Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

contacts list seems to have been hijacked

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

contacts list seems to have been hijacked

Unread postby coryc1975 » October 16th, 2011, 10:14 pm

It seems that my contacts list has been hijacked. Every contact I have ever had is being flooded with emails. I keep getting failure to deliver messages from messages I haven't sent. I'd like to put a stop to this. I'd also like to make sure there's nothing else going on in my computer that shouldn't be. Thanks, in advance, for your help. DDS logs follow.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Acer at 21:06:08 on 2011-10-16
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4026.2192 [GMT -5:00]
.
AV: AVG Internet Security 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG10\avgchsva.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AVG\AVG10\avgfws.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
C:\Windows\system32\mqsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\AVG\AVG10\avgam.exe
C:\Program Files (x86)\AVG\AVG10\avgnsa.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\System32\hkcmd.exe
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\igfxext.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
C:\Program Files (x86)\BitTorrent\BitTorrent.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Zecter\ZumoDrive\zumodrive.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\AVG\AVG10\avgtray.exe
C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe
C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10x_ActiveX.exe
C:\Windows\system32\DllHost.exe
C:\PROGRA~2\AVG\AVG10\avgrsa.exe
C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uSearch Bar = Preserve
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACA ... 5t4852x893
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACA ... 5t4852x893
uURLSearchHooks: YTNavAssist.YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTNavAssist.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
mWinlogon: Userinit=userinit.exe,
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
uRun: [Search Protection] C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [BitTorrent] "C:\Program Files (x86)\BitTorrent\BitTorrent.exe"
uRun: [ZumoDrive] C:\Program Files (x86)\Zecter\ZumoDrive\ZumoLauncher.lnk
mRun: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe
mRun: [YSearchProtection] "C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe"
mRun: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
mRun: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"
mRun: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\Acer\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://l.yimg.com/jh/games/web_games/po ... der_v6.cab
TCP: DhcpNameServer = 10.0.0.1
TCP: Interfaces\{22322B7C-5999-40B5-8668-355FD0B3B409} : DhcpNameServer = 10.0.0.1
TCP: Interfaces\{22322B7C-5999-40B5-8668-355FD0B3B409}\241636B623241697 : DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{22322B7C-5999-40B5-8668-355FD0B3B409}\3507565646C496E6B6372383 : DhcpNameServer = 70.103.96.135 204.130.255.3
TCP: Interfaces\{22322B7C-5999-40B5-8668-355FD0B3B409}\84F6A4F602D456371694E6E6 : DhcpNameServer = 70.103.96.135 204.130.255.3
TCP: Interfaces\{5BCFEA42-572D-4EB6-AB70-BDBD0E0D8194} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{61C00D5F-1794-4C71-8337-59F6ECA619C6} : DhcpNameServer = 192.168.0.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: AVG Security Toolbar BHO: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
TB-X64: AVG Security Toolbar: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
mRun-x64: [Acer Assist Launcher] C:\Program Files (x86)\Acer\Acer Assist\launcher.exe
mRun-x64: [YSearchProtection] "C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe"
mRun-x64: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
mRun-x64: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun-x64: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe"
mRun-x64: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;C:\Windows\system32\DRIVERS\AVGIDSEH.Sys --> C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [?]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys --> C:\Windows\system32\DRIVERS\avgrkx64.sys [?]
R1 Avgfwfd;AVG network filter service;C:\Windows\system32\DRIVERS\avgfwd6a.sys --> C:\Windows\system32\DRIVERS\avgfwd6a.sys [?]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys --> C:\Windows\system32\DRIVERS\avgldx64.sys [?]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys --> C:\Windows\system32\DRIVERS\avgmfx64.sys [?]
R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys --> C:\Windows\system32\DRIVERS\avgtdia.sys [?]
R1 CbFs;CbFs;\??\C:\Windows\system32\drivers\cbfs64.sys --> C:\Windows\system32\drivers\cbfs64.sys [?]
R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]
R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG10\avgfws.exe [2011-3-9 2708024]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2011-8-18 7390560]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [2011-2-8 269520]
R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2009-11-6 844320]
R2 Greg_Service;GRegService;C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [2009-8-28 1150496]
R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2009-11-6 240160]
R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys --> C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [?]
R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys --> C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [?]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-14 136176]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-5-6 947528]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-14 136176]
S3 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe [2009-9-10 305448]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2009-11-6 225280]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-10-17 00:06:30 -------- d-----w- C:\Users\Acer\AppData\Local\{679E12C4-6413-4BBD-9025-54201D6426CF}
2011-10-17 00:06:20 -------- d-----w- C:\Users\Acer\AppData\Local\{FE9D725F-089C-40B3-9819-902538DA317A}
2011-10-16 12:06:07 -------- d-----w- C:\Users\Acer\AppData\Local\{281E5F64-6D24-4C1F-98CD-CFBB94C72013}
2011-10-16 12:05:57 -------- d-----w- C:\Users\Acer\AppData\Local\{74FEB764-A9D9-4611-A8F5-93AF69CF7589}
2011-10-15 21:36:52 -------- d-----w- C:\Users\Acer\AppData\Local\{E9706E80-314F-48D8-9296-7D64AA2057CA}
2011-10-15 21:36:40 -------- d-----w- C:\Users\Acer\AppData\Local\{63C16446-E5AC-4C42-8E34-40C00F67F03B}
2011-10-14 16:33:57 -------- d-----w- C:\Users\Acer\AppData\Local\{B1435A26-DBFA-4EE8-B49A-4CBF97D2977E}
2011-10-14 00:17:42 -------- d-----w- C:\Users\Acer\AppData\Local\{88A6840B-D856-4493-AD49-963C37860215}
2011-10-14 00:17:17 -------- d-----w- C:\Users\Acer\AppData\Local\{939944CA-83B2-45FC-91D7-5B5601D0861A}
2011-10-13 00:38:28 -------- d-----w- C:\Users\Acer\AppData\Local\{298C5BB5-4428-4EEA-84D4-8DE02F95655A}
2011-10-13 00:38:17 -------- d-----w- C:\Users\Acer\AppData\Local\{772FA90B-0DF4-4429-8219-E476B222F5D8}
2011-10-12 16:26:11 -------- d-----w- C:\Users\Acer\AppData\Local\{0717BB15-648F-4CD6-9270-EDF2AEABDFCD}
2011-10-11 23:55:01 3138048 ----a-w- C:\Windows\System32\win32k.sys
2011-10-11 23:52:25 75776 ----a-w- C:\Windows\SysWow64\psisrndr.ax
2011-10-11 23:52:25 613888 ----a-w- C:\Windows\System32\psisdecd.dll
2011-10-11 23:52:25 465408 ----a-w- C:\Windows\SysWow64\psisdecd.dll
2011-10-11 23:52:24 108032 ----a-w- C:\Windows\System32\psisrndr.ax
2011-10-11 23:51:44 861696 ----a-w- C:\Windows\System32\oleaut32.dll
2011-10-11 23:51:44 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2011-10-11 23:51:44 331776 ----a-w- C:\Windows\System32\oleacc.dll
2011-10-11 23:51:44 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll
2011-10-11 23:27:20 -------- d-----w- C:\Users\Acer\AppData\Local\{34AE112C-5D5F-4764-8AAF-C15E5A6C373B}
2011-10-11 23:26:43 -------- d-----w- C:\Users\Acer\AppData\Local\{109792B7-DDE2-46F1-9019-C1D700B54AAD}
2011-10-11 00:43:12 -------- d-----w- C:\Users\Acer\AppData\Local\{77E8D8F2-D539-44CB-8476-1CE126184603}
2011-10-10 03:32:50 -------- d-----w- C:\Users\Acer\AppData\Local\{3B06661D-09AA-4ED6-ADB8-5B299340E722}
2011-10-10 03:32:39 -------- d-----w- C:\Users\Acer\AppData\Local\{6EB49F85-11F0-4303-BDB8-F68B6B659B2E}
2011-10-09 15:32:28 -------- d-----w- C:\Users\Acer\AppData\Local\{E7649A69-6FE9-4D21-98F4-AB5306C22127}
2011-10-09 15:32:26 -------- d-----w- C:\Users\Acer\AppData\Local\{532E42EB-5643-4ABD-8186-6C605629E63C}
2011-10-09 02:03:39 -------- d-----w- C:\Users\Acer\AppData\Local\{EBC97F74-16B3-4E1F-ADDC-CEA7E1047DC9}
2011-10-09 02:03:28 -------- d-----w- C:\Users\Acer\AppData\Local\{E84A5309-5D0E-4BDC-971A-8D274244CCB2}
2011-10-08 11:16:45 -------- d-----w- C:\Users\Acer\AppData\Local\{4D57D0A3-BA13-4A2B-B6A8-1CC8467E880E}
2011-10-08 11:16:34 -------- d-----w- C:\Users\Acer\AppData\Local\{42E39871-554D-49A0-B767-644FE041C769}
2011-10-07 21:05:14 -------- d-----w- C:\Users\Acer\AppData\Local\{8CDDA847-E024-42C5-882E-5A634A66F909}
2011-10-07 21:05:00 -------- d-----w- C:\Users\Acer\AppData\Local\{1F626C20-C838-4136-808B-A89A51883BBA}
2011-10-06 23:39:36 -------- d-----w- C:\Users\Acer\AppData\Local\{675BB7CB-1617-4FAB-9995-30B8FA2C3DDA}
2011-10-06 23:39:23 -------- d-----w- C:\Users\Acer\AppData\Local\{007480A7-C0FC-4CF7-AF2F-6E88F88F36ED}
2011-10-06 16:53:20 -------- d-----w- C:\Users\Acer\AppData\Local\{888050F6-E3A7-47D4-9534-D57BFC1B192A}
2011-10-06 02:33:29 -------- d-----w- C:\Users\Acer\AppData\Local\{3F781D1D-0A58-4E6D-9ABD-25A3FA7F6A60}
2011-10-06 02:33:19 -------- d-----w- C:\Users\Acer\AppData\Local\{FA5B5F14-A8C7-4186-8F4D-CF4FDFC96013}
2011-10-05 14:33:06 -------- d-----w- C:\Users\Acer\AppData\Local\{BC670944-92DA-43D2-86C0-F8D02E767D47}
2011-10-05 14:32:56 -------- d-----w- C:\Users\Acer\AppData\Local\{542B7BA5-1048-4A2F-A030-0C99F3D42621}
2011-10-05 03:47:58 -------- d-----w- C:\Users\Acer\AppData\Roaming\Windows Live Writer
2011-10-05 03:47:58 -------- d-----w- C:\Users\Acer\AppData\Local\Windows Live Writer
2011-10-04 23:01:26 -------- d-----w- C:\Users\Acer\AppData\Local\{EE73ACB0-1550-46BC-A41D-19411C9A82FF}
2011-10-04 23:01:15 -------- d-----w- C:\Users\Acer\AppData\Local\{94FAC81C-6B97-4AE9-9B9D-778BCB7FD9BB}
2011-10-04 11:01:02 -------- d-----w- C:\Users\Acer\AppData\Local\{6DFA0ACB-1E00-481F-9E7C-45F22AE7739E}
2011-10-04 11:00:52 -------- d-----w- C:\Users\Acer\AppData\Local\{97753B10-8C16-4779-B710-60C443DFF14B}
2011-10-03 20:22:49 -------- d-----w- C:\Users\Acer\AppData\Local\{30DFB6D6-A3BD-4626-9C4C-F9DF95C3333A}
2011-10-03 03:07:58 -------- d-----w- C:\Users\Acer\AppData\Local\{D2BC4A54-F282-4284-99CA-37561809D0AE}
2011-10-03 03:07:48 -------- d-----w- C:\Users\Acer\AppData\Local\{8D9CEB1B-DBFE-4EE3-8323-BA459B2DE8C5}
2011-10-02 15:07:36 -------- d-----w- C:\Users\Acer\AppData\Local\{C18A5AA2-DCAD-4C3B-A018-32D2B0D26E68}
2011-10-02 15:07:26 -------- d-----w- C:\Users\Acer\AppData\Local\{678D9ABB-0457-4E23-AD79-EDD39F156499}
2011-10-01 23:26:27 -------- d-----w- C:\Users\Acer\AppData\Local\{3578EA35-84AD-4993-A019-C12739129CEC}
2011-10-01 23:26:16 -------- d-----w- C:\Users\Acer\AppData\Local\{12F45C03-E9C6-48BC-BDEF-754DE3EFADD0}
2011-10-01 11:26:03 -------- d-----w- C:\Users\Acer\AppData\Local\{AF7BC546-2614-4E4C-A08B-AD9CE14B072A}
2011-10-01 11:25:52 -------- d-----w- C:\Users\Acer\AppData\Local\{65329A8C-8403-4709-825A-A8C8B9344F0F}
2011-09-30 23:25:55 -------- d-----w- C:\Users\Acer\AppData\Local\{26A575C9-5D31-466B-A739-A1340F18EB6B}
2011-09-30 09:09:16 -------- d-----w- C:\Users\Acer\AppData\Local\{238BEEFE-EBB9-4D19-93D7-34578F3E7867}
2011-09-30 09:09:05 -------- d-----w- C:\Users\Acer\AppData\Local\{812C8640-B389-474F-B70E-BBF8EABDB16D}
2011-09-29 21:08:53 -------- d-----w- C:\Users\Acer\AppData\Local\{2820F777-5F49-4090-8F01-5C41C9086C0E}
2011-09-29 21:08:43 -------- d-----w- C:\Users\Acer\AppData\Local\{4C12A512-BEBD-40F2-9F25-CAE21D574481}
2011-09-28 23:24:20 -------- d-----w- C:\Users\Acer\AppData\Local\{399A70F6-EBDF-4E5C-99B8-20B2D79AAE3E}
2011-09-28 23:24:10 -------- d-----w- C:\Users\Acer\AppData\Local\{9343EF45-EC58-4705-8C92-9B0E6911332C}
2011-09-28 11:24:15 -------- d-----w- C:\Users\Acer\AppData\Local\{6F115282-F1FA-41B9-B1FB-3BA39B74D825}
2011-09-27 21:54:16 -------- d-----w- C:\Users\Acer\AppData\Local\{34287673-D411-4CBF-A16F-82504DB77B25}
2011-09-27 21:54:04 -------- d-----w- C:\Users\Acer\AppData\Local\{A542DD86-878A-4A02-AB87-4D4C194FC1C4}
2011-09-26 23:28:12 -------- d-----w- C:\Users\Acer\AppData\Local\{4CF0C111-3230-4E5F-9E35-BC1C21129DF4}
2011-09-26 23:27:58 -------- d-----w- C:\Users\Acer\AppData\Local\{B34BE327-D75D-44B0-ABBF-03C8C3866969}
2011-09-25 04:46:15 -------- d-----w- C:\Users\Acer\AppData\Local\{CE0231DD-ACB8-4900-B22F-AE56C4C95866}
2011-09-25 04:46:04 -------- d-----w- C:\Users\Acer\AppData\Local\{75174038-D1AA-46FA-913E-5FCD4CD3082E}
2011-09-24 16:45:53 -------- d-----w- C:\Users\Acer\AppData\Local\{7AB05B47-DB55-4607-ADF0-40CCEBFFAA91}
2011-09-24 16:45:41 -------- d-----w- C:\Users\Acer\AppData\Local\{A0D97BA8-D3C4-47FE-B1B3-EBD97559D406}
2011-09-24 03:27:22 -------- d-----w- C:\Users\Acer\AppData\Local\{8F4A20E9-50CD-401C-B222-930907836A0F}
2011-09-24 03:27:12 -------- d-----w- C:\Users\Acer\AppData\Local\{E181B275-0D65-4F75-A4D3-002C32706F14}
2011-09-23 15:27:16 -------- d-----w- C:\Users\Acer\AppData\Local\{C8066749-8457-4A98-9A35-348A7E94917F}
2011-09-23 02:48:25 -------- d-----w- C:\Users\Acer\AppData\Local\{95D9282A-7D94-42DE-98B5-2FC751C3C6B5}
2011-09-23 02:48:15 -------- d-----w- C:\Users\Acer\AppData\Local\{81C7FAB3-CE8A-43BD-8FE5-C9822DEF759E}
2011-09-22 11:46:47 -------- d-----w- C:\Users\Acer\AppData\Local\{9F58942F-78C0-4A99-9076-94DEBEA8814F}
2011-09-22 11:46:36 -------- d-----w- C:\Users\Acer\AppData\Local\{F9E61BCE-180A-4DDB-BE88-2996434DD02E}
2011-09-21 22:31:04 -------- d-----w- C:\Users\Acer\AppData\Local\{4AF4E129-49F9-4470-A2A7-7C1C4E572499}
2011-09-21 22:30:54 -------- d-----w- C:\Users\Acer\AppData\Local\{BEBF2CC2-8C14-4D93-B20C-B0DA27E82CE1}
2011-09-21 10:30:41 -------- d-----w- C:\Users\Acer\AppData\Local\{B0601A37-F786-4446-BE04-86C70550FF39}
2011-09-21 10:30:31 -------- d-----w- C:\Users\Acer\AppData\Local\{5B1FB4A9-783A-4E49-AF3E-4BA71DC0F15C}
2011-09-20 18:05:05 -------- d-----w- C:\Users\Acer\AppData\Local\{FDA47750-6757-4A10-AF85-A084C60612F7}
2011-09-20 00:03:52 -------- d-----w- C:\Users\Acer\AppData\Local\{86BBFE60-674E-4858-AF09-2D65192EC451}
2011-09-20 00:03:42 -------- d-----w- C:\Users\Acer\AppData\Local\{8DD8E8B4-693E-4895-B98F-95695C935B82}
2011-09-19 12:03:30 -------- d-----w- C:\Users\Acer\AppData\Local\{3AC65BAB-94E3-46F0-B173-97EB475B7735}
2011-09-19 12:03:19 -------- d-----w- C:\Users\Acer\AppData\Local\{F0DACDB4-3B69-4612-B3D8-6FEE169E5976}
2011-09-18 22:03:56 -------- d-----w- C:\Users\Acer\AppData\Local\{C70B9CA2-4D7E-4C78-BEBA-93B4862DF447}
2011-09-18 22:03:36 -------- d-----w- C:\Users\Acer\AppData\Local\{67653459-A1F3-4E94-9731-FFDCCBBA7DAC}
2011-09-17 22:31:37 -------- d-----w- C:\Users\Acer\AppData\Local\{9CFE44E6-C609-464A-8BFF-91A0F1E5DB10}
2011-09-17 22:31:27 -------- d-----w- C:\Users\Acer\AppData\Local\{6BD5F505-E0E7-492C-90BF-B4CCF91AB862}
2011-09-17 10:31:14 -------- d-----w- C:\Users\Acer\AppData\Local\{A0FC777C-43D2-46D4-9DAE-6B6CA765CF2D}
2011-09-17 10:31:03 -------- d-----w- C:\Users\Acer\AppData\Local\{886B283A-B7A8-47FF-8CA8-175A0152EAAC}
.
==================== Find3M ====================
.
2011-09-26 23:27:53 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll
2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll
2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-07-30 07:00:50 258352 ----a-w- C:\Windows\SysWow64\unicows.dll
.
============= FINISH: 21:06:51.83 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 1/12/2010 2:39:28 PM
System Uptime: 10/16/2011 7:33:36 PM (2 hours ago)
.
Motherboard: Acer | | Aspire 5732Z
Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz | uPGA-478 | 2100/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 221 GiB total, 37.445 GiB free.
D: is CDROM ()
Z: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP271: 10/15/2011 6:43:24 PM - Configured NTI Media Maker 8
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office Suite Service Pack 2 (SP2)
Acer Arcade Deluxe
Acer Assist
Acer Crystal Eye Webcam
Acer ePower Management
Acer eRecovery Management
Acer Games
Acer GridVista
Acer Registration
Acer ScreenSaver
Acer Updater
Acrobat.com
Adobe AIR
Adobe Digital Editions
Adobe Flash Player 10 ActiveX
Adobe Reader 9.4.6 MUI
Any Video Converter 3.2.7
AVG PC Tuneup 2011
BitTorrent
Compatibility Pack for the 2007 Office system
D3DX10
Dev-C++ 5 beta 9 release (4.9.9.2)
EA Download Manager
EA Download Manager UI
eBay Worldwide
Google Earth
Google Update Helper
Identity Card
IsoBuster 2.8.5
Java Auto Updater
Java(TM) 6 Update 26
Junk Mail filter update
Launch Manager
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional 2007
Microsoft Office Professional 2007 Trial
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyWinLocker
Octoshape add-in for Adobe Flash Player
Plants vs. Zombies
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Samsung PC Studio 3 USB Driver Installer
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553074)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2553073)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype Toolbars
Skype™ 5.3
Ubuntu
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2583910)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2596560)
Update Installer for WildTangent Games App
Visual C++ 8.0 Runtime Setup Package (x64)
Visual Studio 2008 x64 Redistributables
VLC media player 1.1.11
Welcome Center
WildTangent Games App (Acer Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
World of Warcraft
Yahoo! BrowserPlus 2.9.8
Yahoo! Detect
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar
ZumoDrive
.
==== Event Viewer Messages From Past Week ========
.
10/15/2011 4:35:02 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
10/15/2011 4:35:00 PM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/15/2011 4:34:58 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
10/14/2011 10:38:15 PM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 10.0.0.7. The computer with the IP address 10.0.0.11 did not allow the name to be claimed by this computer.
.
==== End Of File ===========================
coryc1975
Active Member
 
Posts: 5
Joined: September 3rd, 2011, 7:40 pm
Advertisement
Register to Remove

Re: contacts list seems to have been hijacked

Unread postby Cypher » October 18th, 2011, 2:17 pm

Hi,
Checking your logs now be right back.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: contacts list seems to have been hijacked

Unread postby Cypher » October 18th, 2011, 2:24 pm

Hi and welcome to Malware Removal Forum.
My name is Cypher, and I will be helping you with your malware problems.
This may or may not, solve other issues you have with your machine.
If you no longer require help i would be grateful if you would let me know.

Before we start please note the following important guidelines.
  • If you don't know or understand something, please don't hesitate to ask.
  • Only post your problem at One help site. Applying fixes from multiple help sites can cause problems.
  • Only reply to this thread do not start another, Please continue responding until I give you the "All Clean"
    Absence of symptoms does not mean that everything is clear.
  • Please DO NOT run any other tools or scans whilst I am helping you.
  • Please DO NOT install any other software (or hardware) during the cleaning process.
  • Print each set of instructions... if possible...your Internet connection will not be available during some fix processes.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • Note: No Reply Within 3 Days Will Result In Your Topic Being Closed!

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.
Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.


Windows 7 Advice:
  • All applications I ask to be used will require to be run in Administrator mode. IE: Right click on and select Run as Administrator.
  • Your Operating System in use comes with a inbuilt utility called User Access Control(UAC).
  • When prompted by this with anything I ask you to do carry out please select the option Allow.

Create a new System Restore point

  • Click Start, Right Click on Computer, and select Properties.
  • In the left pane, click System Protection > Creat.
  • Give this restore point a descriptive name and click Create.
  • Click Apply and OK.

Next.

Remove P2P Programs

  • I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.
    BitTorrent
  • Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.
  • Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
  • Click on Start > All programs > Accessories > Run.
  • In the open text box copy/paste appwiz.cpl Then click Ok.
  • Uninstall the programs listed above (in red) and any other P2P you have installed NOW.
  • Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.
While you are in Add/remove programs uninstall the following also.
AVG PC Tuneup 2011


Next.

  • Please download MGA Diagnostic Tool and save it to your Desktop.
  • Right click on MGADiag.exe and select Run As Administrator to run it.
  • Click Continue.
  • The program will run. It takes a while to finish the diagnosis, please be patient.
  • Once done, click on Copy.
  • Open Notepad and paste the contents in the window.
  • Save this file and copy/paste it in your next reply.

Next.

  • Please download CKScanner from Here
  • Important: - Save it to your desktop.
  • Right-click CKScanner.exe > select " Run as administrator " then click Search For Files.
  • After a very short time, when the cursor hourglass disappears, click Save List To File.
  • A message box will verify the file saved.
  • Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

Logs/Information to Post in your Next Reply

  • MGADiag log.
  • CKFiles.txt.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: contacts list seems to have been hijacked

Unread postby coryc1975 » October 20th, 2011, 7:05 pm

Thank you, Cypher. I will be going through your steps this evening. I apologise for not getting back to you earlier. Long hours at work this week. I thank you for your help. I'll be sending you the reports you've asked for shortly.
coryc1975
Active Member
 
Posts: 5
Joined: September 3rd, 2011, 7:40 pm

Re: contacts list seems to have been hijacked

Unread postby coryc1975 » October 20th, 2011, 7:22 pm

Here are the logs you asked for.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {88F65BC0-DCA4-4292-941F-0ABC3368D4FA}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 102
Microsoft Office Professional 2007 - 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_B4D0AA8B-920-80070057

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: N/A, hr=0x80070002
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{88F65BC0-DCA4-4292-941F-0ABC3368D4FA}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-251870272-3239306408-1455499055</SID><SYSTEM><Manufacturer>Acer </Manufacturer><Model>Aspire 5732Z </Model></SYSTEM><BIOS><Manufacturer>Acer </Manufacturer><Version>V3.02</Version><SMBIOSVersion major="2" minor="4"/><Date>20091111000000.000000+000</Date></BIOS><HWID>78BC3907018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>102</Result><Products><Product GUID="{91120000-0014-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional 2007</Name><Ver>12</Ver><Val>B3E4CA29EA01AAE</Val><Hash>K4GEgsSHNoh1c4DCkeGWN2Iw+Vg=</Hash><Pid>81605-343-7839393-65525</Pid><PidType>10</PidType></Product><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><PidType>19</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800006-02-1033-7600.0000-3102009
Installation ID: 017681067261224532654706328355531924905904284756117270
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 7QJB7
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 10/20/2011 6:17:22 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:23:2011 14:43
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAIAAAABAAAAAwABAAEA6GE2TYLDxANiNa42DAd+XbigmnrWfUbK

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS ACRPRDCT
FACP ACRSYS ACRPRDCT
HPET ACRSYS ACRPRDCT
BOOT ACRSYS ACRPRDCT
MCFG ACRSYS ACRPRDCT
ASF! ACRSYS ACRPRDCT
SLIC ACRSYS ACRPRDCT
SSDT PmRef CpuPm


CKScanner - Additional Security Risks - These are not necessarily bad
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_de\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_default\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_es\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_fr\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_it\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_zh-cn\sounds\firecrackle.ogg
scanner sequence 3.BD.11.OUNAQM
----- EOF -----
coryc1975
Active Member
 
Posts: 5
Joined: September 3rd, 2011, 7:40 pm

Re: contacts list seems to have been hijacked

Unread postby coryc1975 » October 20th, 2011, 7:22 pm

Here are the logs you asked for.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {88F65BC0-DCA4-4292-941F-0ABC3368D4FA}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 102
Microsoft Office Professional 2007 - 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_B4D0AA8B-920-80070057

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: N/A, hr=0x80070002
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{88F65BC0-DCA4-4292-941F-0ABC3368D4FA}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-251870272-3239306408-1455499055</SID><SYSTEM><Manufacturer>Acer </Manufacturer><Model>Aspire 5732Z </Model></SYSTEM><BIOS><Manufacturer>Acer </Manufacturer><Version>V3.02</Version><SMBIOSVersion major="2" minor="4"/><Date>20091111000000.000000+000</Date></BIOS><HWID>78BC3907018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>102</Result><Products><Product GUID="{91120000-0014-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional 2007</Name><Ver>12</Ver><Val>B3E4CA29EA01AAE</Val><Hash>K4GEgsSHNoh1c4DCkeGWN2Iw+Vg=</Hash><Pid>81605-343-7839393-65525</Pid><PidType>10</PidType></Product><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><PidType>19</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800006-02-1033-7600.0000-3102009
Installation ID: 017681067261224532654706328355531924905904284756117270
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 7QJB7
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 10/20/2011 6:17:22 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:23:2011 14:43
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAIAAAABAAAAAwABAAEA6GE2TYLDxANiNa42DAd+XbigmnrWfUbK

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS ACRPRDCT
FACP ACRSYS ACRPRDCT
HPET ACRSYS ACRPRDCT
BOOT ACRSYS ACRPRDCT
MCFG ACRSYS ACRPRDCT
ASF! ACRSYS ACRPRDCT
SLIC ACRSYS ACRPRDCT
SSDT PmRef CpuPm


CKScanner - Additional Security Risks - These are not necessarily bad
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_de\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_default\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_es\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_fr\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_it\sounds\firecrackle.ogg
c:\program files (x86)\acer games\bejeweled 2 deluxe\wtmui_zh-cn\sounds\firecrackle.ogg
scanner sequence 3.BD.11.OUNAQM
----- EOF -----
coryc1975
Active Member
 
Posts: 5
Joined: September 3rd, 2011, 7:40 pm

Re: contacts list seems to have been hijacked

Unread postby Cypher » October 21st, 2011, 7:11 am

Hi,
I apologise for not getting back to you earlier. Long hours at work this week.

No problem :)

First please do the following:
  • Change your email Password.
  • Change your Secret Question & Answer.
  • Change your alternative email.

Next.

Uninstall programs
  • Click on Start.
  • All programs.
  • Accessories.
  • Run.
  • In the open text box copy/paste appwiz.cpl Then click Ok.
  • Uninstall the following if present.
Adobe Reader 9.4.6 MUI
Java(TM) 6 Update 26


Next.

Download and run OTM

Download OTM.exe by Old Timer and save it to your Desktop.
  • Right-click OTM.exe and select " Run as administrator " to run it.
  • Right-click then copy the following code, Do not include the word Code.
    Code: Select all
    :Reg
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
    
    :Files
    C:\Program Files (x86)\AVG\AVG PC Tuneup 2011
    C:\Program Files (x86)\BitTorrent
    C:\Users\Acer\AppData\Local\{679E12C4-6413-4BBD-9025-54201D6426CF}
    C:\Users\Acer\AppData\Local\{FE9D725F-089C-40B3-9819-902538DA317A
    C:\Users\Acer\AppData\Local\{281E5F64-6D24-4C1F-98CD-CFBB94C72013}
    C:\Users\Acer\AppData\Local\{74FEB764-A9D9-4611-A8F5-93AF69CF7589}
    C:\Users\Acer\AppData\Local\{E9706E80-314F-48D8-9296-7D64AA2057CA}
    C:\Users\Acer\AppData\Local\{63C16446-E5AC-4C42-8E34-40C00F67F03B}
    C:\Users\Acer\AppData\Local\{B1435A26-DBFA-4EE8-B49A-4CBF97D2977E}
    C:\Users\Acer\AppData\Local\{88A6840B-D856-4493-AD49-963C37860215}
    C:\Users\Acer\AppData\Local\{939944CA-83B2-45FC-91D7-5B5601D0861A}
    C:\Users\Acer\AppData\Local\{298C5BB5-4428-4EEA-84D4-8DE02F95655A}
    C:\Users\Acer\AppData\Local\{772FA90B-0DF4-4429-8219-E476B222F5D8}
    C:\Users\Acer\AppData\Local\{0717BB15-648F-4CD6-9270-EDF2AEABDFCD}
    C:\Users\Acer\AppData\Local\{34AE112C-5D5F-4764-8AAF-C15E5A6C373B}
    C:\Users\Acer\AppData\Local\{109792B7-DDE2-46F1-9019-C1D700B54AAD}
    C:\Users\Acer\AppData\Local\{77E8D8F2-D539-44CB-8476-1CE126184603}
    C:\Users\Acer\AppData\Local\{3B06661D-09AA-4ED6-ADB8-5B299340E722}
    C:\Users\Acer\AppData\Local\{6EB49F85-11F0-4303-BDB8-F68B6B659B2E}
    C:\Users\Acer\AppData\Local\{E7649A69-6FE9-4D21-98F4-AB5306C22127}
    C:\Users\Acer\AppData\Local\{532E42EB-5643-4ABD-8186-6C605629E63C}
    C:\Users\Acer\AppData\Local\{EBC97F74-16B3-4E1F-ADDC-CEA7E1047DC9}
    C:\Users\Acer\AppData\Local\{E84A5309-5D0E-4BDC-971A-8D274244CCB2}
    C:\Users\Acer\AppData\Local\{4D57D0A3-BA13-4A2B-B6A8-1CC8467E880E}
    C:\Users\Acer\AppData\Local\{42E39871-554D-49A0-B767-644FE041C769}
    C:\Users\Acer\AppData\Local\{8CDDA847-E024-42C5-882E-5A634A66F909}
    C:\Users\Acer\AppData\Local\{1F626C20-C838-4136-808B-A89A51883BBA}
    C:\Users\Acer\AppData\Local\{675BB7CB-1617-4FAB-9995-30B8FA2C3DDA}
    C:\Users\Acer\AppData\Local\{007480A7-C0FC-4CF7-AF2F-6E88F88F36ED}
    C:\Users\Acer\AppData\Local\{888050F6-E3A7-47D4-9534-D57BFC1B192A}
    C:\Users\Acer\AppData\Local\{3F781D1D-0A58-4E6D-9ABD-25A3FA7F6A60}
    C:\Users\Acer\AppData\Local\{FA5B5F14-A8C7-4186-8F4D-CF4FDFC96013}
    C:\Users\Acer\AppData\Local\{BC670944-92DA-43D2-86C0-F8D02E767D47}
    C:\Users\Acer\AppData\Local\{542B7BA5-1048-4A2F-A030-0C99F3D42621}
    C:\Users\Acer\AppData\Local\{EE73ACB0-1550-46BC-A41D-19411C9A82FF}
    C:\Users\Acer\AppData\Local\{94FAC81C-6B97-4AE9-9B9D-778BCB7FD9BB}
    C:\Users\Acer\AppData\Local\{6DFA0ACB-1E00-481F-9E7C-45F22AE7739E}
    C:\Users\Acer\AppData\Local\{97753B10-8C16-4779-B710-60C443DFF14B}
    C:\Users\Acer\AppData\Local\{30DFB6D6-A3BD-4626-9C4C-F9DF95C3333A}
    C:\Users\Acer\AppData\Local\{D2BC4A54-F282-4284-99CA-37561809D0AE}
    C:\Users\Acer\AppData\Local\{8D9CEB1B-DBFE-4EE3-8323-BA459B2DE8C5}
    C:\Users\Acer\AppData\Local\{C18A5AA2-DCAD-4C3B-A018-32D2B0D26E68}
    C:\Users\Acer\AppData\Local\{678D9ABB-0457-4E23-AD79-EDD39F156499}
    C:\Users\Acer\AppData\Local\{3578EA35-84AD-4993-A019-C12739129CEC}
    C:\Users\Acer\AppData\Local\{12F45C03-E9C6-48BC-BDEF-754DE3EFADD0}
    C:\Users\Acer\AppData\Local\{AF7BC546-2614-4E4C-A08B-AD9CE14B072A}
    C:\Users\Acer\AppData\Local\{65329A8C-8403-4709-825A-A8C8B9344F0F}
    C:\Users\Acer\AppData\Local\{26A575C9-5D31-466B-A739-A1340F18EB6B}
    C:\Users\Acer\AppData\Local\{238BEEFE-EBB9-4D19-93D7-34578F3E7867}
    C:\Users\Acer\AppData\Local\{812C8640-B389-474F-B70E-BBF8EABDB16D}
    C:\Users\Acer\AppData\Local\{2820F777-5F49-4090-8F01-5C41C9086C0E}
    C:\Users\Acer\AppData\Local\{4C12A512-BEBD-40F2-9F25-CAE21D574481}
    C:\Users\Acer\AppData\Local\{399A70F6-EBDF-4E5C-99B8-20B2D79AAE3E}
    C:\Users\Acer\AppData\Local\{9343EF45-EC58-4705-8C92-9B0E6911332C}
    C:\Users\Acer\AppData\Local\{6F115282-F1FA-41B9-B1FB-3BA39B74D825}
    C:\Users\Acer\AppData\Local\{34287673-D411-4CBF-A16F-82504DB77B25}
    C:\Users\Acer\AppData\Local\{A542DD86-878A-4A02-AB87-4D4C194FC1C4}
    C:\Users\Acer\AppData\Local\{4CF0C111-3230-4E5F-9E35-BC1C21129DF4}
    C:\Users\Acer\AppData\Local\{B34BE327-D75D-44B0-ABBF-03C8C3866969}
    C:\Users\Acer\AppData\Local\{CE0231DD-ACB8-4900-B22F-AE56C4C95866}
    C:\Users\Acer\AppData\Local\{75174038-D1AA-46FA-913E-5FCD4CD3082E}
    C:\Users\Acer\AppData\Local\{7AB05B47-DB55-4607-ADF0-40CCEBFFAA91}
    C:\Users\Acer\AppData\Local\{A0D97BA8-D3C4-47FE-B1B3-EBD97559D406}
    C:\Users\Acer\AppData\Local\{8F4A20E9-50CD-401C-B222-930907836A0F}
    C:\Users\Acer\AppData\Local\{E181B275-0D65-4F75-A4D3-002C32706F14}
    C:\Users\Acer\AppData\Local\{C8066749-8457-4A98-9A35-348A7E94917F}
    C:\Users\Acer\AppData\Local\{95D9282A-7D94-42DE-98B5-2FC751C3C6B5}
    C:\Users\Acer\AppData\Local\{81C7FAB3-CE8A-43BD-8FE5-C9822DEF759E}
    C:\Users\Acer\AppData\Local\{9F58942F-78C0-4A99-9076-94DEBEA8814F}
    C:\Users\Acer\AppData\Local\{F9E61BCE-180A-4DDB-BE88-2996434DD02E}
    C:\Users\Acer\AppData\Local\{4AF4E129-49F9-4470-A2A7-7C1C4E572499}
    C:\Users\Acer\AppData\Local\{BEBF2CC2-8C14-4D93-B20C-B0DA27E82CE1}
    C:\Users\Acer\AppData\Local\{B0601A37-F786-4446-BE04-86C70550FF39}
    C:\Users\Acer\AppData\Local\{5B1FB4A9-783A-4E49-AF3E-4BA71DC0F15C}
    C:\Users\Acer\AppData\Local\{FDA47750-6757-4A10-AF85-A084C60612F7}
    C:\Users\Acer\AppData\Local\{86BBFE60-674E-4858-AF09-2D65192EC451}
    C:\Users\Acer\AppData\Local\{8DD8E8B4-693E-4895-B98F-95695C935B82}
    C:\Users\Acer\AppData\Local\{3AC65BAB-94E3-46F0-B173-97EB475B7735}
    C:\Users\Acer\AppData\Local\{F0DACDB4-3B69-4612-B3D8-6FEE169E5976}
    C:\Users\Acer\AppData\Local\{C70B9CA2-4D7E-4C78-BEBA-93B4862DF447}
    C:\Users\Acer\AppData\Local\{67653459-A1F3-4E94-9731-FFDCCBBA7DAC}
    C:\Users\Acer\AppData\Local\{9CFE44E6-C609-464A-8BFF-91A0F1E5DB10}
    C:\Users\Acer\AppData\Local\{6BD5F505-E0E7-492C-90BF-B4CCF91AB862}
    C:\Users\Acer\AppData\Local\{A0FC777C-43D2-46D4-9DAE-6B6CA765CF2D}
    C:\Users\Acer\AppData\Local\{886B283A-B7A8-47FF-8CA8-175A0152EAAC}
    ipconfig /flushdns /c
    
    :Commands
    [EmptyFlash]
    [emptytemp]
    [start explorer]
    [Reboot]
    

    • Return to OTM, right-click then paste the code into the blank box below Image
    • Next click on the large Image button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Next.

Java SE Runtime Environment (JRE).

Please download from HERE

  • Find Java SE 7u1.
  • Click the Download JRE button to the right.
  • Choose the correct Platform and Multi-language. Next, check the box that says I agree to the Java SE Runtime Environment 6 License Agreement.
  • Click the Continue button.
  • Click on the filename under Windows Offline Installation and save it to your desktop.
  • Close all active windows.
  • Install the program.

Next.

Update Adobe Reader

  • You should Download and Install the newest version of Adobe Reader for reading pdf files.
  • Older versions may have vulnerabilities that malware can use to infect your system.
  • Go Here to download and install Adobe Reader X (10.1.1).

Next.

ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
  • First please Disable any Antivirus you have active, as shown in This topic.
  • Note: Don't forget to re-enable it after the scan.
  • Next hold down Control then click on the following link to open a new window to ESET online scannner
  • Select the option YES, I accept the Terms of Use then click on Start.
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on Start.
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on Finish.
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.


Logs/Information to Post in your Next Reply

  • OTM log.
  • ESET log.
  • Please give me an update on your computers performance.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: contacts list seems to have been hijacked

Unread postby Cypher » October 24th, 2011, 6:43 am

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 132 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware