Explore topic-wise InterviewSolutions in .

I used to always rock avast and zone alarm.

but lately i got a modified host file (that blocks all ads)

and removed zone alarm and avast (because they would conflict with a lot of my online gaming) and keep my windows up to date, and been rocking it like this for last 3 months. (mostly from laziness, but I do run ccleaner a lot)

but for the heck of it today i ran a scan with malware BYTES. and i had like 1 infection which was a ad thing from yahoo.

i am a heavy user, facebook, forums, chats, gaming...

and my computer seems to still run as smooth as my gf's inner thigh

so am i alright?
I would never even consider running a SYSTEM without a top notch AV installed and always resident.Quote from: Allan on May 06, 2012, 11:13:01 AM

I would never even consider running a system without a top notch AV installed and always resident.

1) DO NOT EVER use any registry cleaners / utilities - including the ccleaner registry cleaner module. The best of them do absolutely nothing. The worst of them will leave your system unusable.

2) Ccleaner does nothing you can't do yourself. It certainly is not in any way, shape, or form and anti-malware utility.

As for the rest, there is no "good order" or "bad order". Run the scans however you like.

It's getting better. Starts up faster. STILL does not copy/PASTE without me hitting Ctrl+C a dozen times.ESETscan just finished.

[year+ old attachment deleted by admin]Quote

Still does not copy/paste without me hitting Ctrl+C a dozen times.

Right click seldom works. The keystrokes Ctrl+u,i,p etc. work with no issues. It's only copy/paste.

When you detect the problems, we are not informed of the amount or type of damage that may have incurred. In other words, spyware is spyware and malware and trojans are the like. Even though the problems where removed; to what extent; if any, was the damage? My PC ran crappy, you figured out why it ran crappy. Can you discern wether the removed problems were intended to just destroy just the pc, attack me personally to gain my identity and worse to hurt others.

If removing combofix is important, is there an uninstaller for Win7?

Hello

I am unable to delete the BearShare applications FOLDER from my C | Program files directory (ATTACHED screenshot). I have run MalWareBytes which didn't PICK up anything, and then SuperSpyWare which removed 30+ 'threats', but the BearShare folder is still there.

Thanks for any suggestions.

High1

[year+ old attachment deleted by admin]Try REVO Uninstaller SELECT the 30 day trial one.Many thanks for that SuperDave

what should I do now ?Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

pardon me, in drive (C), I click on Documents and Settings folder and show an error that say is not accessible and there is a lock on it
and also in drive (D) system volume information folder, it has a same problem otherwise in drive (C) I had this problem and it seems that has been fixed now
Is it normal ?

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

When I start up computer I get message that something is wrong with my computer and two options: repair or start normallly. Repair LEADS to a blue SCREEN that says to run chkdsk /f which when I run says device is not ready. All the other chkdsk demands say the same thing. Safe mode does not work and I dont care about saving my information. Alls I want to do is be able to reinstall windows vista but when i boot from the cd it does not see my dvd. I have windows vista 32What is the make and MODEL of your computer?
"Device not ready" and "the cd does not see my DVD" indicate a hardware problem, most LIKELY caused by misconfiguration. If its a desktop, try resetting CMOS. If its a laptop, take out the battery, unplug it from the charger and press the power button a few TIMES. Then try again.1) Replace the cmos battery then reset the bios to default.
2) In the bios, find the device boot order and move the dvd drive to the top followed immediately by the hard drive.

If the system still doesn't boot properly you should at least be able to boot to the Vista cd now.

Please anyone who can HELP me?
I WANT to learn more about DOS attack!!!Here!

I am searching for buy a proper Antivirus software for myself. i searched about the comparisons on the Internet. I found out that there are some test labs that their results can be useful such as av-test.org and others.
my question is that which labs are best. which has more expert and famous. which can be used as reference and source for comparison of Antivirus software?
http://www.google.com/#hl=en&sclient=psy-ab&q=antivirus+test+labs&oq=antivirus+test+labs&aq=f&aqi=g1&aql=1&gs_l=hp.3..0.18622l18622l6l20096l1l0l0l1l1l0l0l0ll1l0.efis.1.&pbx=1&bav=
on.2,or.r_gc.r_pw.r_qf.,cf.osb&fp=91fbb53e0f2ce1b4&biw=1366&bih=619
Most of these free AV's are just as good as what you can buy. I prefer MSE.

Remember to only install one antivirus!

1) Avast! Home Edition
2) AVG Free Edition
3) Avira AntiVir Personal
4) Microsoft Security Essentials for Windows Vista\Windows 7 - 64 bit Download
4-a) Microsoft Security Essentials for Windows XP
5) Comodo Antivirus (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" if you choose this one)
6) PC Tools AntiVirus Free Edition
7) ThreatFire

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and FALSE virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.thank you very much for introducing free antiviruses.
As you know some SITES such www.av-test.org examine them and give SCORE for their abilities.
i WANT to know how much these sites are useful. can i refer to their statistics for knowing better antivirus?
which antivirus test labs are best?
http://www.av-comparatives.org/ is the best.You can download Avira too!!!(the red umbrella)

thyxxxxxxx GUYS!!!!!!

Quote

I did every thing you said in earlier posts. but the problem seems exist. there is a lock SHAPE in some folders such "DOCUMENT and settings" and "system recovery. i can't enter these folders with the massage: "ACCESS IS DENIED"

Quote

I changed it back to att.my.yahoo.com to see if the nginx still comes up and it does.

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, PRESS Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

When I try to run TFC, my PC freezes. I've let it sit for over 30 minutes and the desktop goes away but just freezes up.

At this point I'm ready to dump Chrome and go back to Explorer unless you have any other ideas.

Hi SD,
Not trying to be difficult, but those instructions were for Windows 7, and I have Windows XP Media Center Edition 2005. I did try looking for how to boot to systems recovery options on my own though, and it seemed they were saying to just go to Safe Mode to get Safe Mode with command prompt. I did that, went through the process of selecting my user name (HP_Administrator), got C:\Documents and Settings\HP_Administrator> Tried entering bootrec /fixmbr (I remembered to include the space). Got the message that bootrec was not recognized as an internal or external command, operable program, or batch file. So I typed exit, and then just got the black screen with safe mode in the 4 corners. Didn't know how to get out of that, so I just turned off the computer with the power button.

I do have a disk my daughter made when we got this computer, it is labeled "HP Recovery Tools CD". I looked at the contents with WinExplorer: it has a lot of language file folders, some file folders that begin with R and a number, some files that are labeled bootfont with a different extensions (they seem to correspond to the languages), and some files labeled WIN51, [emailprotected], WIN511C, etc.

I also have a set of 3 recovery disks she made when we got the computer, I'm assuming they are for a destructive recovery? I have not looked at them.

Also, under My Computer, C is my hard drive, but there is also a D drive labeled HP_Recovery. I don't know if any of this info helps you decide what to do next. As I said, I'm not trying to be difficult, but want to make sure I'm doing the right THING. Thanks.

After writing all this, I found this site on line that appears to say to ignore the error message for Windows 2000 (but it doesn't say for XP): should I just ignore the error message ?

http://support.microsoft.com/kb/266745

I also found this site that says it also applies to XP:

http://www.tomshardware.com/forum/87475-45-fixmbr-dont

I'm not trying to undermine or second-guess you, just trying to help with research (I don't expect you to know everything. :>). I won't do anything that you haven't checked and said I should do. If you say go ahead then I'll do it. Thanks!Quote

Also, under My Computer, C is my hard drive, but there is also a D drive labeled HP_Recovery

After writing all this, I found this site on line that appears to say to ignore the error message for Windows 2000 (but it doesn't say for XP): should I just ignore the error message ?

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

has my information been vulnerable during this infection/invasion? In otherwords, paying bills on-line (at secure sites) or entering private info on the same sites, is there any chance that info has been compromised?

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

I run Zone Alarm Security Suite and the teatimer program (is it SAS, or Spybot?

Why didn’t ZA or teatimer catch this stuff coming in? Do you think they prevented anything going out?

They sent me an “invitation” I had to accept so they could gain remote access. Is there any chance that’s where the rootkits came from and they’re harmless? Is there any way to tell where they came from and what they did--or are doing?

I read also that malware can be downloaded to your computer through image files. Unfortunately, I have downloaded LOTS of image files--I draw as a hobby and when I see a picture I like, I download it to use as a reference. I have hundreds of pictures. I backed them all up to CD along with my other files when I did the back-ups this week. Would they have been scanned when downloaded? Would something have shown up if there was something in them? Could they/should they be scanned now on the CD? (I’d like to keep them if I could, but if there’s any chance they’ll do harm, I won’t keep them--but is it safe to get my other files off the disk now?)

Are there any other types of files malware could now be hiding in--word or excel files, for example..

I read that the only way to be sure my computer is clean is to reformat completely and reinstall the disks. I’m not sure I could handle that, even if I bought the disks (could it be done from the recovery disks, or does reformatting require original installation disks?) Besides, how safe is it really for how long--if this stuff got in once, why couldn’t it get in again the first time I went on-line? Is it really a fail-safe?

I don’t save/remember passwords, not even in Outlook for e-mail; I don’t keep password lists on my computer--but I do have a document I save to flash-drive with passwords. Is it possible my passwords are compromised anyway--could the info be stolen when I had the file open while working in it? Same with account #s--the only time they’re on my computer is when I type them in on a “secure” site. Wouldn’t that require a program to log keystrokes, and is there any way to tell if that happened? (I e-filed my taxes, all our taxes, on-line about a month ago. I shudder to think that I typed in social security #s and everything. Is this info vulnerable?)

One of the articles mentioned something about changing passwords if you use a router. We have a router; this computer is attached to the router through a line, but my daughter’s laptop is wireless. This computer is the administrator for the router. Is her computer in danger? Do I need to change the password? (And if I do, how do I know it’s safe to do it now?)

I had ZA off for about a day when it seemed to be causing the problem (I exited from the task tray; does that turn off the firewall too, or just the antivirus?) It’s been back on most of the time since then though. But teatimer resident is still off--I turned it off when your instructions said to. Should I turn it back on yet?

ZA scanned while ESET was scanning, and it came up with 4 items--but when I looked at them, it appeared they were all items quarantined by TDSSKiller. I’m assuming they’re nothing to worry about now. Is that correct?

My big fear is having done the income taxes and paying bills on-line, wondering how much of a possibility there is that my information was compromised. I thought as I was on a secure site there was nothing to worry about. Is there no way to determine if anything was stolen?

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

I have been running Zone Alarm suite, spybot, and SAS for a couple of years; I update them periodically (I have to get back onto a schedule again, I admit) and also do scans with MBAM, CCleaner, Spyware Blaster...should I keep doing all of this, or are any of them not really necessary?

I was thinking I should add TFC (or is CCleaner enough), ESET, Securia occasionally...should I?

Should I also be running anything else on a regular basis (like TDSSkiller?) or are these better left to only when there are problems and someone who actually knows what they're doing is supervising their use?

Should I now delete all of the programs we used in this fix and their logs from my desktop, or just move them to a folder and keep them?

Are we all done now, and would it be OK to defrag? With all the stuff I've removed, I'm sure it needs it.

It may just be my computer, but in the last 5 or 6 months it seems like it is getting more and more bogged down and the constant processing / clicking noise is driving me crazy. Before I spent any money upgrading ram or anything, I would like to have my logs checked to make sure there isn't something else going on.

I have a Gateway E-4610S Desktop with 2GB Ram and a 80GB Hard Drive with less than 25% being used.

Here are my logs:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/05/2012 at 00:45 AM

Application Version : 5.0.1146

Core Rules Database Version : 8418
Trace Rules Database Version: 6230

Scan type : Complete Scan
Total Scan Time : 00:44:55

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 451
Memory threats detected : 0
Registry items scanned : 32725
Registry threats detected : 0
File items scanned : 113686
File threats detected : 80

Adware.Tracking Cookie
ictv-ic-ec.indieclicktv.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\E4JWD5RD ]
.serving-sys.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.game-advertising-online.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.dmtracker.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
ad.yieldmanager.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
www.googleadservices.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.burstnet.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.www.burstnet.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.burstnet.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
www.burstnet.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.tribalfusion.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\DOCUMENTS AND SETTINGS\AIDAN.MICHAEL\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\8E6N0U4M.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.dmtracker.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.usatoday1.112.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.truevalue.122.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.statcounter.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
wstat.wibiya.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.media2.legacy.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.media2.legacy.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.timeinc.122.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.msnportal.112.2o7.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.countingcrows.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.countingcrows.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
statse.webtrendslive.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\MIKE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UK3K73OZ.DEFAULT\COOKIES.SQLITE ]


Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.04.05.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Mike :: MICHAEL [administrator]

4/5/2012 9:10:13 AM
mbam-log-2012-04-05 (09-10-13).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 236085
Time elapsed: 5 minute(s), 56 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26
Run by Mike at 9:18:35 on 2012-04-05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.998.387 [GMT -5:00]
.
AV: Kaspersky Anti-Virus *Enabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: COMODO Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
uInternet Settings,ProxyOverride =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\ievkbd.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2011\avp.exe"
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1259633329522
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{B7D8324C-E688-45B7-B0AF-BA9589464CC3} : DhcpNameServer = 192.168.1.254
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
Notify: klogon - c:\windows\system32\klogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\mike\application data\mozilla\firefox\profiles\uk3k73oz.default\
FF - plugin: c:\documents and settings\mike\application data\mozilla\firefox\profiles\uk3k73oz.default\extensions\{195a3098-0bd5-4e90-ae22-ba1c540afd1e}\plugins\npGarmin.dll
FF - plugin: c:\documents and settings\mike\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_228.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
.
============= SERVICES / DRIVERS ===============
.
R0 KL1;kl1;c:\windows\system32\drivers\kl1.sys [2010-6-9 132184]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-6-30 494968]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-6-30 31704]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010-6-9 11352]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2011-9-3 475736]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-6-29 116608]
R2 AVP;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky anti-virus 2011\avp.exe [2010-11-2 365336]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2011-6-30 1983232]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2007-10-9 38144]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2010-5-7 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19472]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [2007-12-28 287232]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-4 253600]
.
=============== Created Last 30 ================
.
2012-04-05 04:53:40418464----a-w-c:\windows\system32\FlashPlayerApp.exe
2012-03-22 19:56:32592824----a-w-c:\program files\mozilla firefox\gkmedias.dll
2012-03-22 19:56:3244472----a-w-c:\program files\mozilla firefox\mozglue.dll
.
==================== Find3M ====================
.
2012-04-05 05:10:4570304----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-11 21:13:4531704----a-w-c:\windows\system32\drivers\cmdhlp.sys
2012-03-11 21:13:44494968----a-w-c:\windows\system32\drivers\cmdGuard.sys
2012-03-11 21:13:4318056----a-w-c:\windows\system32\drivers\cmderd.sys
2012-03-11 21:13:1933984----a-w-c:\windows\system32\cmdcsr.dll
2012-03-11 21:13:18301224----a-w-c:\windows\system32\guard32.dll
2012-02-03 09:22:181860096----a-w-c:\windows\system32\win32k.sys
2012-01-11 19:06:473072------w-c:\windows\system32\iacenc.dll
2012-01-09 16:20:25139784----a-w-c:\windows\system32\drivers\rdpwd.sys
.
============= FINISH: 9:20:16.57 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/30/2009 10:00:06 PM
System Uptime: 4/4/2012 11:51:14 PM (10 hours ago)
.
Motherboard: Intel Corporation | | DQ965MT
Processor: Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz | | 1864/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 73 GiB total, 54.859 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel(R) 82566DM Gigabit Network Connection
Device ID: PCI\VEN_8086&DEV_104A&SUBSYS_0001107B&REV_02\3&61AAA01&0&C8
Manufacturer: Intel
Name: Intel(R) 82566DM Gigabit Network Connection
PNP Device ID: PCI\VEN_8086&DEV_104A&SUBSYS_0001107B&REV_02\3&61AAA01&0&C8
Service: e1express
.
==== System Restore Points ===================
.
RP382: 1/6/2012 10:23:33 PM - System Checkpoint
RP383: 1/7/2012 11:06:15 PM - System Checkpoint
RP384: 1/8/2012 11:30:15 PM - System Checkpoint
RP385: 1/10/2012 12:37:10 AM - System Checkpoint
RP386: 1/11/2012 1:18:15 AM - System Checkpoint
RP387: 1/11/2012 3:00:17 AM - Software Distribution Service 3.0
RP388: 1/12/2012 3:31:35 AM - System Checkpoint
RP389: 1/13/2012 4:31:35 AM - System Checkpoint
RP390: 1/14/2012 4:43:35 AM - System Checkpoint
RP391: 1/15/2012 4:43:55 AM - System Checkpoint
RP392: 1/16/2012 5:49:43 AM - System Checkpoint
RP393: 1/17/2012 6:56:56 AM - System Checkpoint
RP394: 1/18/2012 7:43:56 AM - System Checkpoint
RP395: 1/19/2012 7:44:08 AM - System Checkpoint
RP396: 1/20/2012 8:44:07 AM - System Checkpoint
RP397: 1/21/2012 9:44:08 AM - System Checkpoint
RP398: 1/22/2012 9:44:27 AM - System Checkpoint
RP399: 1/23/2012 10:56:28 AM - System Checkpoint
RP400: 1/24/2012 3:00:15 AM - Software Distribution Service 3.0
RP401: 1/25/2012 3:56:27 AM - System Checkpoint
RP402: 1/26/2012 3:00:15 AM - Software Distribution Service 3.0
RP403: 1/27/2012 3:21:23 AM - System Checkpoint
RP404: 1/28/2012 3:25:46 AM - System Checkpoint
RP405: 1/29/2012 4:31:58 AM - System Checkpoint
RP406: 1/30/2012 5:14:11 AM - System Checkpoint
RP407: 1/31/2012 5:36:44 AM - System Checkpoint
RP408: 2/1/2012 5:48:43 AM - System Checkpoint
RP409: 2/2/2012 6:37:49 AM - System Checkpoint
RP410: 2/3/2012 7:36:44 AM - System Checkpoint
RP411: 2/4/2012 7:37:31 AM - System Checkpoint
RP412: 2/4/2012 5:58:59 PM - Installed Ice Cream Tycoon
RP413: 2/5/2012 11:54:07 PM - System Checkpoint
RP414: 2/7/2012 12:37:03 AM - System Checkpoint
RP415: 2/8/2012 12:49:03 AM - System Checkpoint
RP416: 2/9/2012 1:49:03 AM - System Checkpoint
RP417: 2/9/2012 8:07:35 AM - Installed H&R Block Premium + Efile + State 2011.
RP418: 2/10/2012 8:42:56 AM - System Checkpoint
RP419: 2/11/2012 9:08:34 AM - System Checkpoint
RP420: 2/11/2012 10:51:10 AM - Installed H&R Block Missouri 2011.
RP421: 2/12/2012 11:28:25 AM - System Checkpoint
RP422: 2/15/2012 7:14:01 PM - System Checkpoint
RP423: 2/15/2012 10:05:11 PM - Software Distribution Service 3.0
RP424: 2/16/2012 10:05:36 PM - System Checkpoint
RP425: 2/17/2012 10:17:55 PM - System Checkpoint
RP426: 2/18/2012 10:59:14 PM - System Checkpoint
RP427: 2/19/2012 11:10:10 PM - System Checkpoint
RP428: 2/20/2012 11:58:09 PM - System Checkpoint
RP429: 2/22/2012 12:10:09 AM - System Checkpoint
RP430: 2/23/2012 1:10:09 AM - System Checkpoint
RP431: 2/24/2012 2:10:09 AM - System Checkpoint
RP432: 2/25/2012 2:58:29 AM - System Checkpoint
RP433: 2/26/2012 3:10:30 AM - System Checkpoint
RP434: 2/27/2012 3:58:29 AM - System Checkpoint
RP435: 2/28/2012 5:10:29 AM - System Checkpoint
RP436: 2/29/2012 6:10:30 AM - System Checkpoint
RP437: 3/1/2012 6:58:29 AM - System Checkpoint
RP438: 3/2/2012 7:58:29 AM - System Checkpoint
RP439: 3/3/2012 7:59:03 AM - System Checkpoint
RP440: 3/4/2012 8:59:07 AM - System Checkpoint
RP441: 3/5/2012 9:59:08 AM - System Checkpoint
RP442: 3/6/2012 9:42:24 PM - System Checkpoint
RP443: 3/7/2012 10:11:59 PM - System Checkpoint
RP444: 3/8/2012 10:59:59 PM - System Checkpoint
RP445: 3/10/2012 12:12:02 AM - System Checkpoint
RP446: 3/11/2012 2:12:02 AM - System Checkpoint
RP447: 3/12/2012 3:12:05 AM - System Checkpoint
RP448: 3/13/2012 6:15:41 AM - System Checkpoint
RP449: 3/14/2012 3:00:19 AM - Software Distribution Service 3.0
RP450: 3/15/2012 3:24:25 AM - System Checkpoint
RP451: 3/16/2012 4:24:25 AM - System Checkpoint
RP452: 3/17/2012 4:46:08 AM - System Checkpoint
RP453: 3/18/2012 5:46:07 AM - System Checkpoint
RP454: 3/19/2012 5:50:52 AM - System Checkpoint
RP455: 3/20/2012 6:49:21 AM - System Checkpoint
RP456: 3/21/2012 7:48:57 AM - System Checkpoint
RP457: 3/22/2012 8:23:47 AM - System Checkpoint
RP458: 3/23/2012 8:47:53 AM - System Checkpoint
RP459: 3/24/2012 8:48:12 AM - System Checkpoint
RP460: 3/25/2012 10:26:15 AM - System Checkpoint
RP461: 3/26/2012 10:48:10 AM - System Checkpoint
RP462: 3/27/2012 11:00:11 AM - System Checkpoint
RP463: 3/28/2012 12:00:14 PM - System Checkpoint
RP464: 3/29/2012 12:48:11 PM - System Checkpoint
RP465: 3/30/2012 1:00:10 PM - System Checkpoint
RP466: 3/31/2012 1:00:44 PM - System Checkpoint
RP467: 4/1/2012 2:00:44 PM - System Checkpoint
RP468: 4/2/2012 2:48:43 PM - System Checkpoint
RP469: 4/3/2012 4:00:45 PM - System Checkpoint
RP470: 4/4/2012 4:48:44 PM - System Checkpoint
.
==== Installed Programs ======================
.
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.2)
Adobe Shockwave Player 11.5
Apple Application Support
Apple Software Update
BeerSmith
CCleaner
COMODO Internet Security
Epson Event Manager
Epson FAX Utility
Epson PC-FAX Driver
EPSON Scan
EPSON WorkForce 610 Series Printer Uninstall
EPSON WorkForce 630 Series Printer Uninstall
EpsonNet Print
EpsonNet Setup
EpsonNet Setup 3.3
GIMP 2.6.4
H&R Block Missouri 2011
H&R Block Premium + Efile + State 2011
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Ice Cream Tycoon
Intel Audio Studio 2.0
Intel(R) Active Management Technology LMS Service and SOL Driver
Intel(R) Management Engine Interface
Intel(R) PRO Network Connections Drivers
Java(TM) 6 Update 26
Kaspersky Anti-Virus 2011
Malwarebytes Anti-Malware version 1.60.1.1000
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2000 Premium
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 11.0 (x86 en-US)
NETGEAR WG111v3 wireless USB 2.0 adapter
NetZero For Cosmi
OpenOffice.org 3.0
QuickTime
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2183461)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360131)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2416400)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976325)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
SigmaTel Audio
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
SpywareBlaster 4.4
Squeezebox Server 7.6.1
SUPERAntiSpyware
Tux Paint 0.9.21c
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
Update for Windows XP (KB978207)
Update for Windows XP (KB980182)
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows Search 4.0
Yahoo! BrowserPlus 2.9.8
.
==== Event Viewer Messages From Past Week ========
.
4/1/2012 12:04:04 AM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Type with the following error: Access is denied.
.
==== End Of File ========================Hello and welcome to Computer HOPE Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Download Combofix from any of the links below, and save it to your DESKTOP.

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

I explained my situation to a reliable source who said it sounded like a bug.

You should contact your Internet Service Provider to set up a connection.i contacted them they state the issue is with Internet Explorer not RESPONDING and the virus may have wiped out my drivers?They were unable to help,not sure what i am going to do now?Ok. Let's try to create a NEW connection. Click Start, Control Panel, Network connections and click "create a new connection". You will get the connection Wizard. Click NEXT and select Connect to the internet. Click choose from a list of ISP's and click next. Since I don't know your ISP you will have to search for it. The next drop-down box has two options. The first is Get online with MSN(only GOOD in US.) and the second is Select from a list of ISP's.

Every one, we are computer classroom adminitrator, because all COMPUTERS are USED for all students.
during one week, there is virus infected, it is REALLY headached to manage all computers when there is virus infected.

Is there any good way to solve this problem? Don't you INSTALL antivirus software? It does't WORK?

That looks good. If there are no other issues, we can do some cleanup.

To uninstall ComboFix

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press ENTER, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

would you suggest me incresing my RAM? I only have 2GB.

Now can I uninstall any of the programs you had me install throughout this cleanup process?

I Have Windows 7 Gateway SX2851

Its been a couple months now when i was gone, someone was using computer when i came back it was messed up. no previous problems. Now anytime i open ANY folder (new folder, my documents, my computer etc.) the computer turns off within 1-5 seconds and goes to blue screen, But I can RUN any program and open control panel, start menu, internet, play music or movies and open files on the desktop, the only way to access files off desktop is through start menu search. Originally I Only Had AVG Free, and CCleaner, Since problem I have ran many security programs (Norton, Avira, Avast, Superanti Spyware, Malware Bytes, Ad Aware, Boot Scans Etc.) Also have performed ChkDsk disk check, SFC Scannow from Command Prompt, Data Lifeguard Diagnostic for windows, Uniblue Registry Booster.

Please someone give any advice to help fix this. Even if i can access the folders temporarily it will give me time to back up my files on external hd and restore the computer. Thank YouDownload BlueScreenView:
http://www.nirsoft.net/utils/blue_screen_view.html
unzip downloaded file and double click on BlueScreenView.exe to run the program.
when scanning is done, go to EDIT - Select All
Go to FILE - SAVE SELECTED Items, and save the report as BSOD.txt
Open BSOD.txt in Notepad, copy all of the content, and paste it into your next replyBecuase of the problem i cant even save anything because it opens the save as folder and turns off, so i had to copy it by hand

Dump File -040712-17768-01.dmp
Crash Time -4/7/2012 12:07:49 PM
Bug Check String -KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code -0x0000001e
Paramater 1 -ffffffff`c0000005
Paramater 2 -fffff880`0578d5d0
Parameter 3 -00000000`00000000
Paramater 4 -00000000`00000000
Caused By Driver -ntoskrnl.exe
Caused By Address - ntoskrnl.exe+7cd40
File Description -NT Kernel & System
Product Name -Microsoft® Windows® Operating System
Company -Microsoft Corporation
File Version -6.1.7601.17727 (win7sp1_gdr.111118-2330)
Processor -x64
Crash Address -ntoskrnl.exe+7cd40
Stack Address 1 -
Stack Address 2 -
Stack Address 3 -
Computer Name -
Full Path - C:\Windows\Minidump\040712-17768-01.dmp
Processors Count -4
Major Version - 15
Minor Version - 7601
Dump File Size - 262,144






Dump File -040712-18314-01.dmp
Crash Time -4/7/2012 12:00:16 PM
Bug Check String -KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code -0x0000001e
Paramater 1 -ffffffff`c0000005
Paramater 2 -fffff880`06f0a5d0
Parameter 3 -00000000`00000000
Paramater 4 -00000000`00000000
Caused By Driver -ntoskrnl.exe
Caused By Address -ntoskrnl.exe+7cd40
File Description - NT Kernel & System
Product Name -Microsoft® Windows® Operating System
Company -Microsoft Corporation
File Version -6.1.7601.17727 (win7sp1_gdr.111118-2330)
Processor -
Crash Address -ntoskrnl.exe+7cd40
Stack Address 1 -
Stack Address 2 -
Stack Address 3 -
Computer Name -
Full Path - C:\Windows\Minidump\040712-18314-01.dmp
Processors Count -4
Major Version - 15
Minor Version - 7601
Dump File Size - 262,144Does the same thing happen if you boot to safe mode?

Have you recently updated any drivers?

Do you still have multiple antivirus apps installed? If so, please pick one and delete all of the rest. You should never have more than one installed.

Open device manager - any yellow or red SYMBOLS?

See if anything here helps: http://support.microsoft.com/kb/275678i also cant boot in safe mode, while starting up it freezes and will not boot all the way

Not that i know of manually, maybe if set for auto

No i have uninstalled the extras

Nothing Red Or Yellow in Device Manager

And ill be working on trying the suggestions on that link
i ended up fixing it! I restarted my computer in selevtive startup, got access to folders and backed up all my files on external hd and restored the computer to new thank you for the helpOkay, thanks for the follow up. Glad you're all sorted out. I'm a little surprised a selective startup worked since you could not boot to safe mode.

Specs: Gateway 835 GM Windows XP Intel Pentium D CPU, 2.80 GHz 1.0GB RAM, Intel 82945G

I'm not sure if this is a VIRUS PROBLEM or what. But this suddenly started happening Thursday. My computer will randomly turn itself off and when it turns back on it says Windows was not able to successfully turn on. Then it gives me LIKE 5 options including Safe Mode, Last Successful Configurement etc... when I finally get Windows up I get a "windows has recovered from a serious error". I don't know if my computer was getting to hot and turning off? But I cleaned off my fan and it still happened.

NOW my computer is working but my desktop icons disappear within 30 minutes of my computer being on. They are still there now but I'm not sure how long that will last. I ran AVG, Ccleaner (as suggested by someone on here in a previous post) but have not been using my computer long enough to see if that did the trick. Any ideas on what it could be? Let me know if I need to tell you anything else. I'm going crazy trying to figure it out.
Quote

I cleaned off my fan and it still happened.

I ran AVG

The scum that write this stuff are being brought to BOOK ...

http://www.theinternetpatrol.com/lawsuit-filed-against-winfixer-aka-errorsafe-winantispyware-winantivirus-systemdoctor-and-drivecleaner

You ALSO have their address if you feel like JOINING in the complaints.


OJthanks ALOT for the info oddjob


unlovedwarrior

we have been trying to find a link for days now. we think it may be a virus from an EMAIL. our computer will slow down, freeze up, and states " internet explorer CAUSED an error, and also says SHPRRPRT.DLL." we have tried to find this link or file but everything says that "link/file" is not found or will not let us OPEN a program to find it. PLEASE HELP!!!!! What antivirus and antispyware protection are you using? Try it ALL in safe mode with system restore turned off and post back.war3006.......

This spyware BHO (smrtshpr.dll) is related to SmartShopper

Have you run your anti virus and your antispyware APP from safe mode ? A good antispyware to try is the AVG antispyware ......
get it at http://free.grisoft.com/doc/20/lng/us/tpl/v5 ...make sure to get the latest updates.

Please post a hijackthis log here for us to have a look at ...... after you have run the above mentioned scans.


dl65

I have the AVG Free Edition 7.1 which is no longer supported by Grisoft. I'm having difficulty uninstalling it. I tried to DELETE the files as well as remove it from the Add/Remove program but it will not allow me to uninstall. There was a WARNING to the effect that it failed initialization. I don't want it in my PC any longer because the support was somewhat lousy. It won't even acknoledge the license number given to me. Anyone got any ideas how to delete this monster altogether? ThanksTry using ccleaner.AVG Free edition has been updated to version 7.5, and their free antivirus product is still FREE it is a misunderstanding that the product is no longer available but it is FREE ans available from here:-

http://free.grisoft.com/doc/1It's true that AVG is still free, but donsor's version is no longer supported by Grisoft, meaning that they no longer provide updates and whatnot for it.

donsor, if you can get 7.1 off of your COMPUTER, I would advise downloading 7.5; it works very well and the support for it is great.You can install 7.5 right on top of it. If you insist on uninstalling 7.1 first, you have to disable the active scan first. (Right click on the icon in the task bar.)As the product is free and ONE of the best along with having an excellent support forum that is also free i can't understand you bashing it as an inferior program...
But that's just me.

ok, im on my laptop and i had a bunch of apps running, and i was very frustrated, so i just turned it off, well, then i turned it BACK on and this black screen keeps SAYING that i can reboot my comp, but it is running very SLOW, and sometimes my computer works but it is super slow, and i think i have a virus, but how do i get rid of it pLEASE HLEP MEPlease see below.Sometimes it helps to turn the computer off, unplug it (to MAKE sure everything is off). Wait a minute or two then plug it in and reboot.Turn the light off....

Hello everyone! If anyone could help me I'd really appreciate it.

Problem: Computer has slowed tremediously.

Solutions i've tried: Avg-Antispyware, Avg-Antivirus, Ad-Adware SE Personal, Trojan Hunter, Spybot Search and Destroy, V-cleaner, Find Junk Files software. As far as the system itself i've defrag, disk-cleanup, delete cookies, delete history, delete temporary files under internet options.

The harddrive is fine and I'm seriously at a loss. I downloaded hijackthis but I don't know what to delete if anyone could tell me possibly what to delete i'd appreciate it.

Specs of Computer

Dell Pentium 4
Windows XP Home Edition
256 Ram
1.79 GHz

Logfile of HijackThis v1.99.1
Scan saved at 6:14:44 PM, on 2/28/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet EXPLORER v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\TrojanHunter 4.6\THGuard.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Don Nichols\My Documents\Unzipped\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = actsvr.comcastonline.com:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = cdn
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SideStep Browser Helper - {08351227-6472-43BD-8A40-D9221FF1C4CE} - C:\WINDOWS\Downloaded Program Files\SbCIe027.dll
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [expcat] C:\WINDOWS\Speech\expcat.exe
O4 - HKLM\..\Run: [*runole] C:\WINDOWS\msagent\runole.exe
O4 - HKLM\..\Run: [*crnut] C:\WINDOWS\Tasks\crnut.exe
O4 - HKLM\..\Run: [*utilcom] C:\WINDOWS\Tasks\utilcom.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [7b8b] C:\WINDOWS\onoptca.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [7b8—?¿L+ú\mú"À‰üžigC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\onoptca.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [YdcvyxCM] C:\WINDOWS\xsbmf.exe
O4 - HKLM\..\Run: [Fast start] C:\WINDOWS\system32\ntnut.exe home
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\BIN\PPCOLink -STATION
O4 - HKLM\..\Run: [DxDialog] C:\WINDOWS\System32\dxdlg32.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.6\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.Unfortunately, I'm only just STARTING to learn this stuff, so I can't tell you too much because I'd hate to accidentally have you remove the wrong thing. What I can tell you, however, is that the guys here will need your complete log. Messages a 5500 character maximum, so you'll have to use multiple posts. The log should go all the way down to 023.

Just from a quick glance of what you posted, I can see that you have at least the Trojan.ISTsvc and Troj/VB-CXT trojans (probably more). So, while you wait for the experts to come along, I WOULD advise updating your protection.It also looks like you need to update your Java (I actually need to get the latest update now that I think about it). And I'm wondering...why don't you have the Windows XP Service Pack 2 installed? Both of these things can help with your protection.O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [winxpdll32.exe] C:\WINDOWS\System32\winxpdll32.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh304181.dll/201
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\Downloaded Program Files\SbCIe027.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.iframedollars.biz (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {C72242D0-3AB5-453D-842C-8A3C9AC0838D} - http://download.sidestep.com/get/k00719/sb027.cab
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: JFWService - FREEDOM Scientific BLV Group, LLC. - C:\JAWS402\jfw.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Server Advance (ServerAC) - Unknown owner - C:\WINDOWS\System32\Security.exe (file missing)

Quote

....I'm wondering...why don't you have the Windows XP Service Pack 2 installed? Both of these things can help with your protection.

Heu Guys

Just started having this problem today, when I run Adaware it stops when it GETS to CLSID whatever that is. Every time I cancel and restart it stops at the same file again, any ideas?Its happen to me b4 is probly a virus stopping you from opening the file.

Ad Ware Se Detects about 25% of the Adwares on your computer I use to use it.

When I used a diffrent Ad Ware Program it detected 50 sometihng out of the 18 Ad Ware SE found.

I suggest getting a AV like AVG or MCafree run a scan if you cant install it, itss because the virus or trojan is preventing you from installing it. If this does happen.Save everytihng in a USB or Disk and REBOOT your computer from the begining if you have WINDOWS XP press F10 when the computer starts and the computer will begin to reboot everything now you WONT have any Trojans,Viruses,Worms,Adware,Spyware,or any other malicious program.When CLSID is showing it is checking the registry. It is not unusual for AdAware to "appear" to be stopped when it fact it is not. How much time do give it before deciding it is stopped? When this happens, watch the "items checked" for a few minutes to see if it changes.Some good advice here but, if you continue to have trouble, try this .....

Download Ewido/AVG Anti Spyware from here (this prgram will also remove adware) ….

http://www.ewido.net/en/

It has a FULLY working 30 day trial period.

Install it and update it to the latest definitions.

Do NOT use it yet.


Now boot to safe mode. Here’s a “how to” if you’re not sure ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406


When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

[FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].

----------------------------

If this doesn’t succeed in fixing the problem download a self-extracting copy of HijackThis from here …….

http://downloads.malwareremoval.com/hijackthis_sfx.exe

Save it to your Desktop.

Double-click on the file hijackthis_sfx.exe file and it will self-extract into its own folder ……

C:\Program Files\HijackThis

Go to this folder and run the hijackthis.exe file.

From the menu click on "Do a system scan and save a logfile".

Copy and paste both the AVG AS scan report and the HJT logfile to this thread. More specific removal instructions will follow for whatever it is that's causing the problem.


OJ

Any opinions or views on Sandboxie 2.79.3 Beta? I have seen it as a download on majorgeeks and wondered if it was WORTH installing it, but don't WANT to make the same mistake as I did with spyware terminator which caused more problems than it cured.
Thanks for any replies.
Link to Sandboxie 2.79.3 Beta below.

http://www.majorgeeks.com/Sandboxie_d4993.htmlIt has been running on my benchtest machine for a few weeks now...no issues to report as of yet.

PATIO. 8-)Thanks Patio. I will give it a couple of weeks and if you have not posted any problems about it will give it a TRY.

Can someone analyze these results for me?
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 2:13:54 PM 3/9/2007

+ Scan result:



HKLM\SOFTWARE\Classes\AlxTB.BHO -> Adware.Alexa : IGNORED.
HKLM\SOFTWARE\Classes\Popup.PopupKiller -> Adware.Alexa : Ignored.
HKLM\SOFTWARE\Classes\CLSID\{F1FABE79-25FC-46de-8C5A-2C6DB9D64333} -> Adware.Generic : Ignored.
HKU\S-1-5-21-4039157630-3002777719-1478863617-1007\Software\ADV -> Adware.Generic : Ignored.
C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL -> Adware.IESearch : Ignored.
C:\WINDOWS\SYSTEM32\vtsqn.dll -> Adware.Virtumonde : Ignored.
HKLM\SOFTWARE\Classes\CLSID\{E52DEDBB-D168-4BDB-B229-C48160800E81} -> Hijacker.Generic : Ignored.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e52dedbb-d168-4bdb-b229-c48160800e81} -> Hijacker.Generic : Ignored.
HKU\S-1-5-21-4039157630-3002777719-1478863617-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E52DEDBB-D168-4BDB-B229-C48160800E81} -> Hijacker.Generic : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.2o7 : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.2o7 : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.2o7 : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Addynamix : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Bluestreak : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Burstnet : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Com : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Esomniture : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Liveperson : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Pointroll : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Questionmarket : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Ru4 : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Specificclick : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Specificclick : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Tacoda : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Tacoda : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Tacoda : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][1].txt -> TrackingCookie.Tribalfusion : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Yieldmanager : Ignored.
C:\Documents and Settings\Craig Davis\Cookies\craig [emailprotected][2].txt -> TrackingCookie.Zedo : Ignored.


::Report end
The log shows evidence of a fair amount of rubbish, some more serious than others.

First ... go here and RUN through the process to remove Vundo ....

http://www.bleepingcomputer.com/forums/topic18610.html


When done update your AVG Anti Spyware to the latest definitions then scan your computer with it in safe mode. Save the log as you did before.


Download a self-extracting copy of HijackThis from here …….

http://downloads.malwareremoval.com/hijackthis_sfx.exe

Save it to your Desktop.

Double-click on the file hijackthis_sfx.exe file and it will self-extract into its own folder ……

C:\Program Files\HijackThis

Go to this folder and run the hijackthis.exe file.

From the menu click on "Do a system scan and save a LOGFILE".

Copy and paste both the AVG AS scan report and the HJT logfile to this thread.

Also let us know if you are experiencing any trouble.

More specific removal INSTRUCTIONS will follow for anything that's causing problems.


OJ

So if u could let me know which problems to fix from my scan recently posted, that would be very helpful

Thankyou

mattWell, nothing jumps out at me.
We'll have to wait for a HJT expert to come along an analyse it, I know a fair amount but it's easy to miss things, better to wait for someone who knows exactly what's wrong and how to fix it.ok ty for your help anywayI will move this where it may be SPOTTED better. Thankyou for moving the topic GX1_MAN, hopefully i,ll get some answers as my computer is running no faster!!

takes me about 3 minutes to get the web browser up and making some strange noises!!


thanks for any help

MattWhat "strange noises" and when do they happen?

**************

So far as the log goes it's not in bad shape.

However, I see that you do have many processes running (that could slow the system down) and you use PalTalk.

You should check through your processes to see if there are any that you don't need.

Also Paltalk is an advertising-supported program and can let in malware. I strongly recommend you remove/uninstall it immediately.

**************

Once you have done that .... download Ewido/AVG Anti Spyware from here ….

http://www.ewido.net/en/

It has a fully working 30 day trial period.

Install it and update it to the latest definitions.

Do NOT use it yet.


Now boot to safe MODE. Here’s a “how to” if you’re not sure ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406


When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

[FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].

**************

Reboot to normal mode, scan with HJT and post the AVG AS repost and the HJT log here.

Please also update us on how your COMPTER is operating now. Any better?


OJHello OJ,

Thank you very much for your advice,

I downloaded AVG and ran a scan in safe mode and fixed the selected 16 threats it found.

I,ve also ran the hjt and below are is the log from this scan.

It seems to running faster already after the avg scan

thanks again for your help and any further advice.


Logfile of HijackThis v1.99.1
Scan saved at 13:25:10, on 05/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
E:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
E:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\winmine.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Messenger\msmsgs.exe
E:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe


Matt..the rest of the scan log;

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?f73872f5b454420fb18270efeebf8f0e
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?f73872f5b454420fb18270efeebf8f0e
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - E:\Program Files\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - E:\Program Files\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Nothing dreradful in the log (although I see you have decided to keep Paytalk )

**************

Open HJT and fix this entry with it IF it's still present ...

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


As ALWAYS ... close ALL open windows before you click on "Fix Checked" at the foot of the HJT window.

**************

Your Java is a little out of date.It's up to version 6 now. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications"…..
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6-windowsi586-p.exe to install the newest version.

Dear Experts,

On my Windows XP SP2....when I clicked on "Add Remove Program" on Control Panel, the new pop up window of "Add Remove Programs" appeared as normal...but I dont know why it close automatically without any orders...ANOTHER same case, time and situation, even the same for some application...for instance, when I open application of Windows Fax Viewer, the application close automatically still without any orders....I have no idea what was going on... anyone can help me please what is going on and how to fix this matter? and what the name of the virus or something is please?

Thank's a lot for your HELPS..

NatashaTry this...go to Start / Run and TYPE in sfc /scannow and hit Enter...have your XP CD handy.Hi,

Thank you for your advice. I already follow your steps but still did not WORK. When I open an application CALLED "Window Pictures and Fax Viewer", it opened but when I press any button, suddenly close...any other solution for me pls?

Natashabut do you have a windows cd? and what protection are you using?


unlovedwarrior

Advice please? Is Zone Alarm free a good fire wall? Is Jetico BETTER, or is there ANOTHER free one that you would recommend? Thanks for any advice. LINK to Jetico download (from Majorgeeks) below.
http://www.majorgeeks.com/Jetico_Personal_Firewall_d4480.htmlI recommend Sygate Personal Firewall.
It's free, powerful and doesn't slow your system as much as ZoneAlarm.
Just my opinion.Here are links to some ...


Zone Alarm > http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za

Sygate > http://www.simtel.net/product.download.mirrors.php?id=53687

Kerio Firewall > http://www.sunbelt-software.com/Kerio.cfm

Agnitum > http://www.agnitum.com/products/outpost/

m0n0wall > http://m0n0.ch/wall/
(I’ve heard good things about monowall but it takes some setting up, I believe)

SMOOTHWALL > http://www.smoothwall.org/

Tiny Personal > http://www.webmasterfree.com/tpfw.html

Outpost > http://www.agnitum.com/products/outpostfree/download.php

[Footnote … the NORMAN Personal Firewall looks like it isn’t compatible with vista but this may change.]


OJ

When ever I start up my computer I have to keep moving the mouse for about 5 minutes. When I do sit there and move the mouse it will work fine, its just a pain. When I first start it up it will APPEAR at the log-in screen and then from there I can access my account and go to the desktop. But, when I start up and it first gets to the log in screen if I am not sitting there and moving the computer will freeze. My computer makes those noises inside it when I am starting it up and when it freezes it becomes completely silent and nothing will work. I have to them turn it off and boot it back up. I haven't a foggiest what this COULD be. If anyone could help explain this to me, that would be excellent!

Thanks,
Brentino
PS: If you need any additional information please post it and I will see what I can do. Yes, how about some basic information about the computer? See below for starting points.Very well.

My computer is a Gateway, Microsoft Wimdows XP Edition verson 2002. It is Pentium 4, 3.00 GHz, 512 MB of RAM.

If I missed anything please tell me. Gatway model and age?

XP Home or Pro?

Sevice Pack?

When did the problem start?

What have you tried to FIX it?

Are you the only one using this computer?

Virus and spyware protection?

Other hardware issues?

Etc.?

Where's Dr. Patio?

Done.
Gateway model 2002, Home edition, Sevice Pack 2.

I can't remember when it started happening, just some random day. I have done nothing since to fix it because I don't have any idea how to. My sister is sharing the computer with me, but she is never on. We have McAfee virus protection, no spyware.
if you can get Ccleaner spybot search and destroy and avg antispyware, update them all reboot in safe mode(press f8 rapidly while booting up) with system restore off.


run ccleaner and also the issue scan( make a back up when it asks

run spybot

then run avg antispyware


unlovedwarriorUW, it's been three weeks! Thank you unloved, I am currently installing all of that and I am going to try.

Brentino Uunloved, I tried installing those things and ran them but, they didn't seem to do anything. But, this morning I turned it on and it worked I think because I uninstalled some of my Simcity 4 Plugins. So, I'm good...for now

BrentinoBrentino it sounds like SimCity4 is the CULPRIT here and has caused other problems per your other thread...is this an "Ahem" copy by chance ? ?I'm not exactly sure what you mean by "copy" but they are two different problems that happened at two different times, so I MADE two different threads. I uninstalled SC4 and deleted all the plugins and the freezing up problem seemed to stop, but the icon one hasn't been fixed yet.

B :-?Quote

[highlight]I'm not exactly sure what you mean by "copy"[/highlight] but they are two different problems that happened at two different times, so I made two different threads. I uninstalled SC4 and deleted all the plugins and the freezing up problem seemed to stop, but the icon one hasn't been fixed yet.

B :-?

Quote

[highlight]I'm not exactly sure what you mean by "copy"[/highlight] but they are two different problems that happened at two different times, so I made two different threads. I uninstalled SC4 and deleted all the plugins and the freezing up problem seemed to stop, but the icon one hasn't been fixed yet.

B :-?

What our dear patio means is...is this a legitimate copy of SC4 that you bought, or is it one that you downloaded and found a serial number for? If it's the latter, then that can cause a lot of trouble. Even looking for cracks/serials/keygens for games will often get you bugged.

This is a fairly simple question (I think) what is the easiest way to find a backdoor?

-Melissa-Melissa17........ Backdoor ........ usually found at the back of the house .

If you are looking for hack tips , you have come to the WRONG place ..... unfortuneatly we dont offer that sort of help.
What is it your trying to find a back door for ?

dl65 Yes, if you're looking for hacking tips, you'll want to look ELSEWHERE. But if you're looking for backdoors/trojans that may exist on your computer, I would suggest looking into AVG Anti-Virus, AVG Anti-Spyware, and TrojanHunter. And I'm sure everyone here can give you even more good suggestions.

ALSO, check Rob Pomeroy's Software FAQ.Im trying to find ways of finding backdoors so that I can make my own PROGRAM that prevents people using all these different ways of entering computers. I figure that if I know how a "Hacker" thinks and works and if I know how these worms and backdoors and trojans for example work then I can build against them. Any words of wisdom??? lol. Sory for the confusion

-Melissa-If you want to learn how a hacker operates you will need to master at least one programming language first.

This may help take you into the mind of a hacker ...

http://www.catb.org/~esr/faqs/hacker-howto.html


OJQuote

If you want to learn how a hacker operates you will need to master at least one programming language first.

This may help take you into the mind of a hacker ...

http://www.catb.org/~esr/faqs/hacker-howto.html


OJ

that suxs
Quote

I already emailed them last NIGHT asking about it.
They replied pretty soon, and said that they were in no way affiliated with NDN and advised locking my HOSTS file as read-only, which I had already done, and to keep my firewall enabled.
Their spelling was pretty bad too, [highlight]I think it MAY have been wangming [/highlight]. . .
I replied asking them the same thing in a different way, waiting to hear back from them now.
I can't even threaten to drop my service, I'm TIED into a 12 month contract which ends in a few months.

I was wondering...where can I find a good HJT tutorial? It's such a useful program and we're all using it pretty frequently, so it'd be nice to know how to read the logs better. I can kinda get the main gist by looking at them and can sometimes spot things that shouldn't be there, but I don't quite fully understand everything involved.You could have a look, >here<, >here<, >here<, or >here<. Hope that helps.

8-)fffreakThanks a lot for the links. Those are super helpful. It's a lot of info and I'm a little tired, so I can't read it all right now, but what I've read so far has already cleared up quite a few questions I had. Thanks again; this is exactly what I was looking for.Your welcome, again easy to find when you're using Google.Sorry to go of topic but i have often wondered when sending a link
how do i change the link to here or try this eg ??
You could have a look, >here<, >here<, >here<, or >here<. Hope that helps.
Skyblue

It is called BBCode, you can do this by...

Code: [Select][url=http://www.google.com/]Google[/url]Thank you
Now that tells me what its called,the question was how do i do it???
SkyblueI already told you .

Code: [Select][url=http://www.google.com/]google[/url]He just showed you how. Use that code he posted as a guideline.

Code: [Select][url=THE URL OF THE SITE YOU'RE LINKING TO]TEXT[/url]
For example...
Code: [Select]Please click [url=http://www.google.com]here[/url]
Turns into...
Please click here.CBMatt .... glad to hear someone else has caught the bug. With HJT it is imperative you remember old addage .... a little knowledge is a dangerous thing. The malware that you see in the log could be the tip of the iceberg. Much malware just hides deeper than HJT can see. Contrary to what some folk think HJT doesn't reveal everything. Far from it.

There are free training places where you can learn the art of HJT fixing better than just "reading up" on it.

Here are some of the best .....

TechSupprtForums "Academy"
http://www.techsupportforum.com/tsf-academy/

Malware Removal "University"
http://forum.malwareremoval.com/viewtopic.php?t=233

Tom Coyote "Classroom" http://forums.tomcoyote.org/index.php?showtopic=1421

Bleeping Computer "HJT Study Hall"
http://www.bleepingcomputer.com/forums/topic4970.html

Geekstogo "Geek University" (GeekU)
http://www.geekstogo.com/forum/Would_you_like_to_learn_to_fight_malware-t4817.html

SpywareInfo "BOOT camp" http://forums.spywareinfo.com/index.php?showtopic=34


You register at a school ... have a look round to see what's involved ... make your decision if you want to go ahead. You don't have to. There's no compulsion. Many people decide the committment's not there, it's too difficult or they simply haven't got the time. Oh yes .... to do it properly will take a lot of work and study but it will be worth it in the end.


Happy hunting.


OJThanks for all of the helpful links, oddjob. I'm looking into those sites right now. I'm busy with school, but I'm still interested in being adept with this program. I'm already starting to be able to point out CERTAIN things fairly quickly, which is nice. But of course, I still need more experience.With HJT follow what other experienced analysts do, google HJT entries and see what they indicate and, yes, do read up on those tutorials. They will give you an idea of what the entries can mean.

The author wrote the main tutorial on which all others are based. You can read his tutorial here ...

http://www.merijn.org/htlogtutorial.php


When looking at other analysts' work you must not necessarily believe everything you read. Follow only the recommendations of people who are clearly correct in what they say. For example, if the analyst is a member of ASAP or is an MVP you can trust what they are doing.

One small warning at the moment. In your research you may well see two programs being used when analysts fix HJT but which you must avoid at present.... Avenger and Combofix.

Avenger involves writing specific instructions/code for the specific problem of the user in question. It's a VERY powerful tool and can easlily trash a system if someone else carries out the instructions. What I'm saying is that you can learn a lot by reading other analysts' fixes to problems but NEVER copy what they do with Avenger. At least not until you have more experience with HJT first.

Combofix is a "point & shoot" tool. The user could d/l it, run it and it will fix many things without user intervention. It's very popular and easy to recommend to a user.

HOWEVER, at the moment, the author of Combofix has pulled the tool from use. He has development problems with it. It must NOT be used for the time being. There are doubts as to whether the tool will ever return.

Let us know what "training school" you choose.


OJThis took me a couple of days because I've been super busy with school. But I finished up the MAJORITY of my current project, so I have a bit more time now. I looked around at the different sites and I think I'm going to give Geeks To Go a try. It seemed like the most appealing forum to me. So, I've submitted an APPLICATION. And now, I guess I WAIT to see if I get accepted or not.

By the way, I've found another really helpful tutorial...

http://hometown.aol.co.uk/jrmc137/hjttutorial/tutorial.htmYes, Matt, that is also a useful HJT tutorial. All these tutorials will be based on Merijn's own master copy but perhaps some are easier to follow.

If in any HJT entry gives you doubt ... check with Merijn's one and research what other recognised analysts do with a given entry.

Best of luck with your G2G application. I have no doubt you will be accepted (although do let me know if there's a problem).

Happy bug hunting!


OJJust to let you know, I've been accepted and I'm currently working on my first practice log. I haven't received any feedback yet, but I'm confident that I did well. My girlfriend is totally making fun of me, but I'm determined to do well in this. I'm already working on some of my canned speeches. Heh. Oh, and thanks for your help via PM. I'm downloading the two anti-malware programs you suggested and I'll run them as soon as they're done. Yay for dial-up...

I'm going to have to get some sleep pretty soon because I have class in a few hours, so I might have to let you know how it goes later today.

Windows XP running Norton AV 2007.
A had an alert that said I hadn't run a full system scan in a while...so I ran it.
Next thing I get an error with code 3038,107 and a button to find out more info. I click it and the comp freezes.
Ctrl-Alt-Del doesnt work so i TUNED it off with the power button.
Then upon restarting, it would not get past the welcome screen.
I started in safe mode and went back a month. Now upon rebooting, I make it to where I can see my background before it freezes and craps out.

I ran a HJT log in safe mode (my user, not admin), but have no idea what it means...
Help?
HJT part1:


LOGFILE of HijackThis v1.99.0
Scan saved at 5:15:22 PM, on 6/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Keith Stegmaier\My Documents\download\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O6 "USB002" /M "Stylus C82"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [AllerCalc] "C:\Program Files\AllerCalc\AllerCalc.exe" /i
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - Startup: TDK Launcher.lnk = C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
HJT log part 2:

O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download Flash with Flash Capture - C:\Program Files\Flash Capture\dl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {3AE9ED90-4B59-47A0-873B-7B71554B3C3E} (JoystickCtl Class) - http://www.radicalplay.com/socca/joystick.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo UPLOADER) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O19 - User stylesheet: (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Compaq Advisor - NeoPlanet - C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Content Monitoring Tool - Unknown - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Ulead Burning Helper - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe



plz run hijackthis in normal mode so we can get all of the things that run.. safe mode limits the things that can run..

do you have any other protections?? if not take a look a my signature for some ideasi have spybot and adaware...from what ive read on the boards here i might switch to avg and dump norton once i get things worked out

I'd love to give you a HJT log from normal mode......... [edit...running spybot and adaware now...hopefully after reboot I can at least get to normal mode]you can get into normal mode?? ok dl superantispyware and avg antispyware update them in safe mode with networking if need be then run Ccleaner and then scan with your protection programsStegs ...... What is the current state of your machine ........?
Was the highjackthis log generated before or after you used system restore ?
What have you done since....... ?

Have you tried to undo the system restore ?
It also seems you are using an outdated hijackthis ......perhaps getting the current version would be a good idea.
The log you produced was done in safe mode ...and it does show that at least one trojan is in your machine.
If .....reversing the system restore, will let you boot up in normal, let us know and we can go on from there .


dl65 got the new HJT and updated adaware and s&D
ran in both safe and normal...
i havent gotten any other antispyware yet, as it took a few hours just to do this...
here is the updated normal HJT log

Logfile of HijackThis v1.99.1
Scan saved at 10:08:10 PM, on 6/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\AllerCalc\AllerCalc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Keith Stegmaier\My Documents\download\Hijack This\Hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [AllerCalc] "C:\Program Files\AllerCalc\AllerCalc.exe" /i
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - Startup: TDK Launcher.lnk = C:\Program Files\TDK\TDKLauncher\TDKLauncher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

continued

O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download Flash with Flash Capture - C:\Program Files\Flash Capture\dl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {3AE9ED90-4B59-47A0-873B-7B71554B3C3E} (JoystickCtl Class) - http://www.radicalplay.com/socca/joystick.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.miniclip.com/ricochet/ReflexiveWebGameLoader.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O19 - User stylesheet: (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Stegs ....... How is the machine working now ? You must be up and running in normal mode now....... Were you able to run a complete anti-virus scan ?
You should update your Java ...... it's out of date.
There are several minor things that show up in the logfile, but we will only remove them if you are still having issues.

Please let us know how it is running now.


dl65


dl65...Thanks for your help and patience...

It CAN run in normal mode.
The problem is still that it takes ages to do things.
Startup took at BEST 40 minutes. Simply right clicking on a shortcut takes 3-5 minutes just for the command options to pop up (open, cut, copy)
Now my Norton tells me I need to activate it. (how did it un-activate itself?)
I didn't do an anti-virus yet (just MULTIPLE different kinds of anti-spyware) simply because it took hours just to do all the antispyware tests and hjt.
I will try downloading AVG and running tonight.
I will also try to update Java.

i got the Win32/Rustock.gen!C according to windows after sending a error report. it KEEPS restarting my computer, and wont let me update. i had it for a while probably because i was not able to update for a while. recently i cant even stay on normal mode for more than a minute , it just turns off. im on safe mode right now. how do i remove it, nothing works. pleas help.DLoad; INSTALL; update and run AVG Anti-Spyware and Stinger in safe mode with SYSTEM restore turned off.

Then post back with your results...

You didn't list what protection programs you have...this info would be helpful as well.still doesnt work. everytime i try to install updates my computer turns off.. =(Scan with HijackThis and post a log for us to look at. If you can manage to, please try to do the scan in Normal Mode. It's not as effective in Safe Mode, but if that's all you can manage, we'll do our best to work with it.

Also, download ComboFix and save it to your desktop. Run the program and read its disclaimer (it's fairly short) and make sure you really pay attention to what it says. Follow the PROMPTS and when finished, it will produce a log at C:\ComboFix.txt. Go ahead and post that here. Note: Don't click on the window while it's running; this may cause stalls.Quote from: swift328 on June 14, 2007, 05:10:43 PM

still doesnt work. everytime i try to install updates my computer turns off.. =(

I am not experiencing any problems at the moment so no rush,
is there anything that shoudnt be their Logfile of HijackThis v1.99.1
Scan saved at 07:34:48, on 22/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Trust\MI-4550XP WIRELESS OPTICAL MINI MOUSE\Mouse32a.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\Program Files\Power Mixer\pwmixer.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\Program Files\ZyXEL\ZyXEL G-202 Wireless Adapter Utility\ZyXEL G-202.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-4550XP WIRELESS OPTICAL MINI MOUSE\Mouse32a.exe
O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Power Mixer] "C:\Program Files\Power Mixer\pwmixer.exe" /m
O4 - GLOBAL Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: ZyXEL G-202 Wireless Adapter Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\NETWORK Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe

Looks clean to me.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

You don't need those, so go ahead and fix them.

That aside, I don't see anything you need to worry about. You have anti-virus and anti-spyware, a firewall, and Windows and Java are current. It all looks GOOD.

However, I would suggest moving HijackThis to C:\Program Files\HJT. It's a much better spot where it can work better.Thanks for that (i said no rush )
SkyblueHeh,you're welcome. Don't worry, there's not much activity tonight.Quote

there's not much activity tonight.

At the beginning it just not responded when I would go to the propertys of a harddrive.
Next thing I knew I could even go to the file tap.
I've tryed CHKSDK/F , SFC /SCANNOW ,System restore
System restore would only fix my problem for 5 min after that I just had the same thing I did this 3 times and the last time it would even repear the problem.
As my protection I have Windows Live OneCare.
I Dloaded and installed the 3 AVG's 2 days ago after I removed them I started to have problems.
I will poste my logfile after this post.
Please help me I'm desperate I've TRIED everything I know

Thanks in advance

Jonas Logfile of HijackThis v1.99.1
Scan saved at 19:13:59, on 16/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\twatdog.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Explorer.EXE
E:\Mijn programma's\Hijack\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [RegServer] regserve.exe
O4 - HKLM\..\Run: [TridentWatchDog] twatdog.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O8 - Extra context MENU item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Converteren naar bestaand PDF-bestand - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000Last time I've got an error message (see attach)
When I run Ccleaner at the Issue part I always have an empty entry {-
What is this??
How can I stop it from doing this?
I think it is a VIRUS but it is moving fast.
I 'll scan with Windows OneCare but as I don't think it is going to find it because otherwise it would when I was infected at first (like it usualy do)
Should I Dload the AVG products?

Jonas

[cleaning up - attachment deleted by admin]I've fixed these entries :
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
By google them I've found that they are no suppos to be there
What else can I do because the problem is still going on
I scaned my PC with AVG AV, AVG AS, Superantispyware, Windows Live OneCare
And not one of them found something
then I runed AVG Anti rootkid but I found nothing.
What NOw???
Nothing seems to work

Jonas
How is the drive being reported in Disk Management ? ?

My Computer/right clik and select Manage...then choose Disk Management.Here it is I don't see anything special just that my C: drive is getting full.

Jonas

[cleaning up - attachment deleted by admin]I don't understand how that drive is even running...it's full.

Your C: drive is FAT32
D: is NTFS
E: is also FAT32
F: NTFS.

Is there a reason it is setup this way ? ?

Also D: is practically empty...you can move a bunch of stuff there from C: as long as there not Program files...think in terms of strivctly data files : music, photos, movies etc.Oh but the problem is C: is only used a a program and windows drive sow there's nothing to move.
ecutaully C, D and E: are the same drives but in the begining the person who Installed the whole PC (din't knew anything about PC's at that time) has splited the drive.
is it possible to make C and D one Dirve?
D is NTFS because it read somewhere that that is the most secure drive but I'll change that back becaus now I realise how stupit it is.
and F: has to be NTFS because WLOC (Windows Live OneCare) will only backup at NTFS drives.
I'll try to find something I can set from C to E but I don't think there is goning to be something.

Jonas Jonas...
The "cannot find IDLIST" appears to usually be related to Intel Wireless drivers. Have a look here.



You didn't post a full log. From what I can see right now, it looks clean, but it's important to post the whole thing because there could be an infection there.



You have the MegaUpload toolbar on your computer. Are you sure this is something you want? You might want to take a look a this excerpt from the toolbar's EULA...
"This toolbar integrates certain services from Alexa Internet, Inc. ("Alexa"). The toolbar may exchange data with Alexa in order to provide: (a) information to you about the web pages you view (ranking information, for example) and (b) basic information to Alexa on your use of the toolbar, including the IP address of your computer, the URL of the web pages you visit and, because the toolbar communicates via HTTP, data typical of normal HTTP communications such as user agent and operating system, will be communicated."

We often consider Alexa to be spyware, so you might want to think about that.



As for CCleaner...I'm not familiar with such an entry. If you right-click on it and open the entry in Regedit, where does it take you? What's the path of that registry entry?Now I have 2Gig free space on C; drive and still have the problem.
Here is a screenshot of the regesrty entry.
I've fixed these entries :
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
Didn't do anything wrong with that I hope.
I removed the Megaupload toolbar do not need him anymore (Was needed for school)
I 'll post a new ogfile in the next 2 post

Jonas

[cleaning up - attachment deleted by admin]Logfile of HijackThis v1.99.1
Scan saved at 19:54:27, on 17/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\twatdog.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Computer\Hijack\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [RegServer] regserve.exe
O4 - HKLM\..\Run: [TridentWatchDog] twatdog.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Converteren naar bestaand PDF-bestand - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Geselecteerde koppelingen converteren naar bestaand PDF-bestand - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Koppelingdoel converteren naar Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Koppelingdoel converteren naar bestaand PDF-bestand - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Selectie converteren naar bestaand PDF-bestand - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://tremo4ever.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168273091096
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: Tmesrv3 (Tmesrv) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe" /Service (file missing)
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exeAlright, your log looks clean. For future reference, please refrain from fixing entries on your own. It's easy to disable something important without knowing it.

Did you check out that link I posted?

And this registry entry...when you fix it with CCleaner, it just comes back? What if you manually delete the entry yourself?allright I 'll not do it again.
I was just desperet as my computer was having a strange behavior.
I checked you link I think the problem with me was that my firewall (including ports was restted when I used System restore.)
The regesty just comes back if I restart my computer.
when it shutsdown I ALLWAYS get an error sound like you normally should get an error message but its allways at the time that my pc just goes to the Blue screen and says Windows is shutting down.
I still can't go to the propertys of all my hardrives.
And I don't know how to remove the regestry as I don't know the full path.
Maybe I wouldn't even be able if I knew I only know how to get to the register that's all.
By the way thanks for your help

Jonas Quote

but in the begining the person who Installed the whole PC (din't knew anything about PC's at that time) has splited the drive.

allright I 'll not do it again.
I was just desperet as my computer was having a strange behavior.

I checked you link I think the problem with me was that my firewall (including ports was restted when I used System restore.)

And I don't know how to remove the regestry as I don't know the full path.
Maybe I wouldn't even be able if I knew I only know how to get to the register that's all.
By the way thanks for your help

Quote from: Jonas Wauters on June 17, 2007, 12:54:45 PM

I checked you link I think the problem with me was that my firewall (including ports was restted when I used System restore.)

If you disconnect from the internet and disable your firewall, do you still get any errors?

Quote from: Jonas Wauters on June 17, 2007, 12:54:45 PM

And I don't know how to remove the regestry as I don't know the full path.
Maybe I wouldn't even be able if I knew I only know how to get to the register that's all.
By the way thanks for your help

First, backup your registry with a program like ERUNT... In CCleaner, if you right-click on the entry, you'll be given the option to open it in Regedit. After doing so, you can delete the appropriate entry. However, I suspect this will have the same results as fixing it with CCleaner.

Hello all!

I have seriously sensitive information on my computer and all I have
is AVG FREE. It has caught and stopped 3 spy attacks.

I need to be CERTAIN that I have the best there is!

I don't care if you give me a link you're selling through. I trust that
you geeks here would only sell me something you approve of!

So, give me some names and where to go!

Thanks, Pennie77 You need a spyware or you need an anti-spyware?

Fact: There is no best anti-malware or anti-spyware program out there. And you should accept that. Hehe.


Malwarebytes and SUPERAntiSpyware are not the best, but I'm using both of it.


Personally I use Microsoft Security Essentials. Asking what is the "best" is only going to START arguments. If AVG Free has stopped 3 "spy attacks" perhaps you need to review your browsing and downloading habits?
Quote from: Salmon Trout on AUGUST 04, 2011, 01:46:01 AM

Personally I use Microsoft Security Essentials. Asking what is the "best" is only going to start arguments. If AVG Free has stopped 3 "spy attacks" perhaps you need to review your browsing and downloading habits?

I'm thinking of putting Microsoft Security Essentials on a old laptop I have is it easy to setup/update etc

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the LATEST version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Hi Pennie. You should have a layered approach to malware, spyware, etc. While you should only run one AV program and one Firewall program, you can run more than one malware programs. I would suggest that you turn on Windows Defender. You can also install ThreatFire and also look at some of the suggestions I've posted below.
You can also install Malwarebytes Anti-Malware (link and instructions below) and SuperAntiSpyware ( linked below with instructions.) These are not full-time scanners unless you pay for them but you can run them anytime you feel like doing so to keep your computer clean.

You can download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*************************************************************************
SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
****************************************************
SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping [b]Yourself Safe On The Web [/b] [/URL] for tips and free tools to help keep you safe in the future.

My laptop has a bot and I suspect my iTouch and Dsi to have one to. My laptop won't even GO on the interent anymore. All of these DEVICES had recieved warnings to from comcast SAYING malicious software detected. I have very little knowledge of these things and am going insane. So patience would be suggested....
It's scary when a Dsi is infected because it's the least suspected to me. Desperate help.
Well, for the laptop, you could start at download.com to get your anti-spy free protection. Pc Tools is pretty reliable, so is AVG...
Download DDS from HERE or HERE and save it to your desktop.

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.
* If your antivirus or firewall try to block DDS then please allow it to run.
* When finished DDS will open TWO (2) logs.
* Save both reports to your desktop.
* The instructions here ask you to attach the Attach.txt.



1) DDS.txt
2) Attach.txt
Instead of attaching, please copy/past both logs into your Thread

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.

•Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.
After DOWNLOADING the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control HERE .Then post your DDS logs. (DDS.txt and Attach.txt )

Quote

The Imesh search bar has also finally gone (yay) so not sure if that means all is ok now??

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press ENTER, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

Ahhhh much better

Thank you so much for all of your help Dave I really appreciate it!!

Here is the Jotti again -

http://virusscan.jotti.org/en/scanresult/a7205d5b72308fe0ae22111f97151bdb0cb1ff19/567
0fa35050531c4676fc366f9c23531bf198a43Here is the 'avenger' log.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.


here is what I see on the Jotti scan.




Jotti's MALWARE scan
This file has been scanned before. The results for this previous scan are listed below.





--------------------------------------------------------------------------------

Filename: is-INFQS.exe
Status: Scan finished. 0 out of 20 scanners reported malware.
Scan taken on: Wed 13 Apr 2011 12:40:22 (CET) Permalink



--------------------------------------------------------------------------------
Additional info
File size: 709456 bytes
Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5: c88c64609de58fa3d8637c4866c7c6bb
SHA1: b1484070813fe2910385ab92167199d5784ea3e f



I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

Since I did remove anything etc. is there a reason the computer was sending out the emails that you may know of?
Thank you again so much for your help.

A little more from the CIA computor security retiree.

"
Hi _______,
I just returned from Office Depot looking at their all-in-one printers. The Brother 5895CW you were interested in from Costco illustrated in
their latest flyer is "Made in China". The problem with that is the special agreement that the Intel services in China have with local computer/printer
manufacturers. They get Government money/assistance/sponsorship for allowing their Intel service to insert packages into outgoing ELECTRONICS.
(per Wiki-leaks DOS cable traffic). The below news release confirms that relationship. It would be nice if US company's would accept accountability
for this problem, or hold China accountable. That hasn't happened yet.

Alternately, Office Depot has All-in one printers from Epson that are made in Indonesia. There is a MUCH better relationship between the US and Indonesia
for producing products at this time. The equivalent all-in-one appeared to be the Epson Workforce 520 for approximately $129.00.

I helped my buddy in Tucson install his Epson all-in one printer and he just confirmed to me that he is happy with it's capability,
and he apparently has no adverse side effects from the installation. (unlike some HP all-in-ones that produce unpredictable on line behavior)

Cheers,

xxxxxxxxxxxxxxx



U.S.official says pre-infected computer tech entering country
By M. Alex Johnson, msnbc.com reporter

Confirming years of warnings from government and private security experts, a top Homeland Security official has acknowledged that computer hardware and software is already being imported to the United States preloaded with spy ware and security-sabotaging components.
The remarks by Greg Schaffer, the Department of Homeland Security's acting deputy undersecretary for national protection and programs, came Thursday during a tense EXCHANGE at a hearing of the House Oversight and Government Reform Committee. The PANEL is CONSIDERING an Obama administration proposal to tighten monitoring and controls on computer equipment imported for critical government and communications infrastructure.
Schafferdidn't say whether the equipment he was talking about included end-user consumer tech like retail laptops, DVDs and media players. If so, his comments,first reported Friday morning by Fast Company, would be the first time the United States has publicly confirmed that foreign consumer technology is arriving in the country already loaded with nasty bugs like key-logging software, botnetcomponents and even software designed to defeat security programs installed on the same machine.
"""Charlie361,
Without references, your post has zero value.

I just bought a hammer made in china.
Do you think it will attack me?
LOL please provide sources or references

Or simply boycott all china products LOL

I mean, come on man. Can this "contact" of yours not provide anything but some dilettante rambling?The phrase "made in china" will soon become an awesome cliche.

I know not Linux and did do a hijackit and saw nothing to be worried about in the search.

I fear the bug MAY have come not from the factory, but MAYBE when I VISITED a mainland China site once.

Just do not now REMEMBER having the problem from the getgo when I bought the printer.

If only there was someway I could get rid of the xerox showing up in the add hardware option in "PRINTERS and Scanners" I might be free of the problem. It will not be moved..

After scanning with Malwarebytes Anti- malware a message will pop up saying : Windows cannot access the specified device , path , or FILE . You may not have the appropriate permissions to access item . : ......................................

Then if i try to view the log it will say the same thing .... That was the only problem i had . Until i tried to do something i found in your forum that seemed to be the same problem ..... But it said i had to disable my anti virus (AVG)2011 free edition to use Combo fix . Well i tried to uninstall it and use the remover and NOTHING seemed to change .. except it wouldn't let me enable AVG again or install anything from AVG .... it now has a error message ............... I have been at this for about 2 days and i don't know what else to do .

Thank you to all that respond .


[recovering disk space - old attachment deleted by admin]SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/18/2011 at 04:44 PM

Application Version : 4.55.1000

Core Rules Database Version : 7419
Trace Rules Database Version: 5231

Scan type : Complete Scan
Total Scan Time : 01:40:47

Memory items scanned : 594
Memory threats detected : 0
Registry items scanned : 7855
Registry threats detected : 0
File items scanned : 156874
File threats detected : 60

Adware.Tracking Cookie
.doubleclick.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.adserver.adtechus.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.kontera.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.anrtx.tacoda.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.xiti.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.at.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.at.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.tacoda.at.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.ar.atwola.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.legolas-media.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
segment-pixel.invitemedia.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.invitemedia.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.statcounter.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.media6degrees.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.collective-media.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.mediaplex.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.apmebf.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.revsci.net [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
dc.tremormedia.com [ C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
secure-us.imrworldwide.com [ C:\Users\Administrator\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\2DJPKFNP ]
.at.atwola.com [ C:\Users\andrewwspike\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\andrewwspike\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\andrewwspike\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\andrewwspike\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\andrewwspike\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.advertising.com [ C:\Users\andrewwspike\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.doubleclick.net [ C:\Users\andrewwspike\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:29:22 PM, on 7/18/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Users\ANDREW~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel Matrix STORAGE Manager\IAAnotif.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\vsnp2std.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\sniper.exe\sniper.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsearcher.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
O1 - Hosts: ::1 localhost
O2 - BHO: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\ADOBE\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: BHO Project - {cbc5b60a-aa4d-45f6-84c2-d086f320299a} - C:\Program Files\Object\bho_project.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [snp2std] C:\Windows\vsnp2std.exe
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [SIDEBAR] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\ANDREW~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\UVXD44UR\TRYWOW~1.SH! (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\Users\ANDREW~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\Content.IE5\UVXD44UR\TRYWOW~1.SH! (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97A8E8FE-42F1-4B7D-B22B-63782E7C2BE0}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O18 - Protocol: vsharechrome - {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - C:\Program Files\vShare\vshare_toolbar.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Update Service (gupdate1ca93bd2bfc4dd1) (gupdate1ca93bd2bfc4dd1) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

--
End of file - 8094 bytesok found the problem .... no virus .... just note pad wasn't set to always use this file type . .... now to reinstall AVG

how can i update my nod32 @ where can i get updated files? thank yoy all.If you have an Internet connection on your computer with Nod32, just open the Nod32 then CLICK on "Update now". See SAMPLE screen-shot.

[recovering disk space - OLD ATTACHMENT deleted by admin]

I ran that scan, and it crashed again:

Problem signature:
Problem Event Name:BlueScreen
OS VERSION:6.1.7601.2.1.0.768.3
Locale ID:2057

Additional information about the problem:
BCCode:c5
BCP1:01220B00
BCP2:00000002
BCP3:00000000
BCP4:82D2571A
OS Version:6_1_7601
Service Pack:1_0
Product:768_1

Files that help describe the problem:
C:\Windows\Minidump\070111-16203-01.dmp
C:\Users\Stuart\AppData\Local\Temp\WER-35406-0.sysdata.xml

Read our PRIVACY statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt
Ok. Let's try something else.I'm not sure if it will work. It's an older program

Download MBRCheck to your desktop.

• Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
  
• It will show a black screen with some data on it.
• A report called MBRcheckxxxx.txt will be on your desktop
  
• Open this report and post its content in your next reply.

I could be using Skype, clicking on a Bookmark in Firefox, or MediaMonkey could be playing a song while I'm in the kitchen and the needle starting skipping, as it were.

Here's the log

[recovering disk space - old attachment deleted by admin]I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET SMART Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

Well Dave, everything seems to be good on my user. The "New Itouch" user is still corrupt. I can't open iTunes. Any ideas?

Quote from: SuperDave on June 28, 2011, 04:42:42 PM

Are you trying to repair two computers at once?
If everything is ok with the computer we're working on, I'd like to do some cleanup. After that we'll have to take a look at the second computer.

If everything is ok with the computer we're working on, I'd like to do some cleanup. After that we'll have to take a look at the second computer.