UNSOLVED

lauk101

updated

16 years ago

L

lauk101

31 Posts

0

3704

July 10th, 2010 09:00

No internet connection,

I am trying to help out a friend who had some malware on her computer.  Malwarebytes was used to remove the malware and now there is not internet connection.  I ran HJT on her computer and the following is the log

 

 

 

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:42:21 AM, on 7/10/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll
R3 - URLSearchHook: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O2 - BHO: Ask Toolbar BHO - {F4D76F01-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User '?')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User '?')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User '?')
O4 - HKUS\S-1-5-21-287150465-1581682178-2615787155-1000\..\Run: [Aim6]  (User '?')
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 7330 bytes

  • kevinf80_1d0ac6

    2 Intern

    1131 Posts

    1309

    0

    Posted July 10th, 2010 11:00

    Hi lauk101,

    I`m currently reviewing your log and will reply shortly.


    Kevin

  • kevinf80_1d0ac6

    2 Intern

    1131 Posts

    1309

    0

    Posted July 10th, 2010 12:00

    Hi lauk101

    I'm kevinf80 and I will be helping with any issues you may have. Please be aware that some of the logs I may ask for can be very complex and can take a long time to decipher. I am a volunteer here with a job and family so I ask that you be patient when waiting for replies.
    Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.
    Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together.
    Malware is often buggy and can be very unstable, with that in mind it is advisable to backup any important data before we begin.

    Please proceed as follows :-

    Step 1

    Please re-open HiJackThis and scan only.  Check the boxes next to all the entries listed below.



    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
    R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
    R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll
    R3 - URLSearchHook: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
    O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll
    O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
    O3 - Toolbar: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll

    The following entry shows the welcome screen at startup, if you`d like that to stop then add it to the fix list; if not just leave it out.

    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User '?')



    Now close all windows other than HiJackThis, then click Fix Checked.  Close HiJackThis.  Rebootyour PC.

    Step 2

    Uninstall the following programs if present from Uninstall a Program via the Control Panel:

    SGPSA
    Zynga

    Step 3

    Check for proxy server settings in your browser, the following are the most common used.

    Internet Explorer:
    Tools Menu -> Internet Options  -> Connections Tab ->Lan Settings > uncheck "use a proxy server" and check to "Automatically detect settings".

     
    Firefox:
    Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection. "No Proxy" should be selected , unless you have one set up yourself.

    Chrome:
    Select -> Tools menu ->  then "Options", then  go to "Change Proxy Settings", then "LAN Settings" , then  take out the check mark for "Use a proxy server for your LAN" if set, unless you set this up yourself.

    Step 4


    • Download
    random's system information tool (RSIT) by random/random from here and save it to your desktop.
    • Double click on
    RSIT.exe to run RSIT.
    • Click
    Continue at the disclaimer screen.
    • Once it has finished, two logs will open. Please post the contents of both in reply
    log.txt < info.txt <

    Post both logs from RSIT in your reply and a system update please.

    Kevin.
  • lauk101

    31 Posts

    1309

    0

    Posted July 11th, 2010 15:00

    Thank you for your help.  I have done all the above steps but I still am unable to connect via wired or wireless to the internet.  When I scroll over the connection status icon in the bottom left, it says "The dependency service or group failed to start"

    info.txt logfile of random's system information tool 1.08 2010-07-11 16:33:48

    ======Uninstall list======

    !ntellect-->C:\PROGRA~1\CHAOSS~1\UNWISE.EXE C:\PROGRA~1\CHAOSS~1\Intellect.log
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{028EC2AF-F501-4567-9CEA-140030DE8544}\setup.exe" -l0x9 -u
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2580F4DA-324F-4945-B16F-B2B867325085}\setup.exe" -l0x9 -u
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x9
    -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6366726-BA44-4D6A-8ECE-476E2E616AD1}\setup.exe" -l0x9
    2008 State Tax Printer-->MsiExec.exe /I{DA8398F2-8087-4174-809C-F7DDFEBF4FD8}
    2008 Tax Printer-->MsiExec.exe /I{9407DD24-D13A-4459-A3A2-F46985FD7A1B}
    ABBYY FineReader 6.0 Sprint-->MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
    Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Reader 8.1.5-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
    Advanced Audio FX Engine-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x9  /remove
    Advanced Bridge Defense-->C:\Windows\iun3401.exe C:\Program Files\Master Point Press\Advanced Bridge Defense
    Advanced Video FX Engine-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x9  /remove
    AI RoboForm (All Users)-->"C:\Program Files\Siber Systems\AI RoboForm\rfwipeout.exe"
    AIM 6-->C:\Program Files\AIM6\uninst.exe
    AnswerWorks 5.0 English Runtime-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}\setup.exe" -l0x9  -uninst  -removeonly
    AOL Install-->MsiExec.exe /I{2357B8BC-88C9-4A72-818C-050CC4EB0778}
    Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    ArcSoft Print Creations - Brochure-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F626E006-C06C-466A-B133-92C1991385CA}\Setup.exe" -l0x9  -1Brochure
    ArcSoft Print Creations - Photo Calendar-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F626E006-C06C-466A-B133-92C1991385CA}\Setup.exe" -l0x9  -1Calendar
    ArcSoft Print Creations-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F626E006-C06C-466A-B133-92C1991385CA}\Setup.exe" -l0x9
    Ask Toolbar-->rundll32 C:\PROGRA~1\AskPBar\bar\1.bin\AskPBar.dll,O
    Banctec Service Agreement-->MsiExec.exe /I{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}
    Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
    Bridge Baron 17-->MsiExec.exe /X{2B8AEEF8-8104-45E3-9A5C-521E8E6A6490}
    Bridge Baron 19-->MsiExec.exe /X{D3C57A35-DE0D-475D-9F5E-D1D2DB80C3CF}
    Broadcom Management Programs-->MsiExec.exe /X{C99C0593-3B48-41D9-B42F-6E035B320449}
    Browser Address Error Redirector-->MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F}
    Cain & Abel v4.9.25-->C:\PROGRA~1\Cain\UNINSTAL.EXE C:\PROGRA~1\Cain\Install.log
    Canon Inkjet Printer Driver Add-On Module-->C:\Program Files\Common Files\Canon\IJ\InboxPrnV100\SETUP.EXE -R
    Casino Island To Go-->"C:\Program Files\Oberon Media\Casino Island To Go\Uninstall.exe" "C:\Program Files\Oberon Media\Casino Island To Go\install.log"
    Cisco EAP-FAST Module-->MsiExec.exe /I{BF53252E-4AB2-4C7F-A0FD-6100755745E3}
    Cisco LEAP Module-->MsiExec.exe /I{76F9CF97-FC4B-4E20-B363-D127C888448F}
    Cisco PEAP Module-->MsiExec.exe /I{4E5386F5-C0F6-4532-A54A-374865AEAB71}
    Club Accounting 3-->MsiExec.exe /I{5288A087-30A4-4244-A096-9DBFF37FEDE7}
    Comcast Desktop Software (v1.2.0.9)-->MsiExec.exe /I{CEF7211D-CE3A-44C4-B321-D84A2099AE94}
    Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
    Conexant HDA D330 MDC V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F\UIU32m.exe -U -Idel000fz.INF
    Convention Card Editor 1.1.11-->"C:\Program Files\Convention Card Editor\unins000.exe"
    Crazy Slots Casino-->C:\Program Files\InstallShield Installation Information\{74BD4941-DA54-43CA-9D93-136F648449A9}\setup.exe -runfromtemp -l0x0009 -removeonly
    CutePDF Writer 2.7-->C:\Program Files\Acro Software\CutePDF Writer\uninscpw.exe /uninstall
    Dell Best of Web-->MsiExec.exe /I{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}
    Dell Dock-->MsiExec.exe /I{F6CB42B9-F033-4152-8813-FF11DA8E6A78}
    Dell Getting Started Guide-->MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}
    Dell Support Center (Support Software)-->MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
    Dell Touchpad-->C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE
    Dell Webcam Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1A5BA3E-9ABF-4037-820B-6151022B8ACB}\setup.exe" -l0x9  /remove
    Dell Webcam Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6366726-BA44-4D6A-8ECE-476E2E616AD1}\setup.exe" -l0x9  /remove
    Dell Wireless WLAN Card-->"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card"
    Dell-eBay-->MsiExec.exe /I{B935C985-A17F-484B-8470-09E4FC27DC26}
    Desktop Doctor-->MsiExec.exe /I{D87149B3-7A1D-4548-9CBF-032B791E5908}
    Digital Line Detect-->C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
    Driver Detective-->"C:\Program Files\InstallShield Installation Information\{7395D650-AE5D-4D68-B8FE-D3FA6B51467F}\setup.exe" -runfromtemp -l0x0409 -removeonly
    Driver Detective-->MsiExec.exe /X{7395D650-AE5D-4D68-B8FE-D3FA6B51467F}
    EarthLink Setup Files-->MsiExec.exe /X{255909FA-8E58-4BC2-A83A-3C71EB5DD6EC}
    EDocs-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}\setup.exe"
    Epson Event Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48F22622-1CC2-4A83-9C1E-644DD96F832D}\Setup.exe" -l0x9 -u
    EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
    EPSON WorkForce 600 Series Printer Uninstall-->C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FINSEKA.EXE /R /APD /P:"EPSON WorkForce 600 Series"
    Fast Browser Search (My Web Tattoo)-->regsvr32 /u /s "C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll"
    Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
    Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_E85CDE7661A53A6A.exe" /uninstall
    Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
    Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
    GoToAssist 8.0.0.514-->C:\Program Files\Citrix\GoToAssist\514\G2AUninstaller.exe /uninstall
    HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
    IconLover-->"C:\Program Files\IconLover\uninstall.exe"
    ISO Recorder-->MsiExec.exe /I{39600969-41C3-4658-876E-16F108FC5C92}
    iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
    Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
    Laptop Integrated Webcam Driver (1.04.01.1011)  -->C:\Windows\CtDrvIns.exe -uninstall -script OEM002.uns -plugin OEM02Pin.dll -pluginres OEM02Pin.crl -nodisconprompt -langid 0x0409
    Live! Cam Avatar Creator-->C:\Program Files\InstallShield Installation Information\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}\setup.exe -runfromtemp -l0x0009 -removeonly /remove
    Live! Cam Avatar v1.0-->C:\Program Files\InstallShield Installation Information\{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}\setup.exe -runfromtemp -l0x0009 -removeonly /remove
    Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
    MediaDirect-->C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0009 -cluninstall
    Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
    Microsoft Access 2007 Bible-->C:\Users\rip\Documents\Data\access03\Access2007Bible\SXUNINST.EXE
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    Microsoft Office Access 2007 Inside Out-->MsiExec.exe /X{D87A0AB3-781D-43CC-9D60-CE935D5EFE44}
    Microsoft Office Access 2007 Step by Step-->MsiExec.exe /X{7EE4A27B-1DF4-404D-A97B-800DA9356C17}
    Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
    Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
    Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Live Add-in 1.4-->MsiExec.exe /I{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}
    Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office Professional 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROR /dll OSETUP.DLL
    Microsoft Office Professional 2007-->MsiExec.exe /X{91120000-0014-0000-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
    Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
    Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft Security Essentials-->C:\Program Files\Microsoft Security Essentials\setup.exe /x
    Microsoft Security Essentials-->MsiExec.exe /I{EF98A02A-1748-4762-9B7D-5ED1600520D5}
    Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
    Modem Diagnostic Tool-->MsiExec.exe /I{294EAADF-E50F-4DD8-AD8D-19587EA10512}
    NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
    NetZeroInstallers-->MsiExec.exe /X{352310C3-E46B-42D3-8F32-54721FDD72D9}
    OGA Notifier 2.0.0048.0-->MsiExec.exe /I{B2544A03-10D0-4E5E-BA69-0362FFC20D18}
    OutlookAddinSetup-->MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}
    Quicken 2009-->MsiExec.exe /X{ED2A3C11-3EA8-4380-B59C-F2C1832731B0}
    QuickSet-->MsiExec.exe /I{4B6AD248-D3BF-426A-8D64-847288154F13}
    QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
    Reel Deal Casino Quest! 1.3-->"c:\Program Files\Phantom\Reel Deal Casino Quest\unins000.exe"
    Reel Deal Poker Challenge-->"c:\Program Files\Phantom\Reel Deal Poker Challenge\unins000.exe"
    Reel Deal Slots 1.5-->"C:\Program Files\Reel Deal Slots\unins000.exe"
    Roxio Creator Audio-->MsiExec.exe /I{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}
    Roxio Creator Copy-->MsiExec.exe /I{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}
    Roxio Creator Data-->MsiExec.exe /I{08E81ABD-79F7-49C2-881F-FD6CB0975693}
    Roxio Creator DE-->C:\ProgramData\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe /x {09760D42-E223-42AD-8C3E-55B47D0DDAC3}
    Roxio Creator DE-->MsiExec.exe /I{ED439A64-F018-4DD4-8BA5-328D85AB09AB}
    Roxio Creator Tools-->MsiExec.exe /I{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}
    Roxio Express Labeler 3-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
    Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
    Safari-->MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}
    Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
    Security Update for 2007 Microsoft Office System (KB978380)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {667A88D1-0369-4070-A62A-70672D68A9BF}
    Security Update for Microsoft Office Excel 2007 (KB978382)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {6DE3DABF-0203-426B-B330-7287D1003E86}
    Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
    Security Update for Microsoft Office Publisher 2007 (KB980470)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {34573F17-DADE-4D0D-835F-A54A1DE8AC1F}
    Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
    Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
    Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
    TaxACT 2008 Minnesota-->C:\PROGRA~1\2NDSTO~1\TAXACT~1\\UnStTax.exe C:\PROGRA~1\2NDSTO~1\TAXACT~1\\MN.log
    TaxACT 2008-->C:\PROGRA~1\2NDSTO~1\TAXACT~1\Unta08.exe C:\PROGRA~1\2NDSTO~1\TAXACT~1\Install.log
    The Two Over One System-->C:\Windows\iun506.exe c:\2over1\irunin.ini
    Time and Chaos-->C:\PROGRA~1\CHAOSS~1\UNWISE.EXE C:\PROGRA~1\CHAOSS~1\Chaos7.log
    Toolkit 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E2E8BDDE-6F1B-4A5D-870D-2748DA79360C}\Setup.exe"
    Trillian-->C:\Program Files\Trillian\trillian.exe /uninstall
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for 2007 Microsoft Office System (KB981715)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {661B3F32-FFE4-4606-AE3A-DFA11DCC0D79}
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
    Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
    Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
    Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
    Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}
    Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
    Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
    Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
    Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
    Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
    Update for Outlook 2007 Junk Email Filter (kb981433)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {5A6859A6-042D-4DF7-84E2-79F8DEFB5D48}
    Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
    Windows Live ID Sign-in Assistant-->MsiExec.exe /X{10A44844-4465-456E-8C97-80BDD4F68845}
    WinPcap 4.0.2-->C:\Program Files\WinPcap\uninstall.exe

    Securitycenter WMI appears to be broken

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "Path"=%CommonProgramFiles%\Microsoft Shared\Windows Live;C:\Program Files\Common Files\ArcSoft\Bin;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    "PROCESSOR_ARCHITECTURE"=x86
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "USERNAME"=SYSTEM
    "windir"=%SystemRoot%
    "PROCESSOR_LEVEL"=6
    "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
    "PROCESSOR_REVISION"=0f0d
    "NUMBER_OF_PROCESSORS"=2
    "TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
    "DFSTRACINGON"=FALSE
    "RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\10.0\Roxio Central36\
    "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
    "QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip

    -----------------EOF-----------------

     

     

    Logfile of random's system information tool 1.08 (written by random/random)
    Run by rip at 2010-07-11 16:33:46
    WIN_VISTA Service Pack 2
    System drive C: has 203 GB (69%) free of 292 GB
    Total RAM: 3061 MB (80% free)

    HijackThis download failed

    ======Scheduled tasks folder======

    C:\Windows\tasks\CS.job
    C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A94B111-4504-4e26-AB05-E61E474AA38B}]
    Ask Search Assistant BHO - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL [2008-09-24 61440]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
    AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll []

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
    C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2008-09-12 5751624]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}]
    BrowserHelper Class - C:\Program Files\SGPSA\SearchAssistant.dll [2009-10-15 123904]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
    Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-03-01 279664]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-03-02 812528]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
    CBrowserHelperObject Object - C:\Program Files\Dell\BAE\BAE.dll [2006-11-09 98304]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}]
    Search Assistant - C:\Program Files\SGPSA\BHO.dll [2009-11-10 292864]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4D76F01-7896-458a-890F-E1F05C46069F}]
    Ask Toolbar BHO - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL [2008-09-24 241664]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
    Fast Browser Search Toolbar Helper - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {724d43a0-0d85-11d4-9908-00400523e39a} - &RoboForm - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2008-09-12 5751624]
    {F4D76F09-7896-458a-890F-E1F05C46069F} - Ask Toolbar - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL [2008-09-24 241664]
    {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - Fast Browser Search Toolbar - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll [2009-08-13 2602368]
    {2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-03-01 279664]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    ""= []
    "Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-03-30 1086856]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Aim6"= []
    "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-09-02 68856]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
    C:\Program Files\DellTPad\Apoint.exe [2007-09-24 159744]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2008-04-17 98616]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY]
    C:\PROGRA~1\AVG\AVG8\avgtray.exe []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
    C:\Windows\system32\WLTRAY.exe [2008-05-19 3444736]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe [2008-04-24 202560]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2008-08-14 206064]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Software]
    C:\Program Files\Common Files\supportsoft\bin\bcont.exe [2009-04-24 1025320]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
    C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2008-03-11 16384]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
    C:\Dell\E-Center\EULALauncher.exe [2008-02-28 17920]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
    C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [2008-02-19 591696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.4]
    C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe [2008-10-07 95744]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
    C:\Windows\ehome\ehTray.exe [2008-01-20 125952]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON WorkForce 600 Series]
    C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEKA.EXE [2008-03-04 188928]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FBSSA]
    C:\Program Files\SGPSA\ie3sh.exe [2009-11-19 65344]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-02 29744]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    C:\Windows\system32\hkcmd.exe [2008-04-22 166424]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    C:\Windows\system32\igfxtray.exe [2008-04-22 141848]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-03-30 1086856]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcexecwin]
    C:\Users\rip\AppData\Local\Temp\o1tgx1r.dll, RestoreWindows []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
    c:\Program Files\Microsoft Security Essentials\msseces.exe [2010-02-21 1093208]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
    C:\Windows\OEM02Mon.exe [2007-12-03 36864]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
    C:\Program Files\Dell\MediaDirect\PCMService.exe [2007-12-21 184320]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
    C:\Windows\system32\igfxpers.exe [2008-04-22 133656]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2008-09-12 160592]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
    C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [2008-01-01 405504]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-09-02 68856]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    C:\Program Files\Windows Defender\MSASCui.exe [2008-01-20 1008184]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-20 202240]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    C:\Program Files\Digital Line Detect\DLG.exe [2006-11-03 50688]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]
    C:\Program Files\Dell\QuickSet\quickset.exe [2008-02-22 1193240]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^rip^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^chaos7.exe.lnk]
    C:\Program Files\Chaos Software\Chaos 7\chaos7.exe [2008-11-18 2350568]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^rip^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^eFax 4.4.lnk]
    C:\Program Files\eFax Messenger 4.4\J2GTray.exe [2008-10-07 656896]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist]
    C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll [2008-09-02 10536]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    C:\Windows\system32\igfxdev.dll [2008-04-22 200704]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\GoToAssist]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1
    "EnableUIADesktopToggle"=0

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoFolderOptions"=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "BindDirectlyToPropertySetStorage"=0

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    ======File associations======

    .js - edit - C:\Windows\System32\Notepad.exe %1
    .js - open - C:\Windows\System32\WScript.exe "%1" %*
    .scr - open - "%1" %*

    ======List of files/folders created in the last 3 months======

    2010-07-11 16:33:46 ----D---- C:\rsit
    2010-07-10 07:42:09 ----D---- C:\Program Files\Trend Micro
    2010-04-27 10:30:41 ----A---- C:\Windows\RegGenie.ini
    2010-04-27 10:27:21 ----D---- C:\Program Files\RegGenie
    2010-04-27 04:49:57 ----D---- C:\Program Files\Microsoft
    2010-04-27 04:49:36 ----D---- C:\Program Files\Microsoft Silverlight
    2010-04-26 17:55:37 ----ASH---- C:\hiberfil.sys
    2010-04-24 18:35:33 ----D---- C:\Users\rip\AppData\Roaming\7F95E7039429E74E3F69761901385A74
    2010-04-24 18:35:30 ----D---- C:\ProgramData\avG
    2010-04-14 06:38:16 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
    2010-04-14 06:38:15 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
    2010-04-14 06:38:15 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
    2010-04-14 06:38:12 ----A---- C:\Windows\system32\ntoskrnl.exe
    2010-04-14 06:38:12 ----A---- C:\Windows\system32\ntkrnlpa.exe
    2010-04-14 06:38:07 ----A---- C:\Windows\system32\vbscript.dll
    2010-04-14 06:37:40 ----A---- C:\Windows\system32\drivers\tcpip.sys
    2010-04-14 06:37:39 ----A---- C:\Windows\system32\iphlpsvc.dll
    2010-04-14 06:37:39 ----A---- C:\Windows\system32\drivers\tunnel.sys
    2010-04-14 06:33:35 ----A---- C:\Windows\system32\wintrust.dll
    2010-04-14 06:33:23 ----A---- C:\Windows\system32\cabview.dll

    ======List of files/folders modified in the last 3 months======

    2010-07-11 16:33:18 ----D---- C:\Windows\Temp
    2010-07-11 16:28:29 ----RD---- C:\Program Files
    2010-04-28 03:00:48 ----D---- C:\Windows\system32\drivers
    2010-04-28 03:00:20 ----D---- C:\Windows\Logs
    2010-04-28 03:00:10 ----D---- C:\Windows
    2010-04-27 10:29:33 ----D---- C:\Windows\system32\Tasks
    2010-04-27 10:29:17 ----SHD---- C:\System Volume Information
    2010-04-27 10:27:27 ----RSD---- C:\Windows\Fonts
    2010-04-27 04:53:00 ----SD---- C:\ProgramData\Microsoft
    2010-04-27 04:52:56 ----D---- C:\Windows\inf
    2010-04-27 04:50:35 ----SHD---- C:\Windows\Installer
    2010-04-27 04:50:09 ----D---- C:\Program Files\Common Files\microsoft shared
    2010-04-27 04:33:40 ----D---- C:\Windows\Tasks
    2010-04-26 18:50:14 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2010-04-26 15:33:02 ----A---- C:\Windows\ntbtlog.txt
    2010-04-25 11:41:35 ----HD---- C:\ProgramData
    2010-04-25 08:42:23 ----D---- C:\Windows\Prefetch
    2010-04-17 08:50:42 ----D---- C:\Windows\system32\catroot2
    2010-04-17 07:07:22 ----D---- C:\Windows\winsxs
    2010-04-15 08:56:12 ----D---- C:\Windows\system32\catroot
    2010-04-15 08:53:53 ----D---- C:\Windows\System32
    2010-04-15 08:53:53 ----D---- C:\Program Files\Windows Mail
    2010-04-15 08:11:39 ----D---- C:\ProgramData\Microsoft Help
    2010-04-15 01:41:53 ----A---- C:\Windows\system32\PerfStringBackup.INI

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R0 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iastor.sys [2007-04-23 277784]
    R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2007-11-14 43840]
    R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2009-12-02 149040]
    R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2008-06-23 12672]
    R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2006-11-27 32256]
    R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2006-11-27 43520]
    R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-27 37376]
    R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2008-06-23 8704]
    R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-09-24 155136]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-05-21 179712]
    R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2008-05-19 1044984]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
    R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2008-06-23 980992]
    R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2008-06-23 208384]
    R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-04-22 2016256]
    R3 OEM02Dev;Creative Camera OEM002 Driver; C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-12-03 235648]
    R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver; C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-12-03 7424]
    R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-10 89088]
    R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2008-01-01 330240]
    R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2008-06-23 661504]
    S3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys []
    S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-20 5632]
    S3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-20 220672]
    S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-20 8192]
    S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-20 5888]
    S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-20 5504]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-20 6016]
    S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 2028032]
    S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-20 35328]
    S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-20 83328]
    S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-20 6656]
    S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-20 386616]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2008-05-19 24064]
    S4 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2008-04-17 102712]
    S4 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2008-01-01 73728]
    S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
    S4 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
    S4 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
    S4 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-20 21504]
    S4 GoogleDesktopManager-010708-104812;Google Desktop Manager 5.7.801.7324; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-02 29744]
    S4 GoToAssist;GoToAssist; C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe [2008-09-02 16680]
    S4 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-02 135664]
    S4 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-03-01 182768]
    S4 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
    S4 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Essentials\MsMpEng.exe [2009-12-09 17904]
    S4 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
    S4 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S4 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
    S4 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
    S4 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-08-14 201968]
    S4 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2008-01-01 102400]
    S4 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2008-03-24 74384]
    S4 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
    S4 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2008-06-23 386560]

    -----------------EOF-----------------

     

  • kevinf80_1d0ac6

    2 Intern

    1131 Posts

    1309

    0

    Posted July 12th, 2010 06:00

    Hi lauk101

    • Select the Windows key and R Key together.
    • In the open box type or copy paste services.msc
    • Select OK or tap Enter
    • In the new window scroll down to WLAN Auto Config
    • The status should be Started and Startup type should be Automatic if not so do the following,
    • Right click on that line and select Properties
    • In the new window under the General tab Use the dropdown at Startup type and change to Automatic.
    • Select Apply then OK


    Also check the settings for Wired Auto Config Re-boot and see if connection is ok.

    Next, run Combofix. You can d/load and save to a memory stick or cd from anther PC and transfer to the DESKTOP of the problem one if necessary.

    Download Combofix from either of these links and save to your Desktop that is very important. Combofix must be run from the Desktop and all security programs must have realtime protection turned off, The following link may help:

    How to disable RealtimeProtection

    Download links for Combofix:

    Link 1
    Link 2
    Link 3

    Using ComboFix

    If you get a successful download and it will not run, delete it. Re-download again from the link that worked, but rename it to EXPLORER before saving to your desktop. Very Important

    The first thing you should do is print out this guide, as we will close all the open windows and programs, including your web browser, before starting the ComboFix program.

    To download ComboFix, simply left-click on one of the links above and you will see a prompt similar to the figure below.

    user posted image

    Click on the Save button, and when it asks you where to save it, make sure you save it directly to your Windows Desktop. An image showing this is below.

    user posted image

    When you have the Save as screen configured to save ComboFix.exe to the Desktop, click on the Save button. ComboFix will now start downloading to your computer. If you are on a dialup, this may take a few minutes. When ComboFix has finished downloading you will now see an icon on your desktop similar to the one below.

    user posted image
    ComboFix Icon

    We are almost ready to start ComboFix, but before we do so, we need to take some preventative measures so that there are no conflicts with other programs when running ComboFix. At this point you should do the following:
    • Close all open Windows including this one.
    • Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.

    Click HERE to see a list of list of programs that should be disabled, please note; this list is not all inclusive.

    Once these two steps have been completed, double-click on the ComboFix icon found on your desktop. Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all. The scan could take a while, so please be patient.

    Once you double-click on the icon, you may see a screen similar to the one below.

    user posted image
    Windows Open File Security Warning

    Windows is issuing this prompt because ComboFix does not have a digital signature. This is perfectly normal and safe and you can click on the Run button to continue. If you are using Windows Vista, and receive UAC prompt asking if you would like to continue running the program, you should press the Continue button.

    You will now see the first ComboFix screen as shown below. The screen says wait Combofix is preparing to run

    user posted image
    ComboFix is Preparing to Run

    ComboFix is now preparing to run and when it has finished you will see a screen showing the authorized locations to download Combofix. This screen, press the OK button and you will now see the Disclaimer screen shown below.

    user posted image
    ComboFix Disclaimer


    If you do not agree to the disclaimer, then click on the No button to exit the program. Otherwise, to continue you should press the Yes button to continue. If you decided to continue, then ComboFix will create a System Restore point so that if any problems occur while using the program you can restore back to your previous configuration. When ComboFix has finished creating the restore point, it will then backup your Windows Registry as shown in the image below.

    user posted image
    ComboFix is backing up the Windows Registry

    Once the Windows Registry has finished being backed up, ComboFix will attempt to detect if you have the Windows Recovery Console installed. If you already have it installed, you can skip to this section and continue reading. Otherwise you will see the following message as shown below:

    user posted image
    ComboFix Recovery Console

    At the above message box, please click on the Yes button in order for ComboFix to continue. Please follow the steps and instructions given by ComboFix in order to finish the installation of the Recovery Console. Once it has finished installing, you will be presented with the screen shown below.

    user posted image
    ComboFix Recovery Console Finished

    You should now press the Yes button to continue. If at any time during the Recovery Console installation you receive a message stating that it failed to install, please allow ComboFix to continue with the scan of your computer. When it is done, and a log has been created, you can then perform the manual install of the Recovery Console using the steps found in the Manually installing the Windows Recovery Console section.


    ComboFix will now disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection.

    user posted image
    ComboFix is scanning the computer for infections

    ComboFix will now start scanning your computer for known infections. This procedure can take some time, so please be patient.

    user posted image
    Stages of the ComboFix AutoScan

    While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. You will also see the text in the ComboFix window being updated as it goes through the various stages of its scan. An example of this can be seen below.

    user posted image
    34th Stage of the ComboFix AutoScan

    At the time of this writing there are a total of 50 stages as shown in the image below, so please be patient. The amount of stages will go up as time goes on, so if the amount of stages is different when you run it, please do not be concerned.

    user posted image
    ComboFix is preparing the log report

    When ComboFix has finished running, you will see a screen stating that it is preparing the log report as shown below.

    user posted image
    ComboFix is almost done!

    This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt. This can be seen in the image below.

    When ComboFix has finished, it will automatically close the program and change your clock back to its original format. It will then display the log file automatically for you as shown below.

    user posted image
    ComboFix Log File

    You should now post this log in your next reply.

    Copy and paste the log in you reply from here.. C:\ComboFix.txt if you don`t see it on your desk top.

    kevinf80
  • lauk101

    31 Posts

    1309

    0

    Posted July 12th, 2010 15:00

     

     

    When I try to start the WLAN autoconfig I get the message :

    Windows could not start the WLAN AutoConfig service on local computer

    Error 1068: The dependency service or group failed to start

     

     

    ComboFix 10-07-12.02 - rip 07/12/2010  16:03:34.1.2 - x86
    Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.3061.2434 [GMT -5:00]
    Running from: c:\users\rip\Desktop\ComboFix.exe
     * Created a new restore point
    .

