Explore topic-wise InterviewSolutions in .

HI evil, the cleanup!.exe free up an addition of 32mb.

Here is the lastest hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:07:08 PM, on 3/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com.sg/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed LAUNCH.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! ANTIVIRUS - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6459 bytesThe log is clean.

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt2

This is a good TIME to clear your infected system restore points and establish a new clean restore point:

• Go to Start > All Programs > Accessories > System Tools > System Restore
  
• Select Create a restore point, and click Next.
  
• Next, go to Start > Run and type in cleanmgr
  
• Select the More options tab
  
• Next to System Restore click Clean up...

I've heard of a new virus out called ronamonadona virus. Anyone heard of it or how prevalent it is?I searched for it, and found this:

http://www.dslreports.com/forum/r20082590-MonaRonaDona-virus

Quote

It is clearly extortion-ware, offering on the user's screen: "Welcome to MonaRonaDona; hi, my name is Mona RonaDona. i am a virus& i am here to Wreck Your PC."

• R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MonaRonaDona
  
• O4 - HKLM\..\Run: [.NET.] \FUD.exe
  
• O4 - Global Startup: SRVSPOOL.exe
  
• O4 - HKCU\..\Run: [RegistryCleanFixMFC] C:\Program Files\RegistryCleanFix2008\RegistryCleaner2008.exe

• Save it to your desktop.
  
• Double-CLICK OTMoveIt2.exe to run it. (Note: If you are running on Vista, RIGHT-click on the file and choose Run As Administrator).
  
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  Code: [Select]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr
  HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Window Title
  HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Window Title
  HKEY_CURRENT_USER\Software\Microsoft\Outlook Express\\Window Title
  C:\Program Files\RegistryCleanFix2008
  C:\Program Files\UniGray Antivirus
  C:\Documents and Settings\All Users\SRVSPOOL.EXE /S /D
  C:\Users\SRVSPOOL.EXE /S /D

• Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window.
  IMPORTANT -- Paste only into the bottom input panel (under the Yellow bar), The top panel will not help you.
  Right-click and choose Paste.
  
• Click the red Moveit! button.

• Double-click FixPolicies.exe
  
• Click the Install button on the bottom toolbar of the box that will open.
  
• The program will create a new Folder called FixPolicies
  
• Double-click to Open the new Folder, and then double-click the file named Fix_Policies.cmd
  
• A black box will briefly appear and then close. This will enable your Control Panel, Task Manager and stop any ADMINISTRATIVE warnings.

Could have named it Roseanne Roseannadana virus.

Hello all, new here.

I would say that I know QUITE a bit about computers, considering I am studying them but I am having a computer problem that I've only seen once before that for some reason I can't shake it.

I now for some reason have my windows folder in the recycling BIN, with hidden files shown there is nothing inside the recycling bin, the icon shows as stuff in it.

ESET Nod 32 can't find any problems, nor spybot. Any ideas?

Edit: Please move this to the virus section. My fault.Welcome to the CH forum Trent.
Start here and post the info required.
If you SUSPECT an infection you can then go through the STEPS here.

ok can someone please analyze this and tell me what i should be doing? I already submitted another forum about my computer not letting me dl anything and having corrupted files. Someone had refered me to getting hijackthis. I have no idea how to read this and what i should be doing with this program so here is what it gave me when i scaned my computer.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:30:26 AM, on 2/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=searchfavweb&c=2c02&lc=0409
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/yessentials_cq/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
O4 - HKLM\..\RUN: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Belkin Wireless Utility.lnk = C:\Program Files\Belkin\PCI F5D7000\Wireless Utility\Belkinwcui.exe
O8 - Extra context MENU item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1165092187044
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: B's Recorder GOLD LIBRARY General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

--
End of file - 6920 bytesthanks!When did the problem start?
Did you download anything new around the time it started happening?

I don't see anything in the log as far as viruses but there are some questionable entries. Please go to this post and work through as many of the steps as possible then post the logs back here.This problem started about a month ago. I downloaded aim the newest version and it started to act funny by always kicking me off and then restarting. It would do that every 5 minutes and it got really annoying so I uninstalled it by going to add/remove programs. After that I tried to dl spybot, but the download would not go past 4%. Since then any dl I try to get wont dl past 4%.

I currently have CA antivirus and spyware. It wont let me update the antivirus either it says there was an error. Also I am getting messages saying that WDengine.dll failed and some display driver failed i think its called iamnlt or something like that.

We have two computers in the house and this one Im having trouble with is running off of belkin wireless card. I got the chance to look at the main computer yesterday and i went into the users accounts. There was a user that I never set up but am not sure about. The user name was Aspnet. I didnt know if I should be concerned about that so I left it.

I went through the steps you gave me but I couldnt download superantispyware or AVG. I ran my antivirus and spyware that I already have and quaratined everything. I did that yesterday before I posted the log. I went to ADD/Remove programs but I didnt find anything weird. Sorry if this doesnt help much. WDengine.dll is part of WildTagnet and needs to be uninstalled in add/remove programs. After uninstalling it then go back to the removal steps and try again. Try to get CCleaner to run. You should at least be able to get the online scan to run and post that log.I couldnt get the online scanner to work. Here is the log from ccleaner i had to put in three parts it was to big.


[file cleanup - saving space - attachment deleted by admin]2nd one

[file cleanup - saving space - attachment deleted by admin]last one

[file cleanup - saving space - attachment deleted by admin]Try booting into safe mode and running the installer for Superantispyware. If it installs then also run the scan in safe mode.I tried to in safe mode it wont let me either sorry!Try this.

Download Deckard's System Scanner (DSS) to your Desktop.
Note: You must be logged onto an account with administrator privileges.

• Close all applications and windows.
  
• Double-click on dss.exe to run it, and follow the prompts.
  
• When the scan is complete, two text files will open
• main.txt <- this one will be maximized
  
• extra.txt <- this one will be minimized

• Add the contents of main.txt in your post.
  
• Also add extra.txt to your post.

• The text from these files may exceed the maximum post length for this forum, and may need to be sent over 2 or more posts. Please ensure all text is posted.

• Create a new System Restore point in Windows XP and Vista.
• Clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
• Check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

Were getting there....

Download & run this tool SafeBootKeyRepair-CF

It will only take a short moment for it to finish running.
A log will be produced at C:\SafeBoot_Repair.txt. PLEASE post that in your next reply.

----------

Go to Start > Run and type NOTEPAD.exe then click OK

Copy and paste the below into Notepad and save as fixme.REG to Your Desktop

Code: [Select]REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

Locate fixme.reg on your Desktop and double-click it. Answer

• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• UPDATE anything listed.

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• Click the Report button and copy/paste the contents of it into your next reply
  

• Save it to your desktop.
• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
  
• Double click the setup file to run it.
• Click Next to continue.
• Accept the License agreement and click on next.
• It will, by default, install it to your desktop folder. Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make SURE these are checked.
• Hidden Startup Objects
  
• System Memory
  
• Disk Boot Sectors.
  
• My Computer.
  
• Also any other drives (Removable that you may have)
  

It did say there were no threats. Is it important for you to see the log...?

Also please note that in the bottom right hand corner of the screen I get a "test mode" Rebuild 7601. Would this account for any instability...?

HI everyone!

Today I read about BOT nets, and got an idea:
(Purely THEORETICAL:)
Would it be possible to use an infected computer to take control over, and destroy the entire network?

Would it also be possible to trace the origin of the bot NET?

Thx!
//RG0D SIGH

Hey guys. I'm new here and I thought I/d let you know that I have Norton Anti-Virus Security and it has to be one of the best out there! It's very easy to USE and it works very well at apprehending viruses. Aside from the COST, I think everyone who is currently dealing with viruses should use the free trial to their needs.
I think you are the only person on this forum who would actually recommend Norton. There are better Anti-Viruses out there. NAV is an excellent product. It's among the best anti virus utilities AVAILABLE. Quote from: NoahF on December 05, 2011, 03:44:46 AM

Aside from the cost, I think everyone who is currently dealing with viruses should use the free trial to their needs.

I think you are the only person on this forum who would actually recommend Norton. There are better Anti-Viruses out there.

NAV is an excellent product. It's among the best anti virus utilities available.

Maximum PC magazine just did a rating on av programs. They rated Norton as best of the paid programs with a 9+ rating and all of the free programs rated from 6 to 8. Based on that you usually, but not always, get what you pay for since McAfee was rated a 5.

Since Comcast is my ISP I get Norton for "free" and it's worked fairly well for me.

And I know if you get 10 people to rate anything you will get 10 different opinions.

So, I kept getting threats from 'Trojan.fakealert' and I ssent them to the virus vault. I CLEARED the virus vault and today while scanning, it said in the scan RESULTS I have an infection called: Trojan Horse Generic26.xku
It is in the virus vault. Since it is in there- will it still harm my computer?
And can I safely clear the virus vault?Quote from: terenkleon on December 15, 2011, 04:33:25 AM

So, I kept getting threats from 'Trojan.fakealert' and I ssent them to the virus vault. I cleared the virus vault and today while scanning, it said in the scan results I have an infection called: Trojan Horse Generic26.xku
It is in the virus vault. Since it is in there- will it still harm my computer?
And can I safely clear the virus vault?

Quote

I didn't try it YET. I wait for your answer...

• Save it to your desktop.
• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
  
• Double click the setup file to run it.
• Click Next to continue.
• Accept the License agreement and click on next.
• It will, by default, install it to your desktop folder. Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.
• Hidden Startup Objects
  
• System Memory
  
• Disk Boot Sectors.
  
• My Computer.
  
• Also any other drives (Removable that you may have)
  

They didn't want to wait anymore... they took it to a repair shop...

Go to this link to create a Rescue CD or to this site to create a Rescue USB. Carefully follow all the instructions for whichever method you choose.The rescue cds didn't work. But I will tell you this I was finally able to boot from my Windows cd and do a fresh INSTALL thank you guys for everything.You're welcome. It's too bad it had to come to that but some infections damage the FILES so badly that there's no other option. I will lock this thread. If you need it re-opened, PLEASE send me a PM.

Quote

can i just leave the programs you suggested to download?

relevant knowledge is really bad for the computer?

I'm assuming we are done. tyvm

except for facebook games yes tysoo very much, i have done as you said

I've just installed the LATEST FOXIT Reader - this download included "McAfee Security Scan Plus", which I suppose is a virus checking program. I am a bit wary of this - I already have Avira Anti Virus, and Malwarebyte, and Super Antispyware - I don't want to have a conflicting AV program. Is the McAfee app. any good or would it be best to uninstall? Advice appreciated. Uninstall it.McAfee Security Scan Plus actively CHECKS your computer for anti-virus software, firewall protection, and web security, and threats in your OPEN applications.

Thanks for replies - I'll uninstall.

Logs From OTL


========== OTL ==========
========== FILES ==========
File\Folder C:\found.009 not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - VERSION 3.2.28.0 log created on 09152011_172403


Combofix was detected as a malware.1) I got a bosd while running scans using malware anti malbytes

==================================================
Dump File : 091511-45645-01.dmp
Crash Time : 9/15/2011 6:44:21 PM
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x00000050
Parameter 1 : fffff8a0`067b0000
Parameter 2 : 00000000`00000000
Parameter 3 : fffff880`0165fa38
Parameter 4 : 00000000`00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+7cc40
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.17640 (win7sp1_gdr.110622-1506)
Processor : x64
Crash Address : ntoskrnl.exe+7cc40
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\091511-45645-01.dmp
Processors Count : 3
Major Version : 15
Minor Version : 7601
Dump File Size : 274,576
==================================================


2) The Attachment of the DDS test is here




[regaining space - attachment deleted by admin]I strongly recommend that you remove Ask from your computer because it;

•Promotes its toolbars on sites targeted to kids.

•Promotes its toolbars through ads that appear to be part of other companies' sites.

•Promotes its toolbars through other companies' spyware.

•Installs without any disclosure whatsoever and without any consent whatsoever.

•Solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.

•Makes confusing changes to users' browsers -- increasing Ask's revenues while TAKING users to pages they didn't intend to visit.

See Here for more info.

If you choose to follow my recommendation then please go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

•AskBarDis or anything related to Ask

Then please find and delete this folder in bold (if present):
C:\Program Files\AskBarDis. or anything related to Ask.
*****************************************************
I see you are running Poker Stars. Poker Stars has a history of distributing spyware in their products. However, security experts still question this program as good or bad. I recommend to remove it to prevent spyware, but it is up to you to decide if you want to keep it.

If you would like to uninstall it, do so as follows:

Press Start, and navigate to the Control Panel. When in the control panel enter Add or Remove programs. Search for and locate PokerStars, and either click Change/Remove or Remove.
******************************************************
Update Your Java (JRE)

Old versions of Java have vulnerabilities that malware can use to INFECT your system.

First Verify your Java Version

If there are any other version(s) installed then update now.

Get the new version (if needed)

If your version is out of date install the newest version of the Sun Java Runtime Environment.

Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Be sure to close ALL OPEN web browsers before starting the installation.

Remove any old versions

1. Download JavaRa and unzip the file to your Desktop.
2. Open JavaRA.exe and choose Remove Older Versions
3. Once complete exit JavaRA.

Additional Note: The Java QUICK Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
*****************************************************
P2P - I see you have P2P software installed on your machine. (µTorrent, Ares 2.1.5, FrostWire 4.21.6 and FrostWire 5.0. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
***************************************************
Quote

Combofix was detected as a malware.

I got a bosd while running scans using malware anti malbytes

I have to sort through some old files and DISKS for WORK... But they were downloaded from a sketchy source.

If I set a System Restore POINT before I download, copy, or OPEN the suspect files... If I go back to the restore point once I'm done, will I have mitigated any damage?If you create an image or your "clean disc" with Disc Imaging software you will have no problem. System Restore only copies/restores certain files & foldersThat's what I was afraid of.

Thanks.

rjbYou should be using disc imaging software on a regular basis anyway. It is without question the best and most reliable means of system BACKUP and restore.You can run some scans on the disks before you do anything else.

ComboFix 11-03-13.02 - Connor 03/14/2011 17:28:33.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.4095.2447 [GMT -4:00]
Running from: c:\users\Connor\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
FW: PC Tools Firewall Plus *Disabled* {175D0B73-9F8F-2CA9-8BF1-62277A276DC9}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other DELETIONS )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Connor\AppData\Local\Temp\VPN_77D6\9218E5A4.dll
c:\windows\TEMP\VPN_57C7\9218E5A4.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-02-14 to 2011-03-14 )))))))))))))))))))))))))))))))
.
.
2011-03-14 21:44 . 2011-03-14 21:44--------d-----w-c:\windows\system32\config\systemprofile\AppData\Local\temp
2011-03-14 21:44 . 2011-03-14 21:44--------d-----w-c:\users\Default\AppData\Local\temp
2011-03-14 21:24 . 2011-03-14 21:25--------d-----w-C:\32788R22FWJFW
2011-03-14 03:03 . 2011-02-11 04:317947600----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4300CDD2-4DB3-47E4-88F4-D19C9343D8E6}\mpengine.dll
2011-03-10 21:20 . 2011-03-10 21:20--------d-----w-C:\_OTL
2011-03-08 20:20 . 2011-03-08 20:20--------d-----w-c:\program files (x86)\Common Files\Skype
2011-03-06 03:29 . 2011-03-06 03:29--------d-----w-C:\LazyNewbPack[0.31.19][V8.0]
2011-03-05 12:31 . 2008-10-15 11:22519000----a-w-c:\windows\system32\d3dx10_40.dll
2011-03-05 12:31 . 2008-10-15 11:22452440----a-w-c:\windows\SysWow64\d3dx10_40.dll
2011-03-05 12:31 . 2008-10-15 11:222605920----a-w-c:\windows\system32\D3DCompiler_40.dll
2011-03-05 12:31 . 2008-10-15 11:222036576----a-w-c:\windows\SysWow64\D3DCompiler_40.dll
2011-03-05 12:31 . 2008-10-15 11:225631312----a-w-c:\windows\system32\D3DX9_40.dll
2011-03-05 12:31 . 2008-10-15 11:224379984----a-w-c:\windows\SysWow64\D3DX9_40.dll
2011-03-05 12:30 . 2011-03-05 12:30--------d-----w-c:\users\Public\Games
2011-03-05 01:26 . 2011-03-05 01:37364201984----a-w-C:\WindSlayer-01_09_0000.exe
2011-03-05 00:23 . 2011-03-05 00:23--------d-----w-C:\gPotato
2011-03-05 00:11 . 2011-03-05 00:23472781133----a-w-C:\AIKAOnline_US_Setup_20101103.exe
2011-03-04 03:33 . 2011-03-04 03:35--------d-----w-c:\users\Connor\AppData\Roaming\BugTrap Console Test108
2011-02-28 23:57 . 2011-02-11 04:317947600----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-02-28 23:57 . 2011-02-28 23:56601424------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{92021A4C-7412-4852-B81E-546412346036}\gapaengine.dll
2011-02-28 23:46 . 2011-02-28 23:46--------d-----w-c:\program files (x86)\Microsoft Security CLIENT
2011-02-28 23:46 . 2011-02-28 23:47--------d-----w-c:\program files\Microsoft Security Client
2011-02-28 23:46 . 2010-04-09 11:06374664----a-w-c:\windows\system32\drivers\netio.sys
2011-02-27 23:37 . 2011-02-27 23:37388096----a-r-c:\users\Connor\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-02-27 23:37 . 2011-02-27 23:37--------d-----w-c:\program files (x86)\Trend Micro
2011-02-27 23:17 . 2011-02-27 23:17--------d-sh--w-c:\windows\SysWow64\%APPDATA%
2011-02-27 21:04 . 2011-02-27 21:04--------d-----w-c:\users\Connor\AppData\Roaming\SUPERAntiSpyware.com
2011-02-27 21:04 . 2011-02-27 21:04--------d-----w-c:\programdata\SUPERAntiSpyware.com
2011-02-27 21:04 . 2011-02-27 21:04--------d-----w-c:\programdata\!SASCORE
2011-02-27 21:04 . 2011-02-27 21:04--------d-----w-c:\program files\SUPERAntiSpyware
2011-02-27 20:46 . 2011-02-27 20:46--------d-----w-c:\program files\CCleaner
2011-02-27 20:38 . 2010-03-29 16:06233488----a-w-c:\windows\system32\drivers\PCTCore64.sys
2011-02-27 20:38 . 2010-11-17 15:20331368----a-w-c:\windows\system32\drivers\pctgntdi64.sys
2011-02-27 20:38 . 2010-11-17 15:20136168----a-w-c:\windows\system32\drivers\pctwfpfilter64.sys
2011-02-27 20:38 . 2011-02-27 23:17--------d-----w-c:\users\Connor\AppData\Roaming\PCToolsFirewallPlus
2011-02-27 20:37 . 2011-02-27 20:38--------d-----w-c:\program files (x86)\Common Files\PC Tools
2011-02-27 20:37 . 2010-11-24 14:18119688----a-w-c:\windows\system32\drivers\pctNdis-PacketFilter64.sys
2011-02-27 20:37 . 2010-07-08 14:4979000----a-w-c:\windows\system32\drivers\pctNdis64.sys
2011-02-27 20:37 . 2010-02-05 14:2642968----a-w-c:\windows\system32\drivers\pctNdis-DNS64.sys
2011-02-27 20:37 . 2010-11-25 15:42179464----a-w-c:\windows\system32\drivers\pctplfw64.sys
2011-02-27 20:37 . 2011-02-27 23:17--------d-----w-c:\program files (x86)\PC Tools Firewall Plus
2011-02-27 16:31 . 2011-02-27 21:01--------d-----w-c:\program files (x86)\Spybot - Search & Destroy
2011-02-27 16:31 . 2011-02-27 21:01--------d-----w-c:\programdata\Spybot - Search & Destroy
2011-02-27 15:52 . 2010-12-20 23:0938224----a-w-c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-02-27 07:49 . 2011-02-27 15:52--------d-----w-c:\program files (x86)\MALWAREBYTES ANTI-MALWARE
2011-02-24 13:49 . 2010-09-14 06:45367104----a-w-c:\windows\system32\wcncsvc.dll
2011-02-24 13:49 . 2010-09-14 06:07276992----a-w-c:\windows\SysWow64\wcncsvc.dll
2011-02-23 21:20 . 2011-02-23 21:20--------d-----w-c:\program files (x86)\Common Files\Java
2011-02-23 21:19 . 2011-02-03 02:40472808----a-w-c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-02-23 21:18 . 2011-02-23 21:18--------d-----w-c:\programdata\McAfee
2011-02-23 20:23 . 2011-02-23 20:23--------d-----w-c:\program files (x86)\LOLReplay
2011-02-23 16:55 . 2011-01-07 08:07662528----a-w-c:\windows\system32\XpsPrint.dll
2011-02-23 16:55 . 2011-01-07 08:07475648----a-w-c:\windows\system32\XpsGdiConverter.dll
2011-02-23 16:55 . 2011-01-07 07:31442880----a-w-c:\windows\SysWow64\XpsPrint.dll
2011-02-23 16:55 . 2011-01-07 07:31288256----a-w-c:\windows\SysWow64\XpsGdiConverter.dll
2011-02-21 20:44 . 2008-10-15 14:25461680----a-w-C:\Dbgview.exe
2011-02-20 21:17 . 2011-02-20 21:17--------d--h--w-c:\windows\system32\CanonMF Uninstaller Information
2011-02-20 21:17 . 2011-02-20 21:17--------d-----w-c:\program files\Canon
2011-02-20 21:16 . 2007-04-18 22:1366048----a-w-c:\windows\system32\CNAS0MMK.DLL
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-03 02:40 . 2011-01-13 14:44472808----a-w-c:\windows\SysWow64\deployJava1.dll
2011-01-30 03:17 . 2011-01-30 03:1729808----a-w-c:\windows\system32\drivers\Neo_0014.sys
2011-01-30 03:16 . 2011-01-30 03:1681920----a-w-c:\windows\SysWow64\vpncmd.exe
2011-01-26 06:53 . 2011-02-09 20:22982912----a-w-c:\windows\system32\drivers\dxgkrnl.sys
2011-01-26 06:53 . 2011-02-09 20:22265088----a-w-c:\windows\system32\drivers\dxgmms1.sys
2011-01-26 06:31 . 2011-02-09 20:22144384----a-w-c:\windows\system32\cdd.dll
2011-01-19 08:26 . 2011-01-19 08:2686016----a-w-c:\windows\SysWow64\frapsvid.dll
2011-01-19 08:26 . 2011-01-19 08:2684992----a-w-c:\windows\system32\frapsv64.dll
2011-01-07 08:06 . 2011-02-09 20:2246080----a-w-c:\windows\system32\atmlib.dll
2011-01-07 07:27 . 2011-02-09 20:2234304----a-w-c:\windows\SysWow64\atmlib.dll
2011-01-07 05:49 . 2011-02-09 20:22366080----a-w-c:\windows\system32\atmfd.dll
2011-01-07 05:33 . 2011-02-09 20:22294400----a-w-c:\windows\SysWow64\atmfd.dll
2011-01-05 06:20 . 2011-02-09 20:22612352----a-w-c:\windows\system32\vbscript.dll
2011-01-05 05:37 . 2011-02-09 20:22428032----a-w-c:\windows\SysWow64\vbscript.dll
2011-01-05 04:00 . 2011-02-09 20:223127808----a-w-c:\windows\system32\win32k.sys
2011-01-03 06:32 . 2010-01-08 14:1445056----a-w-c:\windows\system32\acovcnt.exe
2010-12-27 18:55 . 2008-11-25 16:12348160----a-w-c:\windows\SysWow64\msvcr71.dll
2010-12-27 18:55 . 2008-11-25 16:12499712----a-w-c:\windows\SysWow64\msvcp71.dll
2010-12-21 06:16 . 2011-02-09 20:2262976----a-w-c:\windows\system32\wscapi.dll
2010-12-21 06:16 . 2011-02-09 20:2297280----a-w-c:\windows\system32\wscsvc.dll
2010-12-21 06:16 . 2011-02-09 20:22214016----a-w-c:\windows\system32\winsrv.dll
2010-12-21 06:16 . 2011-02-09 20:221197056----a-w-c:\windows\system32\wininet.dll
2010-12-21 06:16 . 2011-02-09 20:22442880----a-w-c:\windows\system32\winhttp.dll
2010-12-21 06:16 . 2011-02-09 20:22258048----a-w-c:\windows\system32\WebClnt.dll
2010-12-21 06:15 . 2011-02-09 20:22264192----a-w-c:\windows\system32\upnp.dll
2010-12-21 06:15 . 2011-02-09 20:2215360----a-w-c:\windows\system32\slwga.dll
2010-12-21 06:13 . 2011-02-09 20:222003968----a-w-c:\windows\system32\msxml6.dll
2010-12-21 06:13 . 2011-02-09 20:221880576----a-w-c:\windows\system32\msxml3.dll
2010-12-21 06:10 . 2011-02-09 20:22100864----a-w-c:\windows\system32\davclnt.dll
2010-12-21 05:38 . 2011-02-09 20:2251200----a-w-c:\windows\SysWow64\wscapi.dll
2010-12-21 05:38 . 2011-02-09 20:22981504----a-w-c:\windows\SysWow64\wininet.dll
2010-12-21 05:38 . 2011-02-09 20:22350720----a-w-c:\windows\SysWow64\winhttp.dll
2010-12-21 05:38 . 2011-02-09 20:22204800----a-w-c:\windows\SysWow64\WebClnt.dll
2010-12-21 05:38 . 2011-02-09 20:22204288----a-w-c:\windows\SysWow64\upnp.dll
2010-12-21 05:38 . 2011-02-09 20:2214336----a-w-c:\windows\SysWow64\slwga.dll
2010-12-21 05:36 . 2011-02-09 20:221389568----a-w-c:\windows\SysWow64\msxml6.dll
2010-12-21 05:36 . 2011-02-09 20:221236992----a-w-c:\windows\SysWow64\msxml3.dll
2010-12-21 05:34 . 2011-02-09 20:2280384----a-w-c:\windows\SysWow64\davclnt.dll
2010-12-20 23:08 . 2010-12-04 20:3124152----a-w-c:\windows\system32\drivers\mbam.sys
2010-12-18 06:11 . 2011-02-09 20:2257856----a-w-c:\windows\system32\licmgr10.dll
2010-12-18 06:11 . 2011-02-09 20:22714752----a-w-c:\windows\system32\kerberos.dll
2010-12-18 05:29 . 2011-02-09 20:2244544----a-w-c:\windows\SysWow64\licmgr10.dll
2010-12-18 05:29 . 2011-02-09 20:22541184----a-w-c:\windows\SysWow64\kerberos.dll
2010-12-18 04:55 . 2011-02-09 20:22482816----a-w-c:\windows\system32\html.iec
2010-12-18 04:20 . 2011-02-09 20:22386048----a-w-c:\windows\SysWow64\html.iec
2010-12-18 04:13 . 2011-02-09 20:221638912----a-w-c:\windows\system32\mshtml.tlb
2010-12-18 03:47 . 2011-02-09 20:221638912----a-w-c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((( [emailprotected]_00.19.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2011-02-27 23:17 . 2011-02-27 23:1616384 c:\windows\SysWOW64\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
+ 2011-02-27 23:17 . 2011-03-14 17:5616384 c:\windows\SysWOW64\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
+ 2009-09-16 01:36 . 2011-03-14 21:1857818 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-03-14 21:4848854 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-11-15 10:07 . 2011-03-14 21:4826572 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-712587676-1097138996-4050794247-1000_UserData.bin
+ 2010-11-21 04:55 . 2011-03-09 08:5316384 c:\windows\system32\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
- 2010-11-21 04:55 . 2011-02-28 05:4916384 c:\windows\system32\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
- 2009-11-15 10:12 . 2011-03-01 00:0516384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-15 10:12 . 2011-03-14 21:4716384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:46 . 2011-03-12 15:2780352 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2009-11-15 10:12 . 2011-03-14 21:4732768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-11-15 10:12 . 2011-03-01 00:0532768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-11-15 10:12 . 2011-03-14 21:4716384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-11-15 10:12 . 2011-03-01 00:0516384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-11-15 10:09 . 2011-03-01 00:0516384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-15 10:09 . 2011-03-14 21:4816384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-11-15 10:09 . 2011-03-14 21:4816384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-11-15 10:09 . 2011-03-01 00:0516384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-11-16 03:17 . 2011-03-09 08:0135088 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-11-16 03:17 . 2011-02-10 12:4635088 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-11-16 03:17 . 2011-03-09 08:0118704 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-11-16 03:17 . 2011-02-10 12:4618704 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-11-16 05:33 . 2011-02-10 12:4620240 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-11-16 05:33 . 2011-03-09 08:0120240 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\cagicon.exe
- 2010-02-13 04:50 . 2010-02-13 04:5012800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2011-03-05 12:31 . 2011-03-05 12:3112800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2011-03-05 12:31 . 2011-03-05 12:3153248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2010-02-13 04:50 . 2010-02-13 04:5053248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2011-03-08 02:05 . 2011-03-08 02:059560 c:\windows\system32\NetworkList\Icons\{D891C3B3-3BF7-4431-9FC1-850715DE7EC8}_48.bin
+ 2011-03-08 02:05 . 2011-03-08 02:054280 c:\windows\system32\NetworkList\Icons\{D891C3B3-3BF7-4431-9FC1-850715DE7EC8}_32.bin
+ 2011-03-08 02:05 . 2011-03-08 02:052456 c:\windows\system32\NetworkList\Icons\{D891C3B3-3BF7-4431-9FC1-850715DE7EC8}_24.bin
- 2011-03-01 00:19 . 2011-03-01 00:192048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-03-14 21:45 . 2011-03-14 21:452048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-03-14 21:45 . 2011-03-14 21:452048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-03-01 00:19 . 2011-03-01 00:192048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-03-14 21:46 . 2011-03-14 21:46119808 c:\windows\temp\VPN_25DD\0FC343C0.dll
- 2009-07-14 00:06 . 2009-07-14 01:16850432 c:\windows\SysWOW64\sbe.dll
+ 2011-03-08 23:40 . 2010-12-23 05:28850432 c:\windows\SysWOW64\sbe.dll
+ 2011-03-05 00:06 . 2011-03-05 00:06235168 c:\windows\SysWOW64\Macromed\Flash\FlashUtil10n_Plugin.exe
- 2009-07-14 00:41 . 2009-07-14 01:16534528 c:\windows\SysWOW64\EncDec.dll
+ 2011-03-08 23:40 . 2010-12-23 05:28534528 c:\windows\SysWOW64\EncDec.dll
+ 2011-03-08 23:40 . 2011-02-19 05:32739840 c:\windows\SysWOW64\d2d1.dll
- 2011-01-12 13:35 . 2010-11-02 04:35739840 c:\windows\SysWOW64\d2d1.dll
+ 2011-03-08 23:40 . 2010-12-23 05:28642048 c:\windows\SysWOW64\CPFilters.dll
- 2009-07-14 02:36 . 2011-02-28 23:46703262 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-03-14 21:20703262 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-03-14 21:20136794 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-02-28 23:46136794 c:\windows\system32\perfc009.dat
+ 2011-03-08 23:40 . 2010-12-23 06:07723968 c:\windows\system32\EncDec.dll
+ 2011-03-08 23:40 . 2011-02-19 06:36902656 c:\windows\system32\d2d1.dll
- 2011-01-12 13:35 . 2010-11-02 05:12902656 c:\windows\system32\d2d1.dll
- 2010-10-26 20:40 . 2010-08-04 07:07961024 c:\windows\system32\CPFilters.dll
+ 2011-03-08 23:40 . 2010-12-23 06:07961024 c:\windows\system32\CPFilters.dll
+ 2009-07-14 05:01 . 2011-03-14 21:45421204 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-03-01 00:18421204 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-12-08 23:58 . 2010-12-08 23:58752640 c:\windows\Installer\5af3d60.msi
+ 2011-03-08 20:20 . 2011-03-08 20:20371272 c:\windows\Installer\{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}\SkypeIcon.exe
- 2010-12-29 18:52 . 2010-12-29 18:52371272 c:\windows\Installer\{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}\SkypeIcon.exe
- 2009-11-16 03:17 . 2011-02-10 12:46888080 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-11-16 03:17 . 2011-03-09 08:01888080 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-11-16 05:33 . 2011-03-09 08:01272648 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pubs.exe
- 2009-11-16 05:33 . 2011-02-10 12:46272648 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-11-16 05:33 . 2011-03-09 08:01922384 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pptico.exe
- 2009-11-16 05:33 . 2011-02-10 12:46922384 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\pptico.exe
- 2009-11-16 05:33 . 2011-02-10 12:46845584 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-11-16 05:33 . 2011-03-09 08:01845584 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\outicon.exe
- 2009-11-16 05:33 . 2011-02-10 12:46217864 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\misc.exe
+ 2009-11-16 05:33 . 2011-03-09 08:01217864 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\misc.exe
- 2009-11-16 05:33 . 2011-02-10 12:46184080 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-11-16 05:33 . 2011-03-09 08:01184080 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\joticon.exe
- 2009-11-16 05:33 . 2011-02-10 12:46159504 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-11-16 05:33 . 2011-03-09 08:01159504 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-02-14 11:04 . 2009-02-14 11:04625520 c:\windows\Installer\$PatchCache$\Managed\00002119E20000000000000000F01FEC\12.0.6425\GROOVEWEBSERVICES.DLL
+ 2009-02-12 20:19 . 2009-02-12 20:19688512 c:\windows\Installer\$PatchCache$\Managed\00002119E20000000000000000F01FEC\12.0.6425\GROOVEWEBPLATFORMSERVICES.DLL
+ 2009-03-06 09:33 . 2009-03-06 09:33961888 c:\windows\Installer\$PatchCache$\Managed\00002119E20000000000000000F01FEC\12.0.6425\GROOVEUTIL.DLL
+ 2009-02-14 11:03 . 2009-02-14 11:03337264 c:\windows\Installer\$PatchCache$\Managed\00002119E20000000000000000F01FEC\12.0.6425\GROOVE.EXE
- 2010-02-13 04:50 . 2010-02-13 04:50223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2010-02-13 04:50 . 2010-02-13 04:50178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2010-02-13 04:50 . 2010-02-13 04:50364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2010-02-13 04:50 . 2010-02-13 04:50159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2010-02-13 04:50 . 2010-02-13 04:50145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2009-11-16 03:08 . 2009-11-16 03:08578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-11-16 03:08 . 2009-11-16 03:08578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-11-16 03:08 . 2009-11-16 03:08577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-11-16 03:08 . 2009-11-16 03:08577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-02-13 04:50 . 2010-02-13 04:50577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-11-16 03:08 . 2009-11-16 03:08576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-11-16 03:08 . 2009-11-16 03:08567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-11-16 03:08 . 2009-11-16 03:08563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-02-13 04:50 . 2010-02-13 04:50473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2011-03-05 12:31 . 2011-03-05 12:31473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2011-03-14 21:46 . 2011-03-14 21:462240512 c:\windows\temp\VPN_25DD\9218E5A4.dll
+ 2011-03-14 21:46 . 2011-03-14 21:461185288 c:\windows\temp\.unicode_cache_78ae99a9.dat
+ 2011-03-08 23:40 . 2010-12-18 05:302690560 c:\windows\SysWOW64\mstscax.dll
+ 2011-03-08 23:40 . 2010-12-18 05:261034240 c:\windows\SysWOW64\mstsc.exe
- 2010-01-27 01:07 . 2011-02-11 21:416053536 c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
+ 2010-01-27 01:07 . 2011-03-05 00:066053536 c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
+ 2011-03-08 23:40 . 2011-02-19 05:321074176 c:\windows\SysWOW64\DWrite.dll
- 2011-01-12 13:35 . 2010-11-02 04:351074176 c:\windows\SysWOW64\DWrite.dll
+ 2011-03-08 23:40 . 2010-12-23 06:071118720 c:\windows\system32\sbe.dll
- 2009-07-14 00:21 . 2009-07-14 01:411118720 c:\windows\system32\sbe.dll
+ 2011-03-08 23:40 . 2010-12-18 06:123138048 c:\windows\system32\mstscax.dll
+ 2011-03-08 23:40 . 2010-12-18 06:081097216 c:\windows\system32\mstsc.exe
+ 2011-03-08 23:40 . 2011-02-19 06:371135104 c:\windows\system32\FntCache.dll
- 2011-01-12 13:35 . 2010-11-02 05:121540608 c:\windows\system32\DWrite.dll
+ 2011-03-08 23:40 . 2011-02-19 06:371540608 c:\windows\system32\DWrite.dll
- 2009-07-14 04:45 . 2011-02-28 23:513798234 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:45 . 2011-03-09 08:223798234 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2011-02-16 18:54 . 2011-02-16 18:544992000 c:\windows\Installer\1d0321f.msp
+ 2011-01-11 22:53 . 2011-01-11 22:531763328 c:\windows\Installer\1d03209.msp
+ 2009-11-16 05:33 . 2011-03-09 08:011172240 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-11-16 05:33 . 2011-02-10 12:461172240 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-11-16 05:33 . 2011-02-10 12:461165584 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-11-16 05:33 . 2011-03-09 08:011165584 c:\windows\Installer\{91120000-002E-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-02-14 11:03 . 2009-02-14 11:033070832 c:\windows\Installer\$PatchCache$\Managed\00002119E20000000000000000F01FEC\12.0.6425\GROOVEDOCUMENTSHARETOOL.DLL
- 2009-11-16 03:08 . 2009-11-16 03:082846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:312846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2011-03-05 12:31 . 2011-03-05 12:312676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-11-16 03:08 . 2009-11-16 03:082676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-07-14 02:34 . 2011-03-01 00:1710223616 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2009-07-14 02:34 . 2011-03-14 21:3010223616 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2009-11-15 13:25 . 2011-03-09 08:0139946696 c:\windows\system32\MRT.exe
+ 2011-03-08 20:19 . 2011-03-08 20:1918307072 c:\windows\Installer\2f64c.msi
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]
2010-11-06 03:142735200----a-w-c:\program files (x86)\OnRPG\tbOnR0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}"= "c:\program files (x86)\OnRPG\tbOnR0.dll" [2010-11-06 2735200]
.
[HKEY_CLASSES_ROOT\clsid\{d22f6f66-2f47-4184-8625-fbfa4cbdb7ce}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08143360----a-w-c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files (x86)\DNA\btdna.exe" [2010-11-19 323392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"CinemaNowMediaManagerApp"="c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowShell.exe" [2009-06-11 2088296]
"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2009-04-20 159744]
"ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2009-07-07 8493624]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-08-10 421888]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-12-06 1910152]
"cwcptray"="c:\program files (x86)\ContentWatch\Internet Protection\cwtray.exe" [2010-11-16 353088]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"00PCTFW"="c:\program files (x86)\PC Tools Firewall Plus\FirewallGUI.exe" [2010-11-29 2676696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FancyStart daemon.lnk - c:\windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe [2009-9-15 12862]
LOLRecorder.lnk - c:\program files (x86)\LOLReplay\LOLRecorder.exe [2011-3-3 201728]
PacketiX VPN Client Task Tray.lnk - c:\program files (x86)\PacketiX VPN Client English\vpncmgr.exe [2008-5-15 2682880]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:4435760----a-w-c:\program files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADSMTray]
2009-06-24 19:30272952----a-w-c:\program files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2009-09-16 01:3372248----a-w-c:\windows\AsScrProlog.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2009-09-16 01:333054136----a-w-c:\windows\AsScrPro.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-19 00:52104936------w-c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2Go_Menu]
2008-06-13 23:11210216------w-c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dump_wmimmc;dump_wmimmc;c:\hanpurple\elsword\data\GameGuard\dump_wmimmc.sys

• Double click it to start the tool.Vista and Windows7 run as administrator.
• Click Scan.
  
• Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
  

Hi when I go into RIBBON and attempt to view hidden FILES it un-ticks itself. I have gone in file options STILL does not WORK and I have changed the regedit still not working. I had hear this may be caused by a virus so I did a system scan with bitdefender total security 2016 but the problem still persists. OS is win10.What ribbon? What exactly are we talking about?Ribbon as in the one in file explorer.
ThatAre you logged in as admin?Yes I am admin. I already said I attempted to change it in the ribbon and in file explorer options.Anyone GOT any idea?Okay so seems as though no one knows then...

I've just listened to an item on radio about "ransomware" and the effect it has on pcs attacked by this malware. I gather that it completely locks the pc and demands are made for money to unlock. I appreciate that common sense and good av and malware protection, kept up-to-date, can help avoid problems but if your pc does GET infected what can you do yourself about it? What would be the best course of action - if the SYSTEM is locked then presumably you're stymied?
There are program that you can download to a USB and use them to start up your PC. If it ever happens to your PC, you will need EXCESS to ANOTHER PC or laptop and a USB stick, preferably a 1GB one.

Of course, if you only download or access reputable sites and do not click on anything for the sake of it, you'll be fine.

Safe surfing works wonders. Thanks for comments. This was new to me - the radio report was the first I've heard of it and it does seem to be serious criminality.I have never seen or heard about any sort of ransomeware personally. I've only heard about it on the internet. I don't doubt it exists but there is no more to be worried about than there is in the case of malware infections which destroy everything. Very few of them are difficult to circumvent anyway. I have only heard of one that actually ENCRYPTS the data and tells the user to send money to a certain address to get the key. But iirc the perpetrators were found and are in prison.

this is what happens, when i type a key word onto the address bar of google chrome.and press enter it directs me to this
http://www.questbasic.com/b.cgi?bk=H8QuaD58wP9ZQYyXDXDpufl1zTeBcpDHoS4ZrDzh1DMZLDM-JCByOf4SXPJ0TtJcmKW01AKi4xS-ZKb28*yZI8OMOn6laSdo26f3lF8xeXCnnwNUkZw5qFNcA8ONrthKG1EA1Q

i posted this problem on the browsers area.but they told me my pc is infected.but my esset anti virus doesnt detect any virus.this happened when i DOWNLOADED and install wamp from this site http://www.wampserver.com/en/

im using windows 7 home PREMIUM 64bit

and on the OPTION my search is set to google. any one please HELP me fix thisand questbasic.exe is on my processes.and i cant end process.how to fix this??found the folder then deleted it. Do you still NEED help?

Quote

Also it never asked so I never did reboot. Is this ok?

========== OTL ==========
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 12292011_141813

ComboFix 11-12-29.04 - Johnny Ola 12/29/2011 14:31:52.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.1055 [GMT -5:00]
Running from: c:\users\Johnny Ola\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\programdata\pswi_preloaded.exe
c:\users\Johnny Ola\AppData\Local\assembly\tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-11-28 to 2011-12-29 )))))))))))))))))))))))))))))))
.
.
2011-12-29 20:18 . 2011-12-29 20:21--------d-----w-c:\users\Johnny Ola\AppData\Local\temp
2011-12-29 20:18 . 2011-12-29 20:18--------d-----w-c:\users\Guest\AppData\Local\temp
2011-12-29 20:18 . 2011-12-29 20:18--------d-----w-c:\users\Default\AppData\Local\temp
2011-12-29 19:18 . 2011-12-29 19:18--------d-----w-C:\_OTL
2011-12-21 04:56 . 2011-12-21 04:56--------d-----w-c:\program files\iPod
2011-12-21 04:56 . 2011-12-21 04:56--------d-----w-c:\program files\iTunes
2011-12-15 01:33 . 2011-11-23 13:372043904----a-w-c:\windows\system32\win32k.sys
2011-12-15 01:33 . 2011-11-08 12:102409784----a-w-c:\program files\Windows Mail\OESpamFilter.dat
2011-12-15 01:33 . 2011-10-27 08:013602816----a-w-c:\windows\system32\ntkrnlpa.exe
2011-12-15 01:33 . 2011-10-27 08:013550080----a-w-c:\windows\system32\ntoskrnl.exe
2011-12-15 01:33 . 2011-10-14 16:02429056----a-w-c:\windows\system32\EncDec.dll
2011-12-15 01:33 . 2011-10-25 15:5649152----a-w-c:\windows\system32\csrsrv.dll
2011-12-15 01:33 . 2011-11-08 14:422048----a-w-c:\windows\system32\tzres.dll
2011-12-08 18:02 . 2011-12-08 18:02--------d-----w-C:\Temp
2011-12-08 17:29 . 2011-12-15 18:06--------d-----w-c:\users\Johnny Ola\AppData\Local\LogMeIn Rescue Applet
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-29 19:05 . 2011-10-17 04:18472808----a-w-c:\windows\system32\deployJava1.dll
2011-12-19 18:59 . 2011-10-07 22:4782400----a-w-c:\windows\system32\drivers\inspect.sys
2011-12-19 18:59 . 2011-10-07 22:4738616----a-w-c:\windows\system32\drivers\cmdhlp.sys
2011-12-19 18:59 . 2011-10-07 22:47491816----a-w-c:\windows\system32\drivers\cmdGuard.sys
2011-12-19 18:59 . 2011-10-07 22:4719600----a-w-c:\windows\system32\drivers\cmderd.sys
2011-12-19 18:58 . 2011-10-07 22:4733984----a-w-c:\windows\system32\cmdcsr.dll
2011-12-19 18:58 . 2011-10-07 22:47301224----a-w-c:\windows\system32\guard32.dll
2011-12-10 20:24 . 2011-10-11 20:0620464----a-w-c:\windows\system32\drivers\mbam.sys
2011-11-19 21:24 . 2011-10-11 18:18414368----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-05 17:47 . 2011-11-05 17:4711264----a-r-c:\users\Johnny Ola\AppData\Roaming\Microsoft\Installer\{98613C99-1399-416C-A07C-1EE1C585D872}\Icon98613C992.exe
2011-10-29 23:10 . 2011-10-29 23:100----a-w-c:\windows\system32\ConduitEngine.tmp
2011-10-26 06:49 . 2011-10-26 06:4986528----a-w-c:\windows\system32\iesysprep.dll
2011-10-26 06:49 . 2011-10-26 06:4976800----a-w-c:\windows\system32\SetIEInstalledDate.exe
2011-10-26 06:49 . 2011-10-26 06:4974752----a-w-c:\windows\system32\RegisterIEPKEYs.exe
2011-10-26 06:49 . 2011-10-26 06:4948640----a-w-c:\windows\system32\mshtmler.dll
2011-10-26 06:49 . 2011-10-26 06:49161792----a-w-c:\windows\system32\msls31.dll
2011-10-26 06:49 . 2011-10-26 06:4963488----a-w-c:\windows\system32\tdc.ocx
2011-10-26 06:49 . 2011-10-26 06:49367104----a-w-c:\windows\system32\html.iec
2011-10-26 06:49 . 2011-10-26 06:4974752----a-w-c:\windows\system32\iesetup.dll
2011-10-26 06:49 . 2011-10-26 06:4923552----a-w-c:\windows\system32\licmgr10.dll
2011-10-26 06:49 . 2011-10-26 06:49420864----a-w-c:\windows\system32\vbscript.dll
2011-10-26 06:49 . 2011-10-26 06:49152064----a-w-c:\windows\system32\wextract.exe
2011-10-26 06:49 . 2011-10-26 06:49150528----a-w-c:\windows\system32\iexpress.exe
2011-10-26 06:49 . 2011-10-26 06:49142848----a-w-c:\windows\system32\ieUnatt.exe
2011-10-26 06:49 . 2011-10-26 06:4935840----a-w-c:\windows\system32\imgutil.dll
2011-10-26 06:49 . 2011-10-26 06:4911776----a-w-c:\windows\system32\mshta.exe
2011-10-26 06:49 . 2011-10-26 06:49110592----a-w-c:\windows\system32\IEAdvpack.dll
2011-10-26 06:49 . 2011-10-26 06:49101888----a-w-c:\windows\system32\admparse.dll
2011-10-26 06:48 . 2011-10-26 06:48979456----a-w-c:\windows\system32\MFH264Dec.dll
2011-10-26 06:48 . 2011-10-26 06:48357376----a-w-c:\windows\system32\MFHEAACdec.dll
2011-10-26 06:48 . 2011-10-26 06:48302592----a-w-c:\windows\system32\mfmp4src.dll
2011-10-26 06:48 . 2011-10-26 06:4898816----a-w-c:\windows\system32\mfps.dll
2011-10-26 06:48 . 2011-10-26 06:482873344----a-w-c:\windows\system32\mf.dll
2011-10-26 06:48 . 2011-10-26 06:48261632----a-w-c:\windows\system32\mfreadwrite.dll
2011-10-26 06:48 . 2011-10-26 06:48209920----a-w-c:\windows\system32\mfplat.dll
2011-10-26 06:48 . 2011-10-26 06:48586240----a-w-c:\windows\system32\stobject.dll
2011-10-26 06:48 . 2011-10-26 06:48667648----a-w-c:\windows\system32\printfilterpipelinesvc.exe
2011-10-26 06:48 . 2011-10-26 06:48638336----a-w-c:\windows\system32\drivers\dxgkrnl.sys
2011-10-26 06:48 . 2011-10-26 06:48478720----a-w-c:\windows\system32\dxgi.dll
2011-10-26 06:48 . 2011-10-26 06:4837376----a-w-c:\windows\system32\cdd.dll
2011-10-26 06:48 . 2011-10-26 06:4826112----a-w-c:\windows\system32\printfilterpipelineprxy.dll
2011-10-26 06:48 . 2011-10-26 06:48258048----a-w-c:\windows\system32\winspool.drv
2011-10-26 06:48 . 2011-10-26 06:48135680----a-w-c:\windows\system32\XpsRasterService.dll
2011-10-26 06:47 . 2011-10-26 06:474096----a-w-c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui
2011-10-26 06:47 . 2011-10-26 06:47369664----a-w-c:\windows\system32\WMPhoto.dll
2011-10-26 06:47 . 2011-10-26 06:47252928----a-w-c:\windows\system32\dxdiag.exe
2011-10-26 06:47 . 2011-10-26 06:47195584----a-w-c:\windows\system32\dxdiagn.dll
2011-10-26 06:47 . 2011-10-26 06:47974848----a-w-c:\windows\system32\WindowsCodecs.dll
2011-10-26 06:47 . 2011-10-26 06:47519680----a-w-c:\windows\system32\d3d11.dll
2011-10-26 06:47 . 2011-10-26 06:47321024----a-w-c:\windows\system32\PhotoMetadataHandler.dll
2011-10-26 06:47 . 2011-10-26 06:47189440----a-w-c:\windows\system32\WindowsCodecsExt.dll
2011-10-17 05:25 . 2006-11-02 10:32101888----a-w-c:\windows\system32\ifxcardm.dll
2011-10-17 05:25 . 2006-11-02 10:3282432----a-w-c:\windows\system32\axaltocm.dll
2011-10-14 07:04 . 2011-10-14 07:04377344----a-w-c:\windows\system32\winhttp.dll
2011-10-14 07:02 . 2011-10-14 07:0236864----a-w-c:\windows\system32\drivers\en-US\http.sys.mui
2011-10-13 08:09 . 2011-10-13 08:0923552----a-w-c:\windows\system32\lpk.dll
2011-10-13 08:09 . 2011-10-13 08:0910240----a-w-c:\windows\system32\dciman32.dll
2011-10-13 08:05 . 2011-10-13 08:0561440----a-w-c:\windows\system32\winipsec.dll
2011-10-13 08:05 . 2011-10-13 08:05272896----a-w-c:\windows\system32\polstore.dll
2011-10-13 08:02 . 2011-10-13 08:029728----a-w-c:\windows\system32\TCPSVCS.EXE
2011-10-13 08:02 . 2011-10-13 08:028704----a-w-c:\windows\system32\HOSTNAME.EXE
2011-10-13 08:02 . 2011-10-13 08:0211264----a-w-c:\windows\system32\MRINFO.EXE
2011-10-13 08:02 . 2011-10-13 08:02105984----a-w-c:\windows\system32\netiohlp.dll
2011-10-13 08:02 . 2011-10-13 08:0210240----a-w-c:\windows\system32\finger.exe
2011-10-13 08:02 . 2011-10-13 08:0227136----a-w-c:\windows\system32\NETSTAT.EXE
2011-10-13 08:02 . 2011-10-13 08:0219968----a-w-c:\windows\system32\ARP.EXE
2011-10-13 08:02 . 2011-10-13 08:0217920----a-w-c:\windows\system32\ROUTE.EXE
2011-10-13 07:59 . 2011-10-13 07:5965024----a-w-c:\windows\system32\wlanapi.dll
2011-10-13 07:59 . 2011-10-13 07:59127488----a-w-c:\windows\system32\L2SecHC.dll
2011-10-13 07:59 . 2011-10-13 07:5968096----a-w-c:\windows\system32\wlanhlp.dll
2011-10-13 07:59 . 2011-10-13 07:59513536----a-w-c:\windows\system32\wlansvc.dll
2011-10-13 07:59 . 2011-10-13 07:59302592----a-w-c:\windows\system32\wlansec.dll
2011-10-13 07:59 . 2011-10-13 07:59293376----a-w-c:\windows\system32\wlanmsm.dll
2011-10-13 07:59 . 2011-10-13 07:5915181----a-w-c:\windows\system32\gatherWirelessInfo.vbs
2011-10-13 07:58 . 2011-10-13 07:581401856----a-w-c:\windows\system32\msxml6.dll
2011-10-13 07:58 . 2011-10-13 07:582048----a-w-c:\windows\system32\msxml3r.dll
2011-10-13 07:58 . 2011-10-13 07:582048----a-w-c:\windows\system32\msxml6r.dll
2011-10-13 07:57 . 2011-10-13 07:57218624----a-w-c:\windows\system32\msv1_0.dll
2011-10-13 07:55 . 2011-10-13 07:5553248----a-w-c:\windows\system32\rrinstaller.exe
2011-10-13 07:55 . 2011-10-13 07:5524576----a-w-c:\windows\system32\mfpmp.exe
2011-10-13 07:55 . 2011-10-13 07:552048----a-w-c:\windows\system32\mferror.dll
2011-10-13 07:52 . 2011-10-13 07:5271680----a-w-c:\windows\system32\atl.dll
2011-10-13 07:47 . 2011-10-13 07:47160256----a-w-c:\windows\system32\wkssvc.dll
2011-10-13 07:46 . 2011-10-13 07:4653248----a-w-c:\windows\system32\tsgqec.dll
2011-10-13 07:46 . 2011-10-13 07:46136192----a-w-c:\windows\system32\aaclient.dll
2011-10-13 07:44 . 2011-10-13 07:44714240----a-w-c:\windows\system32\timedate.cpl
2011-10-13 07:36 . 2011-10-13 07:36623616----a-w-c:\windows\system32\localspl.dll
2011-10-13 07:33 . 2011-10-13 07:33499712----a-w-c:\windows\system32\kerberos.dll
2011-10-13 07:33 . 2011-10-13 07:33175104----a-w-c:\windows\system32\wdigest.dll
2011-10-13 07:33 . 2011-10-13 07:339728----a-w-c:\windows\system32\lsass.exe
2011-10-13 07:33 . 2011-10-13 07:3372704----a-w-c:\windows\system32\secur32.dll
2011-10-13 07:33 . 2011-10-13 07:33439864----a-w-c:\windows\system32\drivers\ksecdd.sys
2011-10-13 07:33 . 2011-10-13 07:331259008----a-w-c:\windows\system32\lsasrv.dll
2011-10-13 07:31 . 2011-10-13 07:316656----a-w-c:\windows\system32\kbd106n.dll
2011-10-13 07:29 . 2011-10-13 07:2962464----a-w-c:\windows\system32\l3codeca.acm
2011-10-13 07:29 . 2011-10-13 07:29220672----a-w-c:\windows\system32\l3codecp.acm
2011-10-13 07:27 . 2011-10-13 07:2730720----a-w-c:\windows\system32\drivers\tcpipreg.sys
2011-10-13 07:27 . 2011-10-13 07:2725088----a-w-c:\windows\system32\drivers\tunnel.sys
2011-10-13 07:27 . 2011-10-13 07:27200704----a-w-c:\windows\system32\iphlpsvc.dll
2011-10-13 07:27 . 2011-10-13 07:2715360----a-w-c:\windows\system32\drivers\TUNMP.SYS
2011-11-09 16:37 . 2011-10-11 17:40134104----a-w-c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:0294208----a-w-c:\users\Johnny Ola\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:0294208----a-w-c:\users\Johnny Ola\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:0294208----a-w-c:\users\Johnny Ola\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2011-11-11 59240]
"ApplePhotoStreams"="c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2011-11-11 59240]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-06 4423680]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-24 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-24 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-24 133912]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-08 835584]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-04-17 321656]
"VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2007-04-02 411768]
"VAIO Center Access Bar"="c:\program files\sony\VAIO Center Access Bar\VCAB.exe" [2007-03-06 36864]
"VAIOSecurity"="c:\program files\Sony\VAIO Security Center\VSC.exe" [2007-03-14 2322432]
"VAIOSurvey"="c:\program files\Sony\VAIO Survey\Vista VAIO Survey.exe" [2006-12-07 577536]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-12-03 2415456]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-12-21 6676808]
.
c:\users\Johnny Ola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Johnny Ola\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-12-5 24242056]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-2-3 2756608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54551296----a-w-c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-04-24 00:1998304----a-w-c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecuteREG_MULTI_SZ autocheck autochk *\0SsiEfr.exe\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-05-03 15:434321112----a-w-c:\program files\AIM\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-11-02 04:2559240----a-w-c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\com.apple.dav.bookmarks.daemon]
2011-11-16 02:5259240----a-w-c:\program files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-10-11 20:04136176----atw-c:\users\Johnny Ola\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-12-08 06:36421736----a-w-c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-12-24 22:50981680----a-w-c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickBooks Simple Start]
2007-01-31 05:59371712----a-w-c:\program files\Intuit\SimpleStartEntice\entice.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunSpySweeperScheduleAtStartup]
2011-10-26 06:4910752----a-w-c:\windows\System32\msfeedssync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-04-06 18:181822720----a-w-c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:381008184----a-w-c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2009-04-11 06:282153472----a-w-c:\windows\System32\oobefldr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 136176]
R3 DIRECTIO;DIRECTIO;T:\DirectIo.sys

R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 136176]
R3 ICScsiSV;Image Converter SCSI Service;c:\program files\Sony\Image Converter 3\ICScsiSV.exe [2007-01-26 75952]
R3 IcVzMonLauncher;IcVzMonLauncher;c:\program files\Sony\Image Converter 3\IcVzMonLauncher.exe [2007-01-26 67760]
R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-11 745472]
R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-01-09 397312]
R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-01-16 1089536]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-10-07 230608]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2011-12-19 491816]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2011-12-19 38616]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-11 116608]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [2011-10-12 4433248]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2011-08-02 192776]
S2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-01-03 11032]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134736]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720]
S3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\Drivers\R5U870FLx86.sys [2007-04-04 73472]
S3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\Drivers\R5U870FUx86.sys [2007-04-04 43904]
S3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2007-04-05 31104]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-02-08 807424]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonationREG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 19:59]
.
2011-12-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-11 19:59]
.
2011-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-463125951-12254502-3284758742-1005Core.job
- c:\users\Johnny Ola\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-11 20:04]
.
2011-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-463125951-12254502-3284758742-1005UA.job
- c:\users\Johnny Ola\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-11 20:04]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2818425
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
TCP: Interfaces\{20DA44BE-98A1-475D-B8AC-88DF3AD26CDD}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{D83D5627-FB49-437C-B3E7-C61C85550B27}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:\users\Johnny Ola\AppData\Roaming\Mozilla\Firefox\Profiles\3yu3mje6.default\
FF - prefs.js: BROWSER.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2818425&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{7aeb3efd-e564-43f1-b658-5058a7c5743b} - (no file)
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-COMODO - c:\program files\COMODO\COMODO GeekBuddy\CLPSLA.exe
MSConfigStartUp-CPA - c:\program files\COMODO\COMODO GeekBuddy\VALA.exe
MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-29 15:21
Windows 6.0.6002 Service Pack 2 NTFS
.
detected NTDLL code modification:
ZwClose
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1112)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'lsass.exe'(1060)
c:\windows\system32\guard32.dll
.
Completion time: 2011-12-29 15:26:46
ComboFix-quarantined-files.txt 2011-12-29 20:26
.
Pre-Run: 208,664,760,320 bytes free
Post-Run: 207,876,616,192 bytes free
.
- - End Of File - - 5F749A562566151542C7F28A2F0CEFC5

I have heard more grinding

Java RA
-OTL
-Combo fix?

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to. Open the text file and copy/paste the log here.

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \SystemRoot\System32\Drivers\dump_dumpata.sys
Service Name: ---
Module Base: 8C9F0000
Module End: 8C9FB000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
Service Name: ---
Module Base: 8E3F8000
Module End: 8E400000
Hidden: Yes

******************************************************************************************
******************************************************************************************
SSDT:
Function Name: ZwAdjustPrivilegesToken
Address: 8E6E0F60
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwAlpcConnectPort
Address: 8E6E114C
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwConnectPort
Address: 8E6E02C0
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwCreateFile
Address: 8E6E0BC6
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwCreateSection
Address: 8E6E097A
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwCreateSymbolicLinkObject
Address: 8E6E1CC4
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwCreateThread
Address: 8E6DFCAC
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwLoadDriver
Address: 8E6E16F6
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwMakeTemporaryObject
Address: 8E6E0588
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwOpenFile
Address: 8E6E0DA2
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwOpenProcess
Address: AC925F3C
Driver Base: AC925000
Driver End: AC928000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

Function Name: ZwOpenSection
Address: 8E6E0822
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwSetSystemInformation
Address: 8E6E19E2
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwShutdownSystem
Address: 8E6E04F2
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwSystemDebugControl
Address: 8E6E070E
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

Function Name: ZwTerminateProcess
Address: AC925FE4
Driver Base: AC925000
Driver End: AC928000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

Function Name: ZwTerminateThread
Address: AC926080
Driver Base: AC925000
Driver End: AC928000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

Function Name: ZwWriteVirtualMemory
Address: AC92611C
Driver Base: AC925000
Driver End: AC928000
Driver Name: \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys

Function Name: ZwCreateThreadEx
Address: 8E6E137A
Driver Base: 8E6D3000
Driver End: 8E74E000
Driver Name: \SystemRoot\System32\DRIVERS\cmdguard.sys

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cookies.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
Status: Access denied

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

Pretty good, it got better last Friday.
Can we call it clear, or is there another scan, any, we can do, just to be sure?

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

Is my PC safe, and clear?

Do I really need TFC, or can I just use CC Cleaner.

Is it alarming that it did not work?

Is there still a problem with updating?Yes. It gets to "installing NUMBER 7 of 86" then freezes.I was speaking to a friend last NIGHT who re-furbishes COMPUTERS for schools and he said for almost a month they have been having trouble downloading updates for Windows 7. He said sometimes if you leave the computer on long enough you will get the updates.I'll give it a try. I'll leave it on all night.Just to give you a update, I restarted my computer and STARTED 80 updates over again. It's been 4 hours and its still at "installing update 1 of 80".

By the way, my updates are DOWNLOADED, they just don't get installed for some reasonThis appears to be a problem with your computer that, unfortunately, I cannot solve remotely. All I can suggest is that you take a look at some of the suggestions here.
I upgraded to Windows 10 and up updating problems went away. Just thought I'd pass it along.

I'm glad for you. Thanks for the update.

Hi,

I just want to know this answer:
If a Computer is infected with Viruses. Does it make a difference if: Instead of scanning it directly (With anti-virus tools), Connect it with a USB IDE SATA cable to another clean Computer, and scan it with anti-virus tools (As an external Drive) ?

I tried it, and when I run a scan from the infected computer, a FULL scan Microsoft Security Essentials takes like 3 or 4 hours to finish, But when CUSTOM (To choose which drive I want to scan) scanned from another computer, it takes only 1h. (and a FULL Scan (will scan also the HDD of the computer, in addition of the external HDD) takes 8h)

I don't find any information on that online, except some opinions, but... I want an experienced opinion... or Fact =P



PS: If I posted in the wrong section, please correct it, or let me know.
I hope I was clear on my question :s

Thank you! There is a difference between the transfer speed of direct SATA connection to the motherboard and connection via USB enclosure.
http://www.tomshardware.com/forum/174836-32-sata-transfer-rate
Quote

Quote from above website.

Test 1: Copying a single 5.7GB avi file between the Lacie and my internal Raptor comparing eSATA with USB2 both reading and writing to the Lacie.

Test 2: Copying 811 smaller files in 2 directories, totalling 4.07GB between the Lacie Drive and my internal Raptor comparing eSATA with USB both reading and writing to the Lacie.
Test 1 - eSATA Write 1m 32sec, Read 1m 31sec
Test 1 - USB2 Write 3m 10sec, Read 3m 39sec
Test 2 - eSATA Write 1m 00sec, Read 1m 20sec
Test 2 - USB2 Write 2m 57sec, Read 1m 51sec

So, If I run a scan of a HDD (That has an OS of another machine) as an external HDD on another machine, it's good ?

There is a difference between the transfer speed of direct SATA connection to the motherboard and connection via USB enclosure.

I personally have a USB 2.0 WD external 500GB HDD which takes around twice to thrice as long to complete file transfers when compared to my internal HDD

Here are a few professional links concerning SATA vs USB vs eSATA:
http://www.wfu.edu/~yipcw/atg/disk/usb3/
http://blogs.gurulabs.com/dax/2009/07/esata-vs-sata-v.html
http://www.rt.db.erau.edu/655s08/655webUSBSAT/index.htm

Even if I had a 5200 RPM external drive which presumably would never be able to saturate USB 2.0 it shouldn't spend twice as much time completing file transfers as my internal 5400 RPM drive...

You got me thinking about USB 3.0 drives. That means... manufacturers claim that the transfer speed will be faster due to the fact that the enclosure supports USB 3.0(which BTW has a quoted max speed of 5Gbps, or 600MB/s) but in fact all they have to do is slip a 7200RPM drive in, which will clearly be an improvement over a 5200RPM one? And then charge an extreme premium for the USB 3.0 port?

EDIT: I just realized 480 Mbps is 60 MegaBytes/second. USB 2.0 is half-duplex. So... only 30 MB/s max in both directions? Any 7200 RPM drive will easily saturate that...

