Solved Broni: Please review these post-cleanup, Spymaxx logs!

drwizgeek · Sep 30, 2010

Hello Broni:

I cleaned up this infection on this HP Pavilion ZE2000 a few months ago. But, you did such an excellent job directing our last cleanup (techspot.com/vb/topic152066.html) that I decided to apply your "UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions" (techspot.com/vb/topic58138.html) to this laptop again.

Here are the logs for Malwarebytes Anti-Malware, GMER (will be posted later tonight), and DDS, plus the zipped Attach.txt file, as instructed:

Apparently I forgot to post these logs before leaving town. Rest assured that this laptop was just sitting on my desk and nothing has changed on it since then. I would appreciate it if you could review these logs so that we could remove all the leftover items and "free loaders" (I see quite a few issues, e.g. shopperreports.com). I thank you all in advance.

Best regards,
Wiz
_______________________
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4636

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

9/17/2010 12:50:57 AM
mbam-log-2010-09-17 (00-50-57).txt

Scan type: