Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Sneeky malware, browser hijack

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Sneeky malware, browser hijack

Unread postby Seep34 » July 11th, 2011, 12:27 pm

Hi,

Hope you can help me. During the last few weeks, I've been malware that rendered my kid's computer unusable, when scores of warning messages plastered the screen, saying that the computer was infected with W32/Blaster-A virus. I deleted a suspected rouge virus protection program and the messages stopped, except when I tried to run any of the computer's resident anti-malware programs; they were all blocked with the same W32/Blaster-A virus message.

I loaded several anti-malware programs onto a thumb-drive. Some ran, and some were blocked. I ran microsoft's malicious virus removal tool and kaspersky's virus removal tool. I reloaded Avast. Slowly, the viruses and trojans began to thin out. I estimate that more than 30 trojans were deleted. However, the computer never reached a clean status since every scan yields new threats. Last week, for example, 6 files were infected (and deleted) with Java:Agent-LC. A day later, 13 files were infected with variants of Java:Agent- (after the dash insert two letters) and Other:Malware-gen. Within the last few days, infections have been detected in the boot sector, rootkit, registry and files (with Trojan.Tracur, Trojan.BHO and Win32:Malware-gen). Most of the scans take approximately between 30-90 minutes to run. (BTW, I never found any traces of Win32/Blaster-A.)

There are three main problems:

1) My inability to definitively delete the malware that seems to find ways of morphing and attacking various parts of the computer.

2) When clicking results of a Google search in Firefox (etc.), I find myself redirected elsewhere. That made it very difficult to reach anti-malware sites, where I could get advice or download scanners, etc.

3) The user/administrator structure on the computer seems to be messed up. There is an administrator name, which I can't log into; I can only use the password when prompted for administrator approval. There are user ID's which don't seem to be password protected and appear to be structurally jumbled up. I haven't dwelt too much on this, but I can't be proactive--only reactive.

I know I've got one messed up computer. Thanks in advance, for your help.

Attached are the two requested DDS scan results.

Seep34

.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_17
Run by Rachel Mindel at 11:21:10 on 2011-07-11
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3998.1380 [GMT -4:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Spybot - Search & Destroy *Enabled/Updated* {1EAF1D03-5480-F3B2-EB14-11F0F5EE2699}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton 360 *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\STacSV64.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\lxbvcoms.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\ooVoo\ooVoo.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Skype\Toolbars\Shared\SkypeNames.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... on&pf=cnnb
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
BHO: PriceGongBHO Class: {1631550f-191d-4826-b069-d9439253d926} - C:\Program Files (x86)\PriceGong\2.1.0\PriceGongIE.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\IPSBHO.DLL
BHO: ooVoo Toolbar: {a1fb2f9a-d35e-11dd-8935-e46a56d89593} - C:\Program Files (x86)\oovootb\oovoodx.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
BHO: FBLayouts Plugin: {ff4e1d1d-705b-4379-ab33-22d98c1abf55} - C:\Program Files (x86)\FBLayouts\fblayouts.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\coIEPlg.dll
TB: ooVoo Toolbar: {a1fb2f9a-d35e-11dd-8935-e46a56d89593} - C:\Program Files (x86)\oovootb\oovoodx.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [AnVir Task Manager Free] "C:\Program Files (x86)\AnVir Task Manager Free\AnVir.exe" Minimized
uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
mRun: [CLMLServer for HP TouchSmart] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
mRun: [UCam_Menu] "C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
mRun: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
mRun: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
mRun: [WinPatrol] "C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe" -expressboot
mRun: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
mRunOnce: [Uninstall Adobe Download Manager] "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
mRunOnce: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /install /silent
mRunOnce: [GrpConv] grpconv -o
dRunOnce: [<NO NAME>]
StartupFolder: C:\Users\RACHEL~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\SETUP_~1.LNK - C:\Users\Rachel Mindel\Desktop\Virus Removal Tool1\setup_9.0.0.722_03.07.2011_17-11\startup.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\Hp\Digital Imaging\bin\hpqtra08.exe
uPolicies-explorer: NoInstrumentation = 1 (0x1)
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
LSP: C:\Windows\system32\wpclsp.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shoc ... tor/sw.cab
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E6BB2089-163F-466B-812A-748096614DFD} - hxxp://cainternetsecurity.net/scanner/cascanner.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{04E103AE-BDC5-497F-933A-C5E6AA0E1F20} : DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{8BD21D8B-16AE-4A4D-BE90-91571A8D5AF2} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{C2370A83-364F-4105-905A-275EB21DFC24} : DhcpNameServer = 192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\CoIEPlg.dll
Notify: SDWinLogon - SDWinLogon.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: PriceGongBHO Class: {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.1.0\PriceGongIE.dll
BHO-X64: PriceGong - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll
BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\coIEPlg.dll
BHO-X64: Symantec NCO BHO - No File
BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\IPSBHO.DLL
BHO-X64: Symantec Intrusion Prevention - No File
BHO-X64: ooVoo Toolbar: {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files (x86)\oovootb\oovoodx.dll
BHO-X64: ooVoo Toolbar - No File
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll
BHO-X64: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
BHO-X64: FBLayouts Plugin: {FF4E1D1D-705B-4379-AB33-22D98C1ABF55} - C:\Program Files (x86)\FBLayouts\fblayouts.dll
BHO-X64: FBLayouts Plugin - No File
BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
BHO-X64: HP Smart BHO Class - No File
TB-X64: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\coIEPlg.dll
TB-X64: ooVoo Toolbar: {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Program Files (x86)\oovootb\oovoodx.dll
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
mRun-x64: [CLMLServer for HP TouchSmart] "C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
mRun-x64: [UCam_Menu] "C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
mRun-x64: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
mRun-x64: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
mRun-x64: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
mRun-x64: [WinPatrol] "C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe" -expressboot
mRun-x64: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
mRunOnce-x64: [Uninstall Adobe Download Manager] "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
mRunOnce-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /install /silent
mRunOnce-x64: [GrpConv] grpconv -o
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R0 70416132;70416132 Boot Guard Driver;C:\Windows\system32\DRIVERS\70416132.sys --> C:\Windows\system32\DRIVERS\70416132.sys [?]
R0 74558332;74558332 Boot Guard Driver;C:\Windows\system32\DRIVERS\74558332.sys --> C:\Windows\system32\DRIVERS\74558332.sys [?]
R1 70416131;70416131;C:\Windows\system32\DRIVERS\70416131.sys --> C:\Windows\system32\DRIVERS\70416131.sys [?]
R1 74558331;74558331;C:\Windows\system32\DRIVERS\74558331.sys --> C:\Windows\system32\DRIVERS\74558331.sys [?]
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
R1 SDHookDriver;Spybot-S&D 2 Hook Driver;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [2011-7-7 48888]
R1 setup_9.0.0.722_03.07.2011_17-11drv;setup_9.0.0.722_03.07.2011_17-11drv;C:\Windows\system32\DRIVERS\7455833.sys --> C:\Windows\system32\DRIVERS\7455833.sys [?]
R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2009/07/20 03:27:04];C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [2008-11-28 146928]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-10-25 42184]
R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe --> C:\Windows\system32\Hpservice.exe [?]
R2 lxbv_device;lxbv_device;C:\Windows\system32\lxbvcoms.exe -service --> C:\Windows\system32\lxbvcoms.exe -service [?]
R2 SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-4-28 120832]
R2 SDHookService;Spybot-S&D 2 Hooks Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookSvc.exe [2011-7-7 130976]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2011-7-7 1060272]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2011-7-7 909224]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2011-7-7 169624]
R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys --> C:\Windows\system32\DRIVERS\enecir.sys [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-5-26 132656]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;C:\Windows\system32\drivers\IntcHdmi.sys --> C:\Windows\system32\drivers\IntcHdmi.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe --> C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_6ef279c8\AESTSr64.exe [?]
S3 bckwfs;Blue Coat K9 Web Protection;C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe [2010-12-20 1845520]
S3 BHDrvx64;Symantec Heuristics Driver;\??\C:\Windows\system32\drivers\N360x64\0308000.029\BHDrvx64.sys --> C:\Windows\system32\drivers\N360x64\0308000.029\BHDrvx64.sys [?]
S3 ccHP;Symantec Hash Provider;\??\C:\Windows\system32\drivers\N360x64\0308000.029\ccHPx64.sys --> C:\Windows\system32\drivers\N360x64\0308000.029\ccHPx64.sys [?]
S3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-1-13 222512]
S3 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-23 135664]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-23 135664]
S3 NETw3v64;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\NETw3v64.sys --> C:\Windows\system32\DRIVERS\NETw3v64.sys [?]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;C:\Windows\System32\svchost.exe -k nosGetPlusHelper [2008-1-20 21504]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 Recovery Service for Windows;Recovery Service for Windows;C:\Program Files (x86)\SMINST\BLService.exe [2009-1-13 365952]
S3 SymEFA;Symantec Extended File Attributes;\??\C:\Windows\system32\drivers\N360x64\0308000.029\SYMEFA64.SYS --> C:\Windows\system32\drivers\N360x64\0308000.029\SYMEFA64.SYS [?]
S3 SYMNDISV;Symantec Network Filter Driver;C:\Windows\system32\Drivers\N360x64\0308000.029\SYMNDISV.SYS --> C:\Windows\system32\Drivers\N360x64\0308000.029\SYMNDISV.SYS [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x64.sys --> C:\Windows\system32\DRIVERS\yk60x64.sys [?]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-12-3 89920]
S4 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [2010-2-2 117640]
.
=============== File Associations ===============
.
JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
.
=============== Created Last 30 ================
.
2011-07-11 02:34:22 -------- d-----w- C:\Windows\Profiles
2011-07-08 05:48:55 8873296 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8727235C-8E81-47A6-A63D-0D39E53547B1}\mpengine.dll
2011-07-07 14:39:22 -------- d-----w- C:\ProcAlyzer Dumps
2011-07-07 14:39:22 -------- d-----w- \ProcAlyzer Dumps
2011-07-07 13:42:28 17272 ----a-w- C:\Windows\System32\sdnclean64.exe
2011-07-07 13:42:25 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2
2011-07-06 18:52:54 -------- d-----w- C:\Program Files (x86)\VS Revo Group
2011-07-06 15:41:13 -------- d-----w- C:\ProgramData\InstallMate
2011-07-06 15:41:13 -------- d-----w- C:\Program Files (x86)\BillP Studios
2011-07-04 16:02:25 -------- d-----w- C:\Program Files\CCleaner
2011-07-03 17:13:38 40464 ----a-w- C:\Windows\System32\drivers\74558332.sys
2011-07-03 17:13:38 352784 ----a-w- C:\Windows\System32\drivers\7455833.sys
2011-07-03 17:13:38 157712 ----a-w- C:\Windows\System32\drivers\74558331.sys
2011-07-03 15:14:37 40464 ----a-w- C:\Windows\System32\drivers\70416132.sys
2011-07-03 15:14:37 352784 ----a-w- C:\Windows\System32\drivers\7041613.sys
2011-07-03 15:14:37 157712 ----a-w- C:\Windows\System32\drivers\70416131.sys
2011-07-01 23:25:25 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-01 21:17:56 -------- d-----w- C:\Malwarebytes
2011-07-01 21:17:56 -------- d-----w- \Malwarebytes
2011-07-01 21:17:49 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-06-30 03:51:12 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-06-30 03:35:31 654928 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys
2011-06-30 03:35:31 42064 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys
2011-06-30 03:35:31 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui
2011-06-30 03:20:23 344576 ----a-w- C:\Windows\System32\schannel.dll
2011-06-30 03:20:23 276992 ----a-w- C:\Windows\SysWow64\schannel.dll
2011-06-29 16:26:50 -------- d-----w- C:\ProgramData\Kaspersky Lab
2011-06-16 11:52:12 -------- d-----w- C:\Program Files (x86)\Conduit
2011-06-16 11:52:02 -------- d-----w- C:\Program Files (x86)\ConduitEngine
2011-06-16 11:51:59 -------- d-----w- C:\Program Files (x86)\uTorrentBar
2011-06-16 11:51:52 -------- d-----w- C:\Program Files (x86)\uTorrent
2011-06-15 12:31:27 847360 ----a-w- C:\Windows\System32\oleaut32.dll
2011-06-15 12:31:27 563712 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2011-06-15 12:31:22 176128 ----a-w- C:\Windows\System32\drivers\srv2.sys
2011-06-15 12:31:22 145920 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2011-06-15 12:31:16 405504 ----a-w- C:\Windows\System32\drivers\afd.sys
2011-06-15 12:31:06 275456 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2011-06-15 12:31:05 135680 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2011-06-15 12:31:05 107008 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2011-06-15 12:31:00 2762752 ----a-w- C:\Windows\System32\win32k.sys
2011-06-15 12:30:56 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2011-06-15 12:30:56 2409784 ----a-w- C:\Program Files (x86)\Windows Mail\OESpamFilter.dat
2011-06-15 12:30:22 97792 ----a-w- C:\Windows\System32\drivers\dfsc.sys
2011-06-15 12:30:19 975360 ----a-w- C:\Windows\System32\inetcomm.dll
2011-06-15 12:30:19 739328 ----a-w- C:\Windows\SysWow64\inetcomm.dll
.
==================== Find3M ====================
.
2011-07-04 11:43:53 40112 ----a-w- C:\Windows\avastSS.scr
2011-07-04 11:32:24 64856 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-05-29 13:11:20 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-05-24 23:14:10 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-05-13 22:58:22 17720 ----a-w- C:\Windows\System32\HPMDPCoInst12.dll
2011-05-13 22:58:16 30008 ----a-w- C:\Windows\System32\drivers\hpdskflt.sys
2011-05-13 22:58:10 30520 ----a-w- C:\Windows\System32\hpservice.exe
2011-05-13 22:58:04 20792 ----a-w- C:\Windows\System32\accelerometerdll.DLL
2011-05-13 22:57:58 43320 ----a-w- C:\Windows\System32\drivers\Accelerometer.sys
2011-04-13 22:40:10 4284416 ----a-w- C:\Windows\SysWow64\GPhotos.scr
.
============= FINISH: 11:23:21.98 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 7/20/2009 5:42:57 AM
System Uptime: 7/10/2011 8:22:17 PM (15 hours ago)
.
Motherboard: Quanta | | 3627
Processor: Intel(R) Core(TM)2 Duo CPU T6500 @ 2.10GHz | CPU | 2100/800mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 285 GiB total, 130.457 GiB free.
D: is FIXED (NTFS) - 13 GiB total, 2.032 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
µTorrent
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Adobe Shockwave Player 11.5
Aleks 3.12
AnVir Task Manager Free
Apple Application Support
Apple Software Update
avast! Free Antivirus
Backyard Soccer MLS Edition
BufferChm
Compatibility Pack for the 2007 Office system
Conduit Engine
Convert AVI to MP4 1.3
CustomerResearchQFolder
CyberLink DVD Suite
D4300
D4300_Help
DeviceDiscovery
DeviceManagementQFolder
DJ_SF_03_D4300_ProductContext
DJ_SF_03_D4300_Software
DJ_SF_03_D4300_Software_Min
DX-Ball 1.09
ESU for Microsoft Vista
eSupportQFolder
Eusing Free Registry Cleaner
FBLayouts Plugin
FormatFactory 2.20
FreshDiagnose
FreshUI
GEAR driver installer for x86 and x64
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
GPBaseService
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hoyle Word Games 2
HP Active Support Library
HP Common Access Service Library
HP Customer Experience Enhancements
HP Games
HP Help and Support
HP MediaSmart DVD
HP MediaSmart Music/Photo/Video
HP MediaSmart SlingPlayer
HP MediaSmart TV
HP MediaSmart Webcam
HP Photosmart Essential 2.5
HP Quick Launch Buttons 6.40 L1
HP Total Care Advisor
HP Total Care Setup
HP Update
HP User Guides 0126
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPProductAssistant
HPSSupply
IDT Audio
iPhone Configuration Utility
Java(TM) 6 Update 17
Java(TM) 6 Update 7
Juno Preloader
LabelPrint
LightScribe System Software 1.14.17.1
Malwarebytes' Anti-Malware version 1.51.0.1200
MarketResearch
Microsoft Live Search Toolbar
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Microsoft WSE 3.0 Runtime
Monopoly
Mozilla Firefox (3.5.8)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee Reveal
NetAssistant
NetZero Preloader
Norton 360
ooVoo
ooVoo Toolbar (Remove Toolbar Only)
Picasa 3
Power2Go
PowerDirector
PriceGong 2.1.0
PSSWCORE
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Realtek USB 2.0 Card Reader
Revo Uninstaller 1.92
Safari
School Tycoon
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft Office 2007 System (KB2541012)
Security Update for Microsoft Office Excel 2007 (KB2541007)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype web features
Skype™ 4.2
Slingbox - Watch Your TV Anywhere
SlingPlayer
SmartWebPrintingOC
Snood 4
SolutionCenter
Sound Effects
SPORE Creature Creator Trial Edition
Spybot - Search & Destroy 2
Status
StepMania (remove only)
The Sims™ 3
Toolbox
TrayApp
UnloadSupport
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
uTorrentBar Toolbar
VideoToolkit01
Voozie Maker
WebReg
WhiteBoardMeeting
Windows Media Player Firefox Plugin
Yahoo! Software Update
Yahoo! Toolbar
.
==== Event Viewer Messages From Past Week ========
.
7/6/2011 2:55:07 PM, Error: Service Control Manager [7000] - The FreshIO service failed to start due to the following error: This driver has been blocked from loading
7/6/2011 2:55:07 PM, Error: Application Popup [1060] - \??\C:\Program Files (x86)\FreshDevices\FreshDiagnose\FreshIO.s has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
7/6/2011 12:01:07 PM, Error: PlugPlayManager [12] - The device 'Realtek PCIe FE Family Controller' (PCI\VEN_10EC&DEV_8136&SUBSYS_3627103C&REV_02\4&17c27800&0&00E1) disappeared from the system without first being prepared for removal.
7/10/2011 3:02:20 AM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/10/2011 3:02:19 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
7/10/2011 3:02:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
7/10/2011 10:06:40 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: bckd SABKUTIL
7/10/2011 10:06:40 PM, Error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
.
==== End Of File ===========================
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am
Advertisement
Register to Remove

Re: Sneeky malware, browser hijack

Unread postby Gary R » July 15th, 2011, 1:47 am

Looking over your logs, back soon.
User avatar
Gary R
Administrator
Administrator
 
Posts: 21869
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Sneeky malware, browser hijack

Unread postby Gary R » July 15th, 2011, 2:12 am

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the Malware Removal forum and wait for help.


Unless informed of in advance, failure to post replies within 3 days will result in this thread being closed.


Hi Seep34

I'm Gary R, I'll be glad to help you with your computer problems.

Before we start: Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

I'd also recommend that you create a System Restore Point that we can restore to if necessary.

  • Click Start, and type Create a restore point into the Search programs and files box.
  • Now click on the Create a restore point icon at the top of the find list.
  • This will open a System Properties box, with the System Protection tab open ...
    • Click on the Create button in the lower part of the window.
    • Type Pre Malware Cleanup into the description box, then click Create.
    • Windows will now create a Restore Point and notify you when finished.
    • Exit any open windows.

Please observe these rules while we work:
  • Perform all actions in the order given.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with it till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to install any new software (other than those I ask you to) until we've got your computer clean.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. If your defensive programmes warn you about any of those tools, be assured that they are not infected, and are safe to use.
If you can do these things, everything should go smoothly.
  • As you're using Vista or Windows7, it will be necessary to right click all tools we use and select ----> Run as Administrator

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.


Quite a few things to attend to in your logs ....

First

I see you have 2 anti-virus programmes installed ....

avast! Free Antivirus
Norton 360


.... this will not give you more protection, in fact it will give you less. The 2 programs will conflict with each other and cause no end of problems.

You must uninstall one of them at once, your choice which one.

If you decide to remove Norton, then don't use the onboard uninstaller, it doesn't do a very good job, instead use THIS tool instead.

Next

Please go to Control Panel > Programs > Uninstall a program and Uninstall the following:

µTorrent
uTorrentBar Toolbar
Java(TM) 6 Update 17
Java(TM) 6 Update 7
Spybot - Search & Destroy 2


P2P programs are the most often used conduit for contracting infections, we won't work on machines that have them installed.
Old versions of Java can be exploited and need removing.
Spybot S&D will interfere with the Malware removal process, you can re-install it if you wish once we've got your computer clean of infection.

Reboot your computer once all those programs have been uninstalled.

Next

Download OTL by OldTimer to your Desktop.

Alternative Download

If you already have a copy of OTL delete it and use this version.

  • Double click OTL.exe to launch the programme.
  • Check the following.
    • Scan all users.
    • Lop check.
    • Purity check.
  • Under Extra Registry section, select Use SafeList
  • Under Custom Scans/Fixes copy/paste the contents of the code box below.
Code: Select all
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.*
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
CREATERESTOREPOINT
%PROGRAMFILES%\*.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents

  • Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).
  • When finished it will produce two logs.
    • OTL.txt (open on your desktop).
    • Extras.txt (minimised in your taskbar)
  • Please post me both logs.

Next

Download TDSSKiller.zip and extract it to your Desktop.
  • Double click on TDSSKiller.exe to launch it.
    • If using Vista or Windows7, when prompted by UAC allow the prompt.
  • Click on Start Scan
  • The scan will run.
  • When the scan has finished, if it finds anything please click on the drop down arrow next to Cure and select Skip
  • Now click on Report to open the log file created by TDSSKiller in your root directory C:\
  • Post the contents in your next reply please.
  • DO NOT TRY TO FIX ANYTHING AT THIS POINT

Summary of the logs I need from you in your next post:
  • OTL.txt
  • Extras.txt
  • TDSSKiller log


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
User avatar
Gary R
Administrator
Administrator
 
Posts: 21869
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Sneeky malware, browser hijack

Unread postby Seep34 » July 15th, 2011, 5:36 pm

Thank you, thank you, thank you. I thought I'd be abandoned by the forum.

I'm not going to be available to implement the tasks that you've assigned until Sunday; then I'll run the various programs, fixes, etc. and post the logs, as you've requested.

Gary R, thank you again for tackling this computer mess. My children can't wait for me to return their computer to them.

Mory
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am

Re: Sneeky malware, browser hijack

Unread postby Gary R » July 15th, 2011, 6:10 pm

No problem Mory, talk to you on Sunday then. :)
User avatar
Gary R
Administrator
Administrator
 
Posts: 21869
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Sneeky malware, browser hijack

Unread postby Seep34 » July 18th, 2011, 12:19 am

Hi Gary R,

Just a brief note on what's happening.

Before starting the clean up process, I've decided--just in case things don't go as planned--to take your advice and backup of the computer; for the first time!

I'm using the Windows 7 backup program and it's now crunching through its third DVD in about three hours. If I believe the status bar, the program has just completed backing up almost 1/3 of whatever it's backing up. The kids have got a lot of pictures, videos, etc., on their computer; none of which was backed up at any time. I believe system files, programs, etc. are excluded from the backup, so I'm surprised that it's taking such a long time. I think that I can safely assume that I shouldn't start the next part of the process until the backup is complete. I'll try to stay awake to switch out the 3rd DVD and insert the 4th. I have no idea how many DVD's will be needed.

Tomorrow morning--if my schedule allows--I'll continue with the backup. Then, I'll tackling the next set of instructions you gave me. I hope that this phase finishes soon... I'll keep you posted.

Mory (aka seep34)

Thanks.
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am

Re: Sneeky malware, browser hijack

Unread postby Gary R » July 18th, 2011, 1:48 am

The quickest way to back up is to use a large capacity external drive that plugs into your USB port. That way you don't have to spend all your time swapping out dvds. Despite their large capacity they're usually physically quite small and easy to store away.

I got a 500 Gbyte drive for about $50, which is usually more than big enough for most people's back up needs.

A full backup for me usually takes about 30-40 mins, if it's taking much longer than that, then either you have a whole mass of data, or it sounds like something isn't quite right.
User avatar
Gary R
Administrator
Administrator
 
Posts: 21869
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Sneeky malware, browser hijack

Unread postby Seep34 » July 18th, 2011, 4:11 pm

It's on DVD #13 now and it takes about 45 minutes to do each DVD. I have to be there to label and swap the DVD's. The kids have a huge number of digital pictures and videos of all lengths. The possibility of losing this treasure trove of personal memories, really wacked out the kids.

I've seen external terabyte drives go for under one hundred $'s; we're a bit tight right now, so it will have to wait...

One thing for sure--I don't want to have to go through this DVD by DVD tedium. The green progress bar shows the backup as being only halfway done.

Thanks for hanging in there...

Mory/seep34
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am

Re: Sneeky malware, browser hijack

Unread postby Gary R » July 18th, 2011, 5:03 pm

No problem, just post me the logs I asked for when you've finished backing up. :)
User avatar
Gary R
Administrator
Administrator
 
Posts: 21869
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Sneeky malware, browser hijack

Unread postby Seep34 » July 20th, 2011, 4:00 pm

GaryR:

If I wasn't already so invested in doing the backup via DVD's and if I would have known how long and how many (27!) DVD's it would take, I would have run to the nearest store to by a stand-alone external hard drive. Never again will I do a backup this way.

Now to the real business:

Step #1: I removed the Norton 360 (via the removal tool you had me link to) and kept avast!

Step #2: I removed: uTorrent, uTorrentBar Toolbar, Java(TM) 6 Update 7, Java(TM) 6 Update 17, and Spybot - Search & Destroy 2. I don't know how significant this is, however, Revo Uninstaller which I used instead to the Windows Uninstaller, was unable to create a System Restore Point for any of the five deletion processes. Also, for the two Java uninstalls, I received messages that read: Internal Error 1606. Could not access network location %APPDATA%\. I didn't receive those messages with the other three uninstalls.

Question: You mention that "old versions of Java can be exploited and need removing." Do I have any Java programs remaining on the computer? I ask because for the Java Update 17, I had to delete 1675 registry items and 656 files/folders. I had to check-off many of the items to be deleted manually. If this is just an old update, where does Java currently reside on the computer? Do I need to reload Java, after the machine is cleared up?

(I thought that I just posted this note, before rebooting the computer--which is what you instructed me to do after the uninstalls--but it's not here... I hope this doesn't post twice...)

Mory (seep34)
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am

Re: Sneeky malware, browser hijack

Unread postby Gary R » July 20th, 2011, 4:28 pm

We'll be installing the latest version of Java once we've established what Malware you have on your machine and removed it.

Installing programs on an infected machine can sometimes cause problems, so at this stage the only things I ask to be installed are programs we're going to use to clean your machine.

Full blown Java isn't used as much as you might suppose (javascript is what runs most websites, and that's a totally different animal), so not having it installed for a short period shouldn't affect things for you too much.
User avatar
Gary R
Administrator
Administrator
 
Posts: 21869
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Sneeky malware, browser hijack

Unread postby Seep34 » July 20th, 2011, 5:23 pm

Hi Gary R.

I just sent the first of the logs, or, rather I tried to. I hit submit and I got thrown out and had to log back in. Needless to say my posting is not here. I saved the logs, so I'll try again in a minute.

BTW, how would I know when I've reached the 100,000 character limit? Should I split the log? The OLT.txt is by far the largest of the three files.

Mory (Seep34)
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am

Re: Sneeky malware, browser hijack

Unread postby Gary R » July 20th, 2011, 5:34 pm

Don't worry about the 100,000 limit, just post your logs one at a time, starting with OTL.txt

Once you post the OTL.txt log just check to see if it's all there, if the forum limiter has kicked in and it's not all present, post the remainder in your next post.

Repeat the same procedure for the remaining logs.
User avatar
Gary R
Administrator
Administrator
 
Posts: 21869
Joined: June 28th, 2005, 11:36 am
Location: Yorkshire

Re: Sneeky malware, browser hijack

Unread postby Seep34 » July 20th, 2011, 5:35 pm

OK, Gary R., here goes again... OLT.txt:

Preview shows me that this post contains 1,143,888 characters--just slightly above the limit :roll: How do you want me to handle it? I'd have to chop it into 12 pieces...

Mory (Seep34)

Here's the report header...


OTL logfile created on: 7/20/2011 4:15:05 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Malky\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.90 Gb Total Physical Memory | 2.15 Gb Available Physical Memory | 55.00% Memory free
8.03 Gb Paging File | 5.94 Gb Available in Paging File | 73.97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.05 Gb Total Space | 129.00 Gb Free Space | 45.25% Space Free | Partition Type: NTFS
Drive D: | 13.04 Gb Total Space | 1.74 Gb Free Space | 13.34% Space Free | Partition Type: NTFS

Computer Name: THE_BOOGER | User Name: Rachel Mindel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am

Re: Sneeky malware, browser hijack

Unread postby Seep34 » July 20th, 2011, 5:38 pm

GaryR.

When I tried to include the entire log, just a while ago, it wasn't truncated. I was tossed out and had to log back in. However, I will take another crack at it...

Mory (Seep34)
Seep34
Regular Member
 
Posts: 37
Joined: August 30th, 2010, 10:05 am
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 31 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware