a-w-   c:\windows\SysWow64\AQCKGen.dll
2012-01-25 19:19 . 2004-10-22 20:42   192512   ----a-w-   c:\windows\SysWow64\aIPH.dll
2012-01-25 19:19 . 2012-01-25 19:19   --------   d-----w-   c:\program files (x86)\ANI
2012-01-25 19:19 . 2004-07-27 18:20   36864   ----a-w-   c:\windows\SysWow64\ANIOApi.dll
2012-01-25 19:19 . 2004-07-27 18:20   28205   ----a-w-   c:\windows\SysWow64\ANIO.sys
2012-01-25 19:19 . 2004-07-27 18:20   16997   ----a-w-   c:\windows\SysWow64\ANIO.VXD
2012-01-25 19:19 . 2004-07-27 18:20   11904   ----a-w-   c:\windows\SysWow64\anio4.sys
2012-01-25 19:19 . 2012-01-25 19:19   --------   d-----w-   c:\program files (x86)\D-Link
2012-01-24 23:44 . 2012-01-24 23:44   0   ---ha-w-   c:\users\JIM\AppData\Local\BIT1ECD.tmp
2012-01-24 23:42 . 2012-01-24 23:42   0   ---ha-w-   c:\users\JIM\AppData\Local\BIT606D.tmp
2012-01-24 23:26 . 2012-01-24 23:26   0   ---ha-w-   c:\users\JIM\AppData\Local\BITCBF.tmp
2012-01-24 23:24 . 2012-01-24 23:24   0   ---ha-w-   c:\users\JIM\AppData\Local\BIT474E.tmp
2012-01-23 23:32 . 2012-01-24 23:37   --------   d-----w-   c:\windows\system32\SPReview
2012-01-23 23:32 . 2012-01-23 23:32   --------   d-----w-   c:\windows\system32\EventProviders
2012-01-23 23:30 . 2012-01-23 23:30   737072   ----a-w-   c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2012-01-23 23:30 . 2012-01-23 23:30   4283672   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-01-23 23:30 . 2012-01-23 23:30   42776   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-01-23 23:30 . 2012-01-23 23:30   539984   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-29 12:10 . 2010-10-20 20:33   279656   ------w-   c:\windows\system32\MpSigStub.exe
2012-01-25 18:37 . 2011-02-18 23:38   639   ----a-w-   c:\windows\uninstallstickies.bat
2012-01-23 23:41 . 2009-07-14 02:36   152576   ----a-w-   c:\windows\SysWow64\msclmd.dll
2012-01-23 23:40 . 2009-07-14 02:36   175616   ----a-w-   c:\windows\system32\msclmd.dll
2011-12-03 20:16 . 2011-07-09 17:21   414368   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-28 18:01 . 2011-03-22 21:03   41184   ----a-w-   c:\windows\avastSS.scr
2011-11-28 18:01 . 2011-03-22 21:03   199816   ----a-w-   c:\windows\SysWow64\aswBoot.exe
2011-11-28 18:01 . 2011-03-22 21:03   256960   ----a-w-   c:\windows\system32\aswBoot.exe
2011-11-28 17:54 . 2011-03-22 21:03   591192   ----a-w-   c:\windows\system32\drivers\aswSnx.sys
2011-11-28 17:53 . 2011-03-22 21:03   304472   ----a-w-   c:\windows\system32\drivers\aswSP.sys
2011-11-28 17:52 . 2011-03-22 21:03   42328   ----a-w-   c:\windows\system32\drivers\aswRdr.sys
2011-11-28 17:52 . 2011-03-22 21:03   58712   ----a-w-   c:\windows\system32\drivers\aswTdi.sys
2011-11-28 17:52 . 2011-03-22 21:03   66904   ----a-w-   c:\windows\system32\drivers\aswMonFlt.sys
2011-11-28 17:51 . 2011-03-22 21:03   24408   ----a-w-   c:\windows\system32\drivers\aswFsBlk.sys
2011-11-24 04:52 . 2011-12-14 21:27   3145216   ----a-w-   c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-07-05_17.01.08   )))))))))))))))))))))))))))))))))))))))))