Obviously for tasks like transferring files and copying files it will be slower, but the fact is the OP is discussing performing a virus scan on the drive. This will almost always be slower when you run it on the system drive since there are any number of programs hooking drive accesses, such as anti-virus programs, which will slow down any and all disk access in that manner. Also, if the drive is infected you've got the issue that malware can be doing the same thing (much like virut, which will infect files as they are accessed)

My internal drive had a average transfer rate of around 80MB (Megabytes) a second. This would definitely saturate USB2, so I was wrong about that. testing a external USB enclosed drive, it seemed to max out at around 30MB/s. Though it's hard to say what that means, since like the quoted test, my "test" is tainted since my external drive is a different brand, model, and even interface (my external is EIDE whereas the internal drive is SATA). Maxing out at 30 though seems to work with your theory, and it looks like Drives now do exceed USB2.

There is a difference between the transfer speed of direct SATA connection to the motherboard and connection via USB enclosure.

Does CCleaner save a log somewhere? I have the portable version...ComboFix
NOTE: The computer freezed during the first time (When it asked me to disable Microsoft Security Essentials)


ComboFix 11-10-28.04 - Nas 10/28/2011 13:00:56.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3957.2544 [GMT -4:00]
Running from: c:\users\Nas\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\programdata\DisplayBackupOnline.dll
c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\ya9829x9.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}
c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\ya9829x9.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\chrome.manifest
c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\ya9829x9.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\chrome\xulcache.jar
c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\ya9829x9.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\defaults\preferences\xulcache.js
c:\users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\ya9829x9.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\install.rdf
c:\users\Nas\AppData\Local\{08583A71-F8CF-4D82-9516-4C5A8117F2CB}
c:\users\Nas\AppData\Local\{08583A71-F8CF-4D82-9516-4C5A8117F2CB}\chrome.manifest
c:\users\Nas\AppData\Local\{08583A71-F8CF-4D82-9516-4C5A8117F2CB}\chrome\content\overlay.xul
c:\users\Nas\AppData\Local\{08583A71-F8CF-4D82-9516-4C5A8117F2CB}\install.rdf
c:\users\Nas\AppData\Local\Activision\ActivisionUpdate\Activisionupdt32.dll
c:\users\Nas\AppData\Local\APPLE\AppleUpdate\Appleupdt32.dll
c:\users\Nas\AppData\Roaming\Adobe\plugs
c:\users\Nas\AppData\Roaming\Adobe\shed
c:\users\Nas\AppData\Roaming\Mozilla\Firefox\Profiles\74j0np1d.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}
c:\users\Nas\AppData\Roaming\Mozilla\Firefox\Profiles\74j0np1d.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\chrome.manifest
c:\users\Nas\AppData\Roaming\Mozilla\Firefox\Profiles\74j0np1d.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\chrome\xulcache.jar
c:\users\Nas\AppData\Roaming\Mozilla\Firefox\Profiles\74j0np1d.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\defaults\preferences\xulcache.js
c:\users\Nas\AppData\Roaming\Mozilla\Firefox\Profiles\74j0np1d.default\extensions\{d8a7ef98-7e29-4def-8b9e-62d8eabdb471}\install.rdf
.
.
((((((((((((((((((((((((( Files Created from 2011-09-28 to 2011-10-28 )))))))))))))))))))))))))))))))
.
.
2011-10-28 17:08 . 2011-10-28 17:0869000----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7876A915-C731-41F0-A6F2-294A2E344B6F}\offreg.dll
2011-10-28 17:07 . 2011-10-28 17:07--------d-----w-c:\users\Guest\AppData\Local\temp
2011-10-28 17:07 . 2011-10-28 17:07--------d-----w-c:\users\Default\AppData\Local\temp
2011-10-28 06:39 . 2011-10-28 06:39--------d-----w-c:\program files (x86)\Common Files\Java
2011-10-28 06:37 . 2011-10-28 06:37--------d-----w-c:\users\Nas\AppData\Roaming\Sawer
2011-10-28 06:36 . 2011-10-28 06:37--------d-----w-c:\users\Nas\AppData\Roaming\Juce VST Host
2011-10-28 06:24 . 2011-10-07 04:168570192----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7876A915-C731-41F0-A6F2-294A2E344B6F}\mpengine.dll
2011-10-26 21:09 . 2011-10-26 21:0983456----a-w-c:\windows\SysWow64\srrstr.dll
2011-10-25 17:54 . 2011-10-25 17:54--------d-----w-c:\users\UpdatusUser
2011-10-25 17:53 . 2011-10-15 08:53837952----a-w-c:\windows\system32\easyupdatusapiu64.dll
2011-10-25 17:51 . 2011-10-25 17:54--------d-----w-c:\program files\NVIDIA Corporation
2011-10-25 17:51 . 2011-10-25 17:51--------d-----w-C:\NVIDIA
2011-10-25 16:57 . 2011-10-25 16:57--------d-----w-c:\program files (x86)\EA Games
2011-10-25 05:10 . 2011-10-25 05:18--------d-----w-c:\users\Nas\AppData\Roaming\Download Manager
2011-10-24 20:52 . 2011-10-24 20:52--------d-----w-c:\users\Nas\AppData\Local\Facebook
2011-10-22 05:36 . 2011-10-22 05:36--------d-----w-c:\program files (x86)\Visicom Media
2011-10-19 04:30 . 2011-10-19 04:30--------d-----w-c:\program files (x86)\SubtitlesSynch
2011-10-16 04:26 . 2011-10-16 04:26--------d-----w-c:\program files\CCleaner
2011-10-15 04:54 . 2011-10-15 04:54321856----a-w-c:\windows\SysWow64\nvStreaming.exe
2011-10-13 19:52 . 2011-10-13 19:52--------d-----w-c:\users\Nas\AppData\Roaming\Template
2011-10-13 01:06 . 2011-09-06 03:033138048----a-w-c:\windows\system32\win32k.sys
2011-10-13 01:06 . 2011-08-17 05:26613888----a-w-c:\windows\system32\psisdecd.dll
2011-10-13 01:06 . 2011-08-17 04:1975776----a-w-c:\windows\SysWow64\psisrndr.ax
2011-10-13 01:06 . 2011-08-17 04:24465408----a-w-c:\windows\SysWow64\psisdecd.dll
2011-10-13 01:06 . 2011-08-17 05:25108032----a-w-c:\windows\system32\psisrndr.ax
2011-10-13 01:06 . 2011-08-27 05:37331776----a-w-c:\windows\system32\oleacc.dll
2011-10-13 01:06 . 2011-08-27 04:26233472----a-w-c:\windows\SysWow64\oleacc.dll
2011-10-13 01:06 . 2011-08-27 05:37861696----a-w-c:\windows\system32\oleaut32.dll
2011-10-13 01:06 . 2011-08-27 04:26571904----a-w-c:\windows\SysWow64\oleaut32.dll
2011-10-11 18:46 . 2010-11-30 15:43601424------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-10-11 18:45 . 2011-10-11 18:45917840------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{868B6634-68E0-4C71-AC68-723CB703D751}\gapaengine.dll
2011-10-10 15:09 . 2011-10-10 15:094550304----a-w-c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2011-09-28 23:30 . 2011-09-28 23:30--------d-----w-c:\program files (x86)\HyperCam 2
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-28 17:09 . 2010-04-24 21:1545056----a-w-c:\windows\system32\acovcnt.exe
2011-10-28 06:38 . 2010-07-09 18:58472808----a-w-c:\windows\SysWow64\deployJava1.dll
2011-10-15 08:53 . 2009-10-03 20:021640768----a-w-c:\windows\system32\nvvsvc.exe
2011-10-15 08:53 . 2009-10-03 20:01539456----a-w-c:\windows\system32\nvhotkey.dll
2011-10-15 08:53 . 2009-10-03 20:015067584----a-w-c:\windows\system32\nvsvc64.dll
2011-10-15 08:53 . 2009-10-03 20:013074368----a-w-c:\windows\system32\nvsvcr.dll
2011-10-15 08:53 . 2009-10-03 20:01222528----a-w-c:\windows\system32\nvmctray.dll
2011-10-15 08:53 . 2009-10-03 20:01137536----a-w-c:\windows\system32\nvshext.dll
2011-10-15 08:53 . 2009-10-03 20:0110406208----a-w-c:\windows\system32\nvcpl.dll
2011-10-15 08:53 . 2009-10-03 14:322808128----a-w-c:\windows\system32\nvapi64.dll
2011-10-15 08:53 . 2009-10-03 14:3213205312----a-w-c:\windows\SysWow64\nvd3dum.dll
2011-10-07 04:16 . 2011-09-14 22:178570192----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-09-14 17:09 . 2009-07-14 02:36152576----a-w-c:\windows\SysWow64\msclmd.dll
2011-09-14 17:09 . 2009-07-14 02:36175616----a-w-c:\windows\system32\msclmd.dll
2011-08-31 21:00 . 2010-12-16 05:5425416----a-w-c:\windows\system32\drivers\mbam.sys
2011-08-12 04:10 . 2011-09-13 14:588862544----a-w-c:\programdata\Microsoft\Windows Defender\Definition Updates\{BD9A08B0-0935-49CB-856B-DB9FEFBA5F11}\mpengine.dll
2011-08-10 02:15 . 2011-08-10 02:1574752----a-w-c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-08-10 02:15 . 2011-08-10 02:15161792----a-w-c:\windows\SysWow64\msls31.dll
2011-08-10 02:15 . 2011-08-10 02:15110592----a-w-c:\windows\SysWow64\IEAdvpack.dll
2011-08-10 02:15 . 2011-08-10 02:1576800----a-w-c:\windows\SysWow64\SetIEInstalledDate.exe
2011-08-10 02:15 . 2011-08-10 02:1548640----a-w-c:\windows\SysWow64\mshtmler.dll
2011-08-10 02:15 . 2011-08-10 02:1586528----a-w-c:\windows\SysWow64\iesysprep.dll
2011-08-10 02:15 . 2011-08-10 02:1563488----a-w-c:\windows\SysWow64\tdc.ocx
2011-08-10 02:15 . 2011-08-10 02:15367104----a-w-c:\windows\SysWow64\html.iec
2011-08-10 02:15 . 2011-08-10 02:1574752----a-w-c:\windows\SysWow64\iesetup.dll
2011-08-10 02:15 . 2011-08-10 02:1523552----a-w-c:\windows\SysWow64\licmgr10.dll
2011-08-10 02:15 . 2011-08-10 02:15152064----a-w-c:\windows\SysWow64\wextract.exe
2011-08-10 02:15 . 2011-08-10 02:15150528----a-w-c:\windows\SysWow64\iexpress.exe
2011-08-10 02:15 . 2011-08-10 02:151427456----a-w-c:\windows\SysWow64\inetcpl.cpl
2011-08-10 02:15 . 2011-08-10 02:15420864----a-w-c:\windows\SysWow64\vbscript.dll
2011-08-10 02:15 . 2011-08-10 02:1535840----a-w-c:\windows\SysWow64\imgutil.dll
2011-08-10 02:15 . 2011-08-10 02:15142848----a-w-c:\windows\SysWow64\ieUnatt.exe
2011-08-10 02:15 . 2011-08-10 02:1511776----a-w-c:\windows\SysWow64\mshta.exe
2011-08-10 02:15 . 2011-08-10 02:15101888----a-w-c:\windows\SysWow64\admparse.dll
2011-08-10 02:15 . 2011-08-10 02:1589088----a-w-c:\windows\system32\RegisterIEPKEYs.exe
2011-08-10 02:15 . 2011-08-10 02:15222208----a-w-c:\windows\system32\msls31.dll
2011-08-10 02:15 . 2011-08-10 02:15173056----a-w-c:\windows\system32\ieUnatt.exe
2011-08-10 02:15 . 2011-08-10 02:1512288----a-w-c:\windows\system32\mshta.exe
2011-08-10 02:15 . 2011-08-10 02:15114176----a-w-c:\windows\system32\admparse.dll
2011-08-10 02:15 . 2011-08-10 02:1591648----a-w-c:\windows\system32\SetIEInstalledDate.exe
2011-08-10 02:15 . 2011-08-10 02:1549664----a-w-c:\windows\system32\imgutil.dll
2011-08-10 02:15 . 2011-08-10 02:1548640----a-w-c:\windows\system32\mshtmler.dll
2011-08-10 02:15 . 2011-08-10 02:15135168----a-w-c:\windows\system32\IEAdvpack.dll
2011-08-10 02:15 . 2011-08-10 02:15111616----a-w-c:\windows\system32\iesysprep.dll
2011-08-10 02:15 . 2011-08-10 02:1576800----a-w-c:\windows\system32\tdc.ocx
2011-08-10 02:15 . 2011-08-10 02:1585504----a-w-c:\windows\system32\iesetup.dll
2011-08-10 02:15 . 2011-08-10 02:15448512----a-w-c:\windows\system32\html.iec
2011-08-10 02:15 . 2011-08-10 02:1530720----a-w-c:\windows\system32\licmgr10.dll
2011-08-10 02:15 . 2011-08-10 02:151492992----a-w-c:\windows\system32\inetcpl.cpl
2011-08-10 02:15 . 2011-08-10 02:15603648----a-w-c:\windows\system32\vbscript.dll
2011-08-10 02:15 . 2011-08-10 02:15165888----a-w-c:\windows\system32\iexpress.exe
2011-08-10 02:15 . 2011-08-10 02:15160256----a-w-c:\windows\system32\wextract.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08143360----a-w-c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-10-17 5500800]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2009-10-09 6937216]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2009-08-20 170624]
"VolPanel"="c:\program files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" [2008-12-30 237693]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Best Buy Software Installer.lnk - c:\program files\Best Buy Software Installer\Best Buy Software Installer.exe [2009-10-5 1132472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security PackagesREG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-01 136176]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-12-22 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-12-22 79360]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-01 136176]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys

• Tick the box next to YES, I accept the Terms of Use
  
• Click Start
  
• When asked, allow the ActiveX control to install
• Click Start
  
• Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  
• Click Scan (This scan can take several hours, so please be patient)
  
• Once the scan is completed, you may close the window
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  
• Copy and paste that log as a reply to this topic

• Save it to your desktop.
• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
• Double click the setup file to run it.
• Click Next to continue.
• Accept the License agreement and click on next.
• It will, by default, install it to your desktop folder. Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.

• Hidden Startup Objects
• System Memory
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)[/color]

• Then click on Scan at the to right hand Corner.
• It will automatically Neutralize any objects found.
• If some objects are left un-neutralized then click the button that says Neutralize all
• If it says it cannot be neutralized then CHOOSE the delete option when prompted.
• After that is done click on the reports button at the bottom and save it to file name it Kas.
• Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
  
  Note: This tool will self uninstall when you close it so please save the log before closing it.

Actually, the computer run fine, and there is no visible sign of infection.

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

Do I absolutely have to uninstall combofix?

And after I run all of that... I'm done with this laptop?
there is no need of any log posting?

My friend has just rung and she is really spooked. She was sending an email off to someone, finished that, then a big square came up on the screen. A voice actually spoke and said 'Your computer is not protected. To fix this problem go to LINK removedand disappeared! Has anyone heard of this happening? Should she be really concerned (which she is)?[/color]Probably not a GOOD idea to leave that link there.
Good idea! I have asked to have the link REMOVED, but hope the query will stay there.If my computer started talking to me, I'd either run a virus scanner or see a doctor. Your friend should start a NEW thread on this site and run a few scans just to make sure.Aha! I have discovered the method. It is an automated Skype call, see link (not dangerous) http://nakedsecurity.sophos.com/2011/09/19/automated-skype-calls-spread-fake-anti-virus-warning-video/ ....n it happening on a You Tube clip. At least it's not a virus.... or seems so. Any time you get a message like "'Your computer is not protected." and it directs you to a link you can be almost 100% sure there some MALWARE involved.No, it seemed to be computer protection software. Just a sales pitch.Quote

Just a sales pitch

I do not KNOW who in my family put this program on our desktop (hp windows vista)
but I did LOOK up what files are in it and wow takes up a lot of space, I don't know how to get it all off. I tried uninstalling it.
There are so many files and some show up as windows this and that.
What is this? and how can I get rid of it safely?

thanks
Can you SEE it in Start, All Programs. Sometimes they have their own uninstaller. It was probably loaded with some other SOFTWARE.

Hello,

My problem with laptop acer aspire M is kinda weird. I took the comp from my gf (idk how many days she didnt shutdown it, even weeks or months) and i shutdownit then a few hours later i lunched it and computer started to work slowly. But its unreal slow, its hard to open any FILE, even cmd but SOMETIMES its like he wake up and starting work normally. I tried everything what i know. I cant just format and install windows 7 again COS theres no partition recovery and i don't have recovery disks, also theres a lot of important data.

What i already discovered:
- explorer.exe randomly stopping work
- most ussage is dwm.exe ( i shutdown it and STILL problem)
- sometimes theres icon with information "intel rst stopped working" and computer then working normally. Rst is Intel Rapid Storage Technology, i tried to shutdown it in mscofing on start but theres still problem.
- temperature of ram and processor are OK (max 5-30%).
- if comp working normally (1-2mins) and i open anything like chrome+youtube its like something start work in background and slow him, if i watch hd video then every few seconds my mouse frozen for a 0,5sek or something and i hear that the music in speakers crash.

What i already done:
-scanned by avira
-scanned by malwarebytes
-scanned by hijackthis (adding logs)
-scanned by securitycheck (adding logs)
-scanned by adwclear
-used ccleaner
-scanned by hdtune (adding photos cos i cant make printscrean on deadcomp)
-tryied to find anything in autorunsc microsoft tool that i downloaded but shiet

Please find any way to help me bros!

[attachment deleted by admin to conserve space]Looks like that HDD is on it's last legs...

Pull it out of there and connect it as a slave to a working PC to retrieve any important data...

I need to install an antivirus on a laptop that does not have INTERNET CONNECTION. I need to transfer this file to it via pen drive.

I have tried various antiviruses like Avast, Bitdefender but these require internet connection during installation. What can I do?If it doesn't have internet connection you shouldn't need an AV. Do you intend to go on-line after the AV is installed? What OS is on that computer?Most, if not all antivirus producers make offline installers available, for EXAMPLE

Avast:
https://www.avast.com/download-software

Bitdefender:
http://www.bitdefender.co.uk/support/how-to-install-bitdefender-2015-using-the-offline-installation-kit-1330.html

Eset:
http://support.eset.com/kb2885/?locale=en_US

Google "product name offline antivirus installer", to find others, but be aware it is safest to get these things direct from the app official website.

Save offline installer to a pen drive or burn to a CD-ROM or DVD-ROM to install on offline machine.



^Yes you're RIGHT, after this starting this thread I immediately tried GOOGLING one and found Avast on FileHippo.

Thanks

Can anyone help me get this fecking ReImage MONSTER off my PC !!
It has completely taken over our PC and even prevents us from talking via Skype to our son in Florida .

ReImage seems to grow , very fittingly , like a CANCER !!

It can't be removed using the usual route of program removal as it doesn't even seem to exist according to the PC searches . Even when I TRY finding programs to try off the HippoDownload site it ReImage somehow BLOCKS every attempt to search for a fix .... It just keeps opening LOADS of different Windows until the PC CRASHES or freezes ...


Can someone please HELP and send me a PM with some advice ?
https://malwaretips.com/blogs/remove-reimage-repair/Thanks . I'll give it a try but everything I try to load up or install is immediately taken over by ReImage.

I have no idea how they're allowed to do this to our PCs . ... If they had a local branch office I'd be in there causing some serious restructuring of their building !Thanks, Allan. Zincubus, you may have to do the uninstall in Safe Mode.Ah ... I'll try that tomorrow if I get chance ... I tried downloading the adwCleaner program but the PC froze as I CLICKED on the link and restarted .

I actually think the ReImage software has evolved and improved since the days of the advice threads I've been directed to by your fellow forum users .I've tried downloading Hitman pro and CWD CLEANER but ReImage prevents the PC from downloading / installing either /both programs by opening new windows advertising ReImage software options and then FREEZES the PC completely and then restarts the computer !!!Download them on another computer and transfer them to the infected computer.

Hi, I have a dell notebook with Windows 7 Ultimate. Its infected with a virus whic has shut down the firewall and all anti virus programs. the D drive showed 0 files/empty, but when i tried to scan the drive, it was full.
The D drive is HIDDEN, now I CANT even get it to BOOT = just a black screen. I cant even get it to boot from an external drive using USB port! Help, PLEASE...
Thanks!
JMDid you TRY booting in Safe Mode?

Quote

I apologise for taking up your time.

[.ShellClassInfo]
[emailprotected]%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183

[.ShellClassInfo]
[emailprotected]%SystemRoot%\system32\shell32.dll,-21799

Above are the two ini files on my desktop (called desktop.ini)

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create Registry backup
• Purge System Restore Points
• Re-set system settings

Click Start> Computer> right click the C Drive and choose Properties> enter
Click Disk Cleanup from there.

Click OK on the Disk Cleanup Screen.
Click Yes on the Confirmation screen.

my inbox has a message about MB's. emergency update concerning a threat, & they SUGGEST new installs for protection. Is this real, or a scam ? do the suggested updates COST anything ?SOUNDS like a scam. Rule of thumb is if any E-mail gives you a link and TRIES to get you to go to it, it is a scam.

I have recently installed Malwarebytes and ran a couple of scans with it last NIGHT. It has only found two PUPs (That I qurantined) and nothing else so nothing really serious. I try to BROWSE with Firefox this morning and I recieved this page.

https://www.malwarebytes.org/restorebrowser/index.html?gd=&ctid=CT3319613&octid=EB_ORIGINAL_CTID&ISID=MAD8C5E6E-38AD-43F4-8882-886428E16D57&SearchSource=55&CUI=&UM=5&UP=SP6F33A9C3-4797-4240-8BB9-45CB8480CBC0&SSPV=

It tells me that I potentially have infections on my browser that has made changes to my system. It has given me instructions on manually altering them but I decided it would be better to seek advice from more experienced users here who may interpert these instructions better than me and know what to do.

Is this something I should not ignore? If not, what would occur if I decide to let these potential infections in my Firefox browser stay?

What other browsers do yhoou have? Do they work?
Iff you install FireFox again, it should save your settings.I have no other browsers on this PC. I do have a laptop that has both Firefox and Google Chrome but I do not use that one as much as this PC.

Do you reccomend uninstalling and then a re-install? Since you posted in our malware forum I suggest you ignore advice from anyone except Super Dave, our malware specialist.Ok. Should I PM him?No, you should wait until he responds.You can EITHER FOLLOW the advice or uninstall and re-install FF. It was just a warning that the infections may have altered the settings in FF.Ok thanks.Let me know if you have more problems.

You're welcome. I will LOCK this THREAD. If you NEED it re-opened, PLEASE send me a pm.

Dell desktop PC running Windows 8.1 with malwarebytes.

My free Mcafee virus protection is about to run out, has anyone got a link to a decent free virus protection.

Many THANKS.Windows 8.1 comes with its own AV called Windows Defender. Just uninstall McAfee and enable WD and you're good to go.Cheers for speedy reply, all done and SORTED, is there any other protection worth downloading to run along side it or should that be ok. Thanks,You can INSTALL MalwareBytes from here. There is a free trial period which enables MBAM to ACTIVELY scan your computer full-time. After the trial period is over you will need to scan your computer periodically.

Hi I bought a cheap RCA appolo 2 in 1 to use for small time things, t caught a nasty virus and won't work anymore. So I let it sit, until my vaio got broken last NIGHT. Now I need some help with RCA tablet/laptop. I don't remember what virus it had but this is where I'm at, all the help I got online FAILED and it got to the point I turned it off once and when I booted it back up it gives me a blank black screen after the logo. Now if I touch the screen or move the mouse you can see the clicker with an HOURGLASS next to it so stuff is happening there for sure. But nothing else. So I tried to reset it, and then to totally reset it. It works to almost the end and then gives me and error saying it can't be reset. I had never made a save point on it either so I can't load it back to a previous point. Can anyone help me with this?? Please. Can you boot in Safe Mode?I deleted my post. Sorry.Quote from: Geek-9pm on MAY 31, 2016, 05:07:36 PM

I deleted my post. Sorry.

I received a phone call today (same type of call as a couple of months ago) from someone claiming that Microsoft has been receiving several error reports from my computer. He guided me to my event viewer log to show me the errors etc. 2853 of them as you can see in the attached screen shot. Then he guided me to:

https://secure.logmeinrescue.com/Customer/Code.aspx

Then he asked me to enter a 6 digit code into the box and I refused, then hung the phone up.

This just smells fishy to me. Could this be legit or some scammer trying to gain ACCESS to my computer?

Funny thing is that I got this same type call (even from the same person I believe) a couple of months ago when I was running Windows 7. I have since upgraded to Win 10 with no problems.

And if this is legit, then how do I prevent all these errors being created and sent to Microsoft?

As always, thanks for any help.

Mike



[attachment deleted by admin to conserve space]Also my CALLER ID reports this call as being an individual (name is displayed) in 443 area code. I have the full name and number if needed.It is a scam. They know nothing about your system and they aren't Microsoft. The events are standard log MESSAGES written by MANY Windows components. The scam involves installing malware onto your system (backdoor remote-access trojans, I presume) in order to (presumably, again) get details like your bank information by looking through the data on your PC. Your phone number wouldn't be in the error reports! That's what I expected and I'm glad I didn't bite the bait. But I'm sure there are others that will. I've got this caller ID information so should I report it, and if so how / where?

Thanks BC!This is a really well known scam. The callers use random dialling systems. The caller doesn't know you or your computer. There is no point in reporting it to anyone. The call centre is in India or the Philippines. Nobody will do anything.Area code 443 is from the Maryland state but it most CERTAINLY is a scam.The scammers often use caller ID spoofing so the victim sees an area code in their own country.

So I believe I cleared it all out because the internet is the only issue so maybe the damage was left over. I can only RUN the internet on the Tor BROWSER now. When I tried mini TOOLBOX it says this
"the procedure entry point DnsGetPolicyTableInfo could not be located in the dynamic link library C:/Windows/SYSTEM32/NETIOHLP.DLL"
"the procedure entry point DNSResolverOp could not be located in the dynamic link library C:\Windows\SysWOW64\ipconfig.exe"

I tried disabling the connection and reenabling it. I also tried reinstalling the NETWORK drivers.

I want to avoid refreshing/reseting my computer if I can..partly to be more an advanced user as I'm always LOOKING to learn new things on the computer and also because it's a complete pain to reinstall everything
What was your initial problem?

Zone Alarm SECURITY suite works on my XP PC right now, but will not work with my Vista PC even if it says Vista ready. Does that mean that I NEED to upgrade to Home Premium or ULTIMATE Vista maybe ? I talked to ZA. support they said to DOWNLOAD their lasted updated version which I did , but got the same results. I all ready bought this second archive ZA. version, so it would be great to get it run like my other XP ZA version running now If you can't get it to work on Vista you could always download and install MicroSoft Security Essentials ( below) It's free and very good. It's all I use on all my computers.
MicroSoft Security Essentials All versions and all LANGUAGES.

Just sharing this here to bring to the attention of all. I suspect the attachment has a payload to it to infect Firefox or the system as a whole, notice the URL and patch are not from Mozilla but instead eekumyoutube ( dot ) org. I was at Wowhead looking up a Reins of the swift Spectral Tiger Mount when all of a sudden one of the ads in the corner of wowhead took over and brought me to what you see in this screenshot. This is the first time ever i have seen Firefox targeted to try to trick someone into running a so called "patch". System I am on has no infections. AVG is clean and Malwarebytes shows clean to, so thats why I am thinking there is a rogue ad associated with wowheads website that trying to get people to click and infect themselves if on firefox. Perhaps this phishing is using the browser detection script in which depending on browser they have a number of different payloads to infect you with.

I took a break from programming in C++ and checked out FACEBOOK and then saw this that caught my attention and then the ultra rare mount I decided to look up and then thats when I got hit with this redirect from wowhead. This link here is the article that I was checking out which was kind of interesting. http://www.gamespot.com/gallery/15-crazy-world-of-warcraft-facts-that-will-impress/2900-678/?ftag=ACQa2186e3&vndid=1852765721&ttag=gs-fb-834&nan_pid=1852765721

Decided to go back to this URL path to see if I can look further into it and its now hidden as if its a 1 time shot, dynamic URL path link, 1 time try to infect and then kill the path possibly to hide its rogue intentions of this website. Interesting! Second screenshot shows me trying to get back to it to poke AROUND and its gone.




[attachment deleted by admin to conserve space]This is the type of stuff that IMO makes using adblock/uBlock worth violating the implicit social contracts of website advertisements.Another attempt to infect me. This came thru from facebook. This time I wanted to see what the payload was and so I agreed to download it, but I didnt run it. I then ran virus scan with AVG on it as well as malwarebytes and it says the file is safe. NICE!!! Not going to run that EXE because I know better, but its flying under the radar of antivirus as well as malwarebytes in patch EXE form. Perhaps once it infects it would then detect it. Not going to run it to find out.

More screenshots and different site with same type of emergency patch junk. This time I viewer the HTML source to see what additional is going on with it. A browser detect is present as seen in source to page.

Note: File size 338k from other site and 482k from this one...

[attachment deleted by admin to conserve space]Opened up the EXE in a hex editor to see whats inside without running using FlexHex.

Screenshots of some of its intent. If anyone wants the Hex dump to dig into I have a 15MB PDF of it too. Just saying in CASE anyone out that is interested in this sort of thing.

[attachment deleted by admin to conserve space]pic 2 of hex

[attachment deleted by admin to conserve space]last pic of SECTION of hex that caught my attention.

[attachment deleted by admin to conserve space]putting in the same URLs, I can't get the page to load at all. First site is gone now entirely and the second one is only a blank page.

I'd be surprised of the program wasn't a .NET Executable. It seems oddly common to use a .NET program for this sort of thing.

It's actually quite common to post such programs as "tools" or "utilities" on game forums. It's common for Minecraft, for example, a user will post tools claiming to give the person full admin access to any server, for example, then steal private information. The fun part is that since they are .NET they are fairly easy to decompile; and while the more clever ones will encrypt the password it's dead-simple to just remove the decryptor and run it separate from the malicious software to get things like E-mail passwords, as they need to have SMTP passwords in the file to send their sweet sweet private info to. In one case the user had even used their own personal E-mail, (connected to paypal, amazon, Steam, Facebook, etc.) so I went ahead and E-mailed his family members from his account confessing some rather questionable feelings. Let's just say things must have been VERY awkward between himself and his sister for a while. Quote

In one case the user had even used their own personal E-mail, (connected to paypal, amazon, Steam, Facebook, etc.) so I went ahead and E-mailed his family members from his account confessing some rather questionable feelings.

Laughing so hard, but yes in order to authenticate the info would be in the source. Shaking my head why they didnt just use an alias to stay hidden. Although to have an alias paypal I suppose they would have had to have had a stolen identity or some means of creating a alias that appears to be a real person with the rabbit hole going deeper into someone opening an account with a bank with fake id / stolen identity etc.

Does .Net hide better against antimalware and antivirus's?

Maybe I'm wrong, but I thought the basis of .Net was to make for better healthier programs that wont BSOD systems etc. Memory managements and tighter execution layer controls etc. So I always thought that if you want to make a program that is going to be naughty it was best to code it up in something that wasnt based around .Net that more readily would allow for you to target memory addresses outside of where the program should be operating etc and overflow conditions etc.

How can I DELETE IE webrep loader I have tried a lot from the WEB and NONE of them seem to work.What are you using for AV?
I'm using avast, I think that's where it came from.Quote from: harry 48 on July 19, 2016, 02:08:03 PM

I'm using avast, I think that's where it came from.

I have been having problems with ONLINE shopping. The last TWO orders I placed never arrived at the mail. After that I got a totally random audio message telling me to call the phone number provided and not to shop online until I did. This was while visiting a PORNOGRAPHY website.You could try calling the number but do not GIVE them any personal information. If it is legit they should already have all the information. You should also contact the company where you placed your purchases and INQUIRE about your orders.

I cannot enter to some websites except FACEBOOK and Google websites etc. But it normal when I using internet with my other DEVICES in same 4G wifi router. Do you think that it is a malware issue? PPZ help me to fix this.Your post is not clear.

1) Are you saying you can ONLY get into Facebook and Google?

2) What do you mean by "other devices"?

3) What happens when you try other sites?

4) Have you tried another browser?

5) What is new or different since the last time everything worked properly (ie, new hw, new sw, virus, error, etc)?

You need to provide as much INFORMATION as possible before we can offer intelligent assistance.

The problem now is - I am in the middle of a newsletter done on publisher 2003, if I try to open it in publisher 2010 it is not up to DATE - in fact none of my 2003 newsletter will open now it is not installed. Hmmm. What to do - the newsletter is DUE to go out today or tomorrow Ok, good luck with that.Strange things happen, after I re-installed M/Soft Professional 2003, I then re-installed it, and all the problems vanished.

The one thing that bugs me, is I can't EASILY find M/S Outlook Publisher 2003. By searching, it is in c: ProgramData-Microsoft-Windows-Start Menu- Programs-0Microsoft Office - Publisher 2003 - but once I shut the search - I can't find it anywhere - ProgramData is not shown for some reason. When I try to open the newsletter, it automatically opens in 2010 Publisher, but tells me to browse for what I want - and that's when I cant find the above thread (c: ProgramData-Microsoft-Windows-Start Menu- Programs-0Microsoft Office - Publisher 2003)

If you could please tell me how to locate it to make it my preferred program, I would be very grateful. Other than that, consider the thread CLOSED, and many thanks for your help. (DAVE)Is it not in All Programs?Thanks, I've found a way around it now, longer, from All Programs.

Can you close this thread now and thanks again for your help.You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.

I wanted to tell Allan just how wonderful his help was.
My computer is running like new and my printer is working again.
I know I am suppose to post this on the 'end' of my THREAD ; but I can't find it...
So THANKS ALLAN I feel almost so grateful I thought of SENDING money; almost...
And the teck that I got when I called abouit Malware Bytes, said I should THROW my puter out...
THANKS again,
Ivan CopasFor the future with help finding a thread, click the PROFILE link.
Under your profile picture you will see Show POSTS. The newest post is at the top.All I did was point you in the right direction, but you're welcome.

I have been using WINDOWS live mail for a long time.
Will I be forced to learn another?
Mine won't work all of a sudden. Help!

CopasWell, I think mine still works. In fact our family has two accounts. But MS has combined some services and it may look DIFFERENT. Notices the attachment.
I tried to sign in to www.live.com and it decided to LOG me into the Hotmail account. (attachment below.)


[attachment deleted by admin to conserve space]Mine started working; but it may be spoofing me. I open my mail with a quick launch and when it wouldn't open the first time I opened a copy of yahoo mail so I may have conmfused myself.
Now when it opens it looks like my old Windows mail.
Don't PAY too much attention to me; i'm easily conmfused...
Cheers,
CopasQuote

Don't pay too much attention to me; i'm easily conmfused...

Let's say that you have a computer that is hiding behind a dedicated TOR Ethernet hotspot.

So let's assume the computer got hacked by web browser exploit.

So it is hacked, but it is still connected via a Tor Ethernet.

Therefore, the hacker can see WHAT you are doing, but not WHO you are, i.e. your real IP.

So... I want to operate in this environment.

What kinds of things would I do to stop this laptop from being tied to me..?

I will give you a LIST of things I thought of... I would like you to add to this list or correct anything I got wrong.

1. Laptop manufacturer

2. System spec

3. Wipe/re-install the BIOS and HDD from any previous attacks

4. Lists of programs installed. Perhaps only install a web browser and nothing else

5. Don't visit sites in your ordinary BROWSING routine on clearnet

6. Typing style / speed / vocabulary / language / typos, i.e. forensic linguistics

7. Time of the day that you use the computer.. clock on the machine..

8. Physically remove the webcam, mic

9. Physically remove the WiFi chip, so it can't scan for nearby networks and devices. So the only connection is directly by Ethernet to the Tor hotspot

10. Don't type your real name, or LOG into any accounts tied to your real name.

What do you think..?I read this as:

Quote

Let's say that you have a computer that is hiding behind a dedicated Tor Ethernet hotspot.

So let's assume the computer got hacked by web browser exploit say I put remote software on this system for remote control from elsewhere

So it is hacked, but it is still connected via a Tor Ethernet.

Therefore, the hacker can see WHAT you are doing, but not WHO you are, i.e. your real IP.

So... I want to operate in this environment.

What kinds of things would I do to stop this laptop from being tied to me..? I want to do illegal ACTIVITIES but trying to hide this in a question that maybe someone will answer and help me hide myself when I illegally do something.

I will give you a list of things I thought of... I would like you to add to this list or correct anything I got wrong. Help me perfect my ways of hiding my illegal behavior.

1. Laptop manufacturer

2. System spec

3. Wipe/re-install the BIOS and HDD from any previous attacks

4. Lists of programs installed. Perhaps only install a web browser and nothing else

5. Don't visit sites in your ordinary browsing routine on clearnet

6. Typing style / speed / vocabulary / language / typos, i.e. forensic linguistics

7. Time of the day that you use the computer.. clock on the machine..

8. Physically remove the webcam, mic

9. Physically remove the WiFi chip, so it can't scan for nearby networks and devices. So the only connection is directly by Ethernet to the Tor hotspot

10. Don't type your real name, or log into any accounts tied to your real name.

What do you think..?

I have tried ccleaner, adware cleaner, superantispyware, malwarebytes but it's still here/ where did it come from.

[attachment deleted by admin to conserve space]What do you mean" cannot get rid of it? What happens when you click "Don't allow" ?Theres a SQUARE you tick which says don't show this again but it makes no difference still pops up.

I ran all above no good and I cannot find it anywhere in the pc.Your comment has been removed. Please do not post malware advice, or post here in the malware forum, unless you need help.SUPERDAVE.It's goneThere now, that wasn't so hard. See you Harry.
Quote from: SuperDave on September 28, 2016, 05:15:04 PM

There now, that wasn't so hard. See you Harry.

That's why your a genius

As the man said " i'll be back "

It's great, I'm fully retired now and enjoying it, how's life in Briton's colony

ppData\Roaming\Kingsoft\office6\update\down\wpsupdate.exea variant of Win32/KingSoft.D potentially unwanted applicationcleaned by deleting
C:\Users\Owner\Documents\FILMS\ParaNorman.2012.720p.BRRip.x264.AAC.DiVERSiTY\FFSetup3.9.5.0.exea variant of Win32/FusionCore.I potentially unwanted applicationdeleted
E:\AdwCleaner\Quarantine\C\Program Files (x86)\GetPrivate\gpup.exe.vira variant of Win32/Techsnab.B potentially unwanted applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Program Files (x86)\GetPrivate\tasks.dll.vira variant of Win32/Tasks.A potentially unwanted applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProUninstaller.exe.vira variant of Win32/Adware.SpeedingUpMyPC.AL applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Users\Frank\AppData\Local\GCC\Modules\InSes.dll.virWin32/GigaClicks.AM potentially unwanted applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Users\Frank\AppData\Local\simple_new_tab\simple_new_tab.dll.virWin32/AdWare.Snoozer.A applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Users\Frank\AppData\Local\Temp\OCS\ocs_v71a.exe.vira variant of Win32/DownloadSponsor.A potentially unwanted applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Users\Frank\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl\minibarchrome.exe.vira variant of Win32/Toolbar.Iminent.O potentially unwanted applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Users\Frank\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.virWin32/Systweak.G potentially unwanted applicationdeleted
E:\AdwCleaner\Quarantine\C\Users\frank-pc\AppData\Roaming\GetPrivate\gp_upd.exe.vira variant of Win32/Techsnab.B potentially unwanted applicationcleaned by deleting
E:\AdwCleaner\Quarantine\C\Users\frank-pc\AppData\Roaming\GetPrivate\tasks.dll.vira variant of Win32/Tasks.A potentially unwanted applicationcleaned by deleting
Please give me a update on how your computer's working now.Morning Dave I think you have cracked it whatever you have done, my computer seems to be running far BETTER. the trouble I was having with Bit defender
keep popping up and not being able to uninstall it. seems to have disappeared, so everything working ok .I am not sure about what antivirus to use though ,is windows defender enough. anyway you have done your job (as usual)

Thanks once again Dave you saved me again (bet your glad to se the back of me). Have a good day.Quote

is windows defender enough.

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create Registry backup
• Purge System Restore Points
• Re-set system settings