    (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\Fast Browser Search
    c:\program files\Fast Browser Search\IE\1.bat
    c:\program files\Fast Browser Search\IE\about.html
    c:\program files\Fast Browser Search\IE\affid.dat
    c:\program files\Fast Browser Search\IE\basis.xml
    c:\program files\Fast Browser Search\IE\basis_br.xml
    c:\program files\Fast Browser Search\IE\basis_de.xml
    c:\program files\Fast Browser Search\IE\basis_en.xml
    c:\program files\Fast Browser Search\IE\basis_es.xml
    c:\program files\Fast Browser Search\IE\basis_fr.xml
    c:\program files\Fast Browser Search\IE\basis_it.xml
    c:\program files\Fast Browser Search\IE\basis_nr.xml
    c:\program files\Fast Browser Search\IE\basis_pt.xml
    c:\program files\Fast Browser Search\IE\basis_ru.xml
    c:\program files\Fast Browser Search\IE\basis_tr.xml
    c:\program files\Fast Browser Search\IE\BHO.dll
    c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
    c:\program files\Fast Browser Search\IE\error.html
    c:\program files\Fast Browser Search\IE\fbsProtection.xml
    c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
    c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
    c:\program files\Fast Browser Search\IE\FBStoolbar.dll
    c:\program files\Fast Browser Search\IE\fbstoolbar.jar
    c:\program files\Fast Browser Search\IE\fbstoolbar.manifest
    c:\program files\Fast Browser Search\IE\icons.bmp
    c:\program files\Fast Browser Search\IE\IE3SH.exe
    c:\program files\Fast Browser Search\IE\info.txt
    c:\program files\Fast Browser Search\IE\local.xml
    c:\program files\Fast Browser Search\IE\logobg.bmp
    c:\program files\Fast Browser Search\IE\MTWB3SH.dll
    c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
    c:\program files\Fast Browser Search\IE\search.bmp
    c:\program files\Fast Browser Search\IE\search_br.bmp
    c:\program files\Fast Browser Search\IE\search_de.bmp
    c:\program files\Fast Browser Search\IE\search_es.bmp
    c:\program files\Fast Browser Search\IE\search_fr.bmp
    c:\program files\Fast Browser Search\IE\search_it.bmp
    c:\program files\Fast Browser Search\IE\search_pt.bmp
    c:\program files\Fast Browser Search\IE\search_ru.bmp
    c:\program files\Fast Browser Search\IE\SearchAssistant.dll
    c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe
    c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico
    c:\program files\Fast Browser Search\IE\SGPU.ico
    c:\program files\Fast Browser Search\IE\sgpUpdater.exe
    c:\program files\Fast Browser Search\IE\sgpUpdater.xml
    c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe
    c:\program files\Fast Browser Search\IE\tbhelper.dll
    c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
    c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
    c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
    c:\program files\Fast Browser Search\IE\Toolbar Help.htm
    c:\program files\Fast Browser Search\IE\uninstall.exe
    c:\program files\Fast Browser Search\IE\uninstalSGP.exe
    c:\program files\Fast Browser Search\IE\uninstalSGPU.exe
    c:\program files\Fast Browser Search\IE\update.exe
    c:\program files\Fast Browser Search\IE\version.txt
    c:\program files\RegGenie
    c:\program files\RegGenie\Backups\40295.4371428472
    c:\program files\RegGenie\RegGenie.ini
    c:\program files\SGPSA
    c:\program files\SGPSA\BHO.dll
    c:\program files\SGPSA\ie3sh.exe
    c:\program files\SGPSA\mtwb3sh.dll
    c:\program files\SGPSA\SearchAssistant.dll
    c:\users\Public\RemoveSGP.exe
    c:\users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\11y1s.jpg
    c:\users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\42T2xiRV.jpg
    c:\users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\8528pUE3.jpg
    c:\users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\jaj5T6u.jpg
    c:\users\rip\AppData\Local\syssvc.exe
    c:\users\rip\GoToAssistDownloadHelper.exe
    c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
    c:\windows\jestertb.dll
    c:\windows\system32\st325614.dll
    c:\windows\system32\winload.exe
    c:\windows\xpsp1hfm.log

    .
    (((((((((((((((((((((((((   Files Created from 2010-06-12 to 2010-07-12  )))))))))))))))))))))))))))))))
    .

    2010-07-12 21:14 . 2010-07-12 21:16 -------- d-----w- c:\users\rip\AppData\Local\temp
    2010-07-12 21:14 . 2010-07-12 21:14 -------- d-----w- c:\users\Default\AppData\Local\temp
    2010-07-11 21:33 . 2010-07-11 21:33 -------- d-----w- C:\rsit
    2010-07-10 12:42 . 2010-07-10 12:42 -------- d-----w- c:\program files\Trend Micro

    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-04-28 20:25 . 2008-09-09 21:07 102424 ----a-w- c:\users\rip\AppData\Local\GDIPFONTCACHEV1.DAT
    2008-09-02 09:37 . 2008-09-02 09:37 76 --sh--r- c:\windows\CT4CET.bin
    2008-09-02 12:11 . 2008-09-02 12:11 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
    .

    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{0A94B116-4504-4e26-AB05-E61E474AA38B}"= "c:\program files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL" [2008-09-24 61440]

    [HKEY_CLASSES_ROOT\clsid\{0a94b116-4504-4e26-ab05-e61e474aa38b}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-02 68856]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
    2008-09-02 09:54 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
    backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
    backup=c:\windows\pss\QuickSet.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Users^rip^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^chaos7.exe.lnk]
    path=c:\users\rip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chaos7.exe.lnk
    backup=c:\windows\pss\chaos7.exe.lnkStartup

    [HKLM\~\startupfolder\C:^Users^rip^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^eFax 4.4.lnk]
    path=c:\users\rip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eFax 4.4.lnk
    backup=c:\windows\pss\eFax 4.4.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2008-10-15 07:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
    2007-09-24 09:27 159744 ----a-w- c:\program files\DellTPad\Apoint.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
    2008-04-17 19:14 98616 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
    2008-05-19 06:26 3444736 ----a-w- c:\windows\System32\WLTRAY.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
    2008-04-24 18:25 202560 ----a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
    2008-08-14 05:04 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Software]
    2009-04-24 07:57 1025320 ----a-w- c:\program files\Common Files\supportsoft\bin\bcont.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
    2008-03-11 17:44 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
    2008-02-29 04:18 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
    2008-02-19 22:05 591696 ------w- c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.4]
    2008-10-07 20:25 95744 ----a-w- c:\program files\eFax Messenger 4.4\J2GDllCmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
    2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON WorkForce 600 Series]
    2008-03-04 14:00 188928 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIEKA.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
    2008-09-02 09:45 29744 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    2008-04-22 06:11 166424 ----a-w- c:\windows\System32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    2008-04-22 06:11 141848 ----a-w- c:\windows\System32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2008-11-20 19:20 290088 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
    2010-03-30 05:46 1086856 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
    2010-02-21 10:03 1093208 ----a-w- c:\program files\Microsoft Security Essentials\msseces.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
    2007-12-03 05:58 36864 ----a-w- c:\windows\OEM02Mon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
    2007-12-21 15:58 184320 ------w- c:\program files\Dell\MediaDirect\PCMService.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
    2008-04-22 06:11 133656 ----a-w- c:\windows\System32\igfxpers.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2008-11-04 16:30 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
    2008-09-13 04:21 160592 ----a-w- c:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
    2008-01-02 04:37 405504 ----a-w- c:\program files\Sigmatel\C-Major Audio\WDM\sttray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    2008-09-02 09:45 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):dd,c1,c3,a6,71,b9,ca,01

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-287150465-1581682178-2615787155-1000]
    "EnableNotificationsRef"=dword:00000001

    R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2008-01-02 73728]
    R4 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
    R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-02 135664]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-05-21 179712]


    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - DOT3SVC

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ    FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2010-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-02 14:07]

    2010-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-02 14:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride =
    IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    Trusted Zone: irs.gov\www
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Aim6 - (no file)
    MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe
    MSConfigStartUp-FBSSA - c:\program files\SGPSA\ie3sh.exe
    MSConfigStartUp-mcexecwin - c:\users\rip\AppData\Local\Temp\o1tgx1r.dll

     

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-07-12 16:16
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ... 

    scanning hidden autostart entries ...

    scanning hidden files ... 

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2010-07-12  16:19:10
    ComboFix-quarantined-files.txt  2010-07-12 21:19

    Pre-Run: 212,735,881,216 bytes free
    Post-Run: 215,253,319,680 bytes free

    - - End Of File - - E8EE4D9321709BE6645307116F919FF1

  • kevinf80_1d0ac6

    2 Intern

    1131 Posts

    1309

    0

    Posted July 12th, 2010 17:00

    Hi lauk101,

    Please continue as follows :-

    Step 1

    Uninstall the following from "Uninstall a Program" via your Control Panel

    AskPBar

    Step 2

    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    3. Open notepad and copy/paste the text inbetween the dotted lines below:

    ---------------------------------------------------------------------------------------------------------------------------------------------------------------------
    KillAll::

    File::
    c:\windows\CT4CET.bin
    Folder::
    c:\program files\AskPBar
    Registry::
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{0A94B116-4504-4e26-AB05-E61E474AA38B}"=-
    [-HKEY_CLASSES_ROOT\clsid\{0a94b116-4504-4e26-ab05-e61e474aa38b}]
    RegLock::
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    -----------------------------------------------------------------------------------------------------------------------------------------------------------------------

    Save this as CFScript.txt, in the same location as ComboFix.exe

    user posted image

    user posted image

    Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

    Step 3

    If you now have an internet connection :-

    Run an online virus scan with Kaspersky from HERE. This scan is very thorough and may take several hours to run, please allow it to complete.

    1. At the main page. Press on " Accept". After reading the contents.
    2. At the next window Select  Update. Allow the Database to update.
    Note: If prompted to run or update your Java, then follow the prompts to do so. Kaspersky requires Java to run.
    3. Once the Database has finished, under the Scan icon Select My Computer to start the scan. The scan may take a few minutes to complete.
    4. Select Scan Report.
    5. If any threats were found they will appear in the report
    6. Select "Save error report as"
    Then in the file name just type in kaspersky
    Under "save as type" select text .txt
    Save it to your Desktop.
    Copy and post the results of the Kaspersky Online scan. If no threats were found then report that as well.

    The following animation may help.

    Kaspersky Gif

    Let me see the logs from Combofix, Kaspersky and a fresh HJT log in reply please.

    Kevin.






























































  • lauk101

    31 Posts

    1309

    0

    Posted July 19th, 2010 16:00

    sorry for the delay in response, I've been very busy.  Just a note, I still cannot get internet access and also could not find the AskPBar in the uninstall list.

    ComboFix 10-07-12.02 - rip 07/19/2010  17:31:11.2.2 - x86
    Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.3061.2345 [GMT -5:00]
    Running from: c:\users\rip\Desktop\ComboFix.exe
    Command switches used :: c:\users\rip\Desktop\CFScript.txt
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
     * Created a new restore point
    .
    - REDUCED FUNCTIONALITY MODE -

    FILE ::
    "c:\windows\CT4CET.bin"
    .

    (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\AskPBar
    c:\windows\CT4CET.bin
    c:\windows\system32\winload.exe

    .
    (((((((((((((((((((((((((   Files Created from 2010-06-19 to 2010-07-19  )))))))))))))))))))))))))))))))
    .

    2010-07-20 01:34 . 2009-04-11 06:33 986600 ----a-w- c:\windows\system32\winload.exe
    2010-07-19 22:33 . 2010-07-19 22:35 -------- d-----w- c:\users\rip\AppData\Local\temp
    2010-07-19 22:33 . 2010-07-19 22:33 -------- d-----w- c:\users\Public\AppData\Local\temp
    2010-07-11 21:33 . 2010-07-11 21:33 -------- d-----w- C:\rsit
    2010-07-10 12:42 . 2010-07-10 12:42 -------- d-----w- c:\program files\Trend Micro

    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-04-28 20:25 . 2008-09-09 21:07 102424 ----a-w- c:\users\rip\AppData\Local\GDIPFONTCACHEV1.DAT
    2008-09-02 12:11 . 2008-09-02 12:11 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
    .

    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-02 68856]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
    2008-09-02 09:54 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
    backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
    backup=c:\windows\pss\QuickSet.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Users^rip^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^chaos7.exe.lnk]
    path=c:\users\rip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chaos7.exe.lnk
    backup=c:\windows\pss\chaos7.exe.lnkStartup

    [HKLM\~\startupfolder\C:^Users^rip^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^eFax 4.4.lnk]
    path=c:\users\rip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eFax 4.4.lnk
    backup=c:\windows\pss\eFax 4.4.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2008-10-15 07:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
    2007-09-24 09:27 159744 ----a-w- c:\program files\DellTPad\Apoint.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
    2008-04-17 19:14 98616 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
    2008-05-19 06:26 3444736 ----a-w- c:\windows\System32\WLTRAY.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
    2008-04-24 18:25 202560 ----a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
    2008-08-14 05:04 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Software]
    2009-04-24 07:57 1025320 ----a-w- c:\program files\Common Files\supportsoft\bin\bcont.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
    2008-03-11 17:44 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
    2008-02-29 04:18 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
    2008-02-19 22:05 591696 ------w- c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.4]
    2008-10-07 20:25 95744 ----a-w- c:\program files\eFax Messenger 4.4\J2GDllCmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
    2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON WorkForce 600 Series]
    2008-03-04 14:00 188928 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIEKA.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
    2008-09-02 09:45 29744 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    2008-04-22 06:11 166424 ----a-w- c:\windows\System32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    2008-04-22 06:11 141848 ----a-w- c:\windows\System32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2008-11-20 19:20 290088 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
    2010-03-30 05:46 1086856 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSSE]
    2010-02-21 10:03 1093208 ----a-w- c:\program files\Microsoft Security Essentials\msseces.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
    2007-12-03 05:58 36864 ----a-w- c:\windows\OEM02Mon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
    2007-12-21 15:58 184320 ------w- c:\program files\Dell\MediaDirect\PCMService.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
    2008-04-22 06:11 133656 ----a-w- c:\windows\System32\igfxpers.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2008-11-04 16:30 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
    2008-09-13 04:21 160592 ----a-w- c:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
    2008-01-02 04:37 405504 ----a-w- c:\program files\Sigmatel\C-Major Audio\WDM\sttray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    2008-09-02 09:45 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
    2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):dd,c1,c3,a6,71,b9,ca,01

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-287150465-1581682178-2615787155-1000]
    "EnableNotificationsRef"=dword:00000001

    R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2008-01-02 73728]
    R4 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]
    R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-02 135664]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-05-21 179712]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ    FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2010-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-02 14:07]

    2010-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-02 14:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride =
    IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    Trusted Zone: irs.gov\www
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-07-19 17:36
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ... 

    scanning hidden autostart entries ...

    scanning hidden files ... 

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\System32\WLTRYSVC.EXE
    c:\windows\System32\bcmwltry.exe
    .
    **************************************************************************
    .
    Completion time: 2010-07-19  17:43:31 - machine was rebooted
    ComboFix-quarantined-files.txt  2010-07-19 22:43
    ComboFix2.txt  2010-07-12 21:19

    Pre-Run: 215,619,743,744 bytes free
    Post-Run: 215,518,371,840 bytes free

    - - End Of File - - 2A107F26F25E2B33EAB22D6CA0041B46

     

     

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:48:45 PM, on 7/19/2010
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18904)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\WerCon.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
    O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
    O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
    O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
    O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
    O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

    --
    End of file - 5294 bytes

  • kevinf80_1d0ac6

    2 Intern

    1131 Posts

    1309

    0

    Posted July 19th, 2010 18:00

    Hi lauk101,

    You mentioned at the start of the thread that Malwarebytes was used to remove some malware, since then you`ve had no internet connection. Can you post that log from Malwarebytes for me to see.

    Open Malwarebytes > Select the Logs Tab > Highlight the relevent log by selecting it > Then select open > the log will open in Notepad > copy and paste the log to next reply please.

    Kevin

  • lauk101

    31 Posts

    1312

    0

    Posted July 20th, 2010 14:00

    There were 2 scans that I found that had the infections.

    Malwarebytes' Anti-Malware 1.45
    www.malwarebytes.org

    Database version: 3930

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18904

    4/26/2010 9:33:04 PM
    mbam-log-2010-04-26 (21-33-04).txt

    Scan type: Full scan (C:\|D:\|)
    Objects scanned: 336426
    Time elapsed: 1 hour(s), 56 minute(s), 13 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 0
    Registry Keys Infected: 3
    Registry Values Infected: 5
    Registry Data Items Infected: 4
    Folders Infected: 0
    Files Infected: 14

    Memory Processes Infected:
    C:\Users\rip\AppData\Local\ave.exe (Rogue.MultipleAV) -> Unloaded process successfully.

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf (Rootkit.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@mywebsearch.com/Plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\secfile\shell\open\command\(default) (Rogue.MultipleAV) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\rip\AppData\Local\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Users\rip\AppData\Local\Temp\RarSFX0\hor0410e.exe (Adware.Adrotator) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\RarSFX0\hor0410e.exe (Adware.Adrotator) -> Quarantined and deleted successfully.
    C:\Windows\System32\drivers\npf.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\services.exe (Password.Stealer) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\winlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\smss.exe (Trojan.Agent) -> Delete on reboot.
    C:\Users\rip\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

     

     

    Malwarebytes' Anti-Malware 1.45
    www.malwarebytes.org

    Database version: 4041

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18904

    4/27/2010 4:33:40 AM
    mbam-log-2010-04-27 (04-33-40).txt

    Scan type: Full scan (C:\|D:\|)
    Objects scanned: 340262
    Time elapsed: 4 hour(s), 22 minute(s), 28 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 1
    Registry Keys Infected: 1
    Registry Values Infected: 4
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 79

    Memory Processes Infected:
    C:\Users\rip\AppData\Local\Temp\dfh94y93ca.exe (Trojan.Ertfor) -> Unloaded process successfully.

    Memory Modules Infected:
    C:\Users\rip\AppData\Local\Temp\o1tgx1r.dll (Trojan.Ertfor) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcexecwin (Trojan.Ertfor) -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87sdhfush87fsufhuie3fddf (Trojan.Ertfor) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qzaib7kitk (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Users\rip\AppData\Local\Temp\o1tgx1r.dll (Trojan.Ertfor) -> Delete on reboot.
    C:\Users\rip\AppData\Local\Temp\dfh94y93ca.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0CLCDBPC\fjnvpk[1].htm (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CZTHHRMO\oriqbjdp[1].htm (Trojan.Ertfor) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CZTHHRMO\hypwhc[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\POA1JXNX\fwelcx[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIWMBE95\newupdate1142C[1].exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIWMBE95\rvqxfn[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIWMBE95\kkemu[1].htm (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\rip\AppData\Roaming\7F95E7039429E74E3F69761901385A74\newupdate1142C.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\rknfl.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\uaufqma.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\user.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\icqafd.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\iexplarer.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\install.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\000038f8 (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\000073fd (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\826525184.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\4022457592.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\4119880395.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\2980551976.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\2411470352.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\cmd.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\3568805481.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\spoolsv.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\notepad.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\nvsvc32.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\oawermnxsc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\897118377.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\dgwdig.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\drweb.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\win.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\win16.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\winamp.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\zj0ww17omaqz63i3.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\hexdump.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\login.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\mdm.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\avp.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\avp32.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\b6purn2.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\n0r2l.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\0.09634790483338762.exe (Trojan.Spambot) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\00003077 (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\000065c8 (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\1545.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\3184045481.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\avp.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\Compreg.dll (Spyware.Passwords) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\csrss.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\debug.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\esmwaorxnc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\gmfrxpgv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\hexdump.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\ie8h5jjmiq2bil.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\install.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\installchkntfs64x.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\login.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\nbmrh.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\qkxidr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\rw9x3run.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\sgpwrj.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\spoolsv.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\taskmgr.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\TMP12C6.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\TMP4B2.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\TMPCABE.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\uaufqma.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\vb6jho.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Low\win32.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Roaming\7F95E7039429E74E3F69761901385A74\newupdate1142C.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Windows\Temp\154437C.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
    C:\Windows\Temp\ins178B.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\Temp\esm348A.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Windows\Temp\oawADA1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\rip\AppData\Local\Temp\Fgm.exe (Trojan.FakeAlert) -> Delete on reboot.

  • kevinf80_1d0ac6

    2 Intern

    1131 Posts

    656

    0

    Posted July 20th, 2010 15:00

    Hi lauk101,

    Can you try the following command for me and see if it helps:

    Step 1

    Select the Windows key and R key together, either type or copy/paste netsh winsock reset into the open box and then select OK, wait 1 minute, literally and then reboot.

    Step 2

    I gave you this to do early in the thread, I took it for granted that you would use Apply and OK at the end, you may have done, can you re-check just to make sure. Open Internet explorer --> Select
    --> Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" and check to "Automatically detect settings" --> Apply ---> OK.
    Re-boot and try your connection. If it still fails move on to step3.

    Step 3

    Download TDSSKILLER and save it to your Desktop. D/L on clean pc and transfer to Desktop of infected one.

    • Extract the file and run it.
    • Once completed it will create a log in your C:\ drive
    • Please post the contents of that log in next reply
    • If asked to re-boot, please do so



    I`d like to see the TDSSKiller log, it will look similar to this TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt and will be located on your C:\ drive. START > My Comp > C:\TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt Copy/paste to reply.

    In reply let me see TDSSKiller log if connection not returned, also let me see a fresh HJT log

    Kevin.