DELETED

.
- Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
"{f78bf7a8-cf12-4de7-a6da-c463d1b539a7}"= "c:\program files (x86)\Dogpile Bundle Toolbar\Helper.dll" [2012-01-10 361984]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CLASSES_ROOT\clsid\{f78bf7a8-cf12-4de7-a6da-c463d1b539a7}]
[HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{C766F9AD-E91E-43DE-91DC-D007680ED4AF}]
[HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{BFE4B5CB-63F7-4A51-9266-6167655D5B4F}]
2012-01-10 18:49   1612800   ----a-w-   c:\program files (x86)\Dogpile Bundle Toolbar\Toolbar.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
2010-10-18 19:26   3908192   ----a-w-   c:\program files (x86)\NCH\tbNCH.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-01-03 23:31   1514152   ----a-w-   c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{c2db4fe6-8409-45ce-8010-189a7b5cce86}"= "c:\program files (x86)\NCH\tbNCH.dll" [2010-10-18 3908192]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
"{C80BDEB2-8735-44C6-BD55-A1CCD555667A}"= "c:\program files (x86)\Dogpile Bundle Toolbar\Toolbar.dll" [2012-01-10 1612800]
.
[HKEY_CLASSES_ROOT\clsid\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{c80bdeb2-8735-44c6-bd55-a1ccd555667a}]
[HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{CCBDEEA9-517A-4862-B0A1-862AE9532228}]
[HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DriverCure"="c:\program files (x86)\ParetoLogic\DriverCure\DriverCure.exe" [2009-08-07 3993368]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-10-21 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files (x86)\PC Tools Firewall Plus\FirewallGUI.exe" [2010-11-29 2676696]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]
"Share-to-Web Namespace Daemon"="c:\program files (x86)\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"ANIWZCS2Service"="c:\program files (x86)\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-22 45056]
.
c:\users\JIM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stickies.lnk - c:\program files (x86)\Stickies\stickies.exe [2011-2-18 1101824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ      kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-21 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-21 136176]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\6D4.tmp

R3 pctNdis;PC Tools Firewall Intermediate Filter Service;c:\windows\system32\DRIVERS\pctNdis64.sys

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe

R4 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
S1 aswSnx;aswSnx;

S1 aswSP;aswSP;

S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi64.sys

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 aswFsBlk;aswFsBlk;

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys

S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter64.sys

S3 pctNdisMP;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis64.sys

S3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw64.sys

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys

.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - AVGIDSDriver
*Deregistered* - AVGIDSEH
*Deregistered* - AVGIDSFilter
*Deregistered* - Avgrkx64
*Deregistered* - Avgtdia
*Deregistered* - pctESPInject
*Deregistered* - SASDIFSV
*Deregistered* - SASKUTIL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
Akamai   REG_MULTI_SZ      Akamai
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-07 c:\windows\Tasks\DriverCure.job
- c:\program files (x86)\ParetoLogic\DriverCure\DriverCure.exe [2009-08-07 19:36]
.
2012-02-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3909975552-3371312792-2741729148-1000Core.job
- c:\users\JIM\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-09 16:33]
.
2012-02-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3909975552-3371312792-2741729148-1000UA.job
- c:\users\JIM\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-09 16:33]
.
2012-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-21 16:45]
.
2012-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-21 16:45]
.
2012-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3909975552-3371312792-2741729148-1000Core.job
- c:\users\JIM\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-08 15:07]
.
2012-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3909975552-3371312792-2741729148-1000UA.job
- c:\users\JIM\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-08 15:07]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01   134384   ----a-w-   c:\program files\AVAST Software\Avast\ashShA64.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.yahoo.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{B9B97401-98E1-4942-930D-C36652DAB7F2} - (no file)
WebBrowser-{C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{C80BDEB2-8735-44C6-BD55-A1CCD555667A} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\6D4.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\PC Tools Firewall Plus\FWService.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
.
**************************************************************************
.
Completion time: 2012-02-17  09:54:11 - machine was rebooted
ComboFix-quarantined-files.txt  2012-02-17 16:54
ComboFix2.txt  2012-01-30 19:59
ComboFix3.txt  2011-07-05 17:05
.
Pre-Run: 200,615,768,064 bytes free
Post-Run: 200,118,099,968 bytes free
.
- - End Of File - - EEDAA5B51DE05D84269BAA2B05A05AA5
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

I have the log in its entirety if you need it.   JIM

[SuperDave]

And now a few more scans.

Please download Rooter and Save it to your desktop.

• Double click it to start the tool.Vista and Windows7 run as administrator.
• Click Scan.
  
• Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
  

*******************************************
AVENGER

• Download The Avenger by Swandog46 from here.
  
• Unzip/extract it to a folder on your desktop.
• Double click on avenger.exe to run The Avenger.
  
• Click OK.
  
• Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  
• Click the Execute button.
  
• You will be asked No script has been entered.  Do you want to execute a rootkit scan only?.
  
• Click Yes.
  
• You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot.  Reboot now?.
  
• Click Yes.
  
• Your PC will now be rebooted.
• After your PC has completed the necessary reboots, a log should automatically open. If it does not automatically open, then the log can be found at %systemdrive%\avenger.txt (typically C:\avenger.txt).
  
• Please post this log in your next reply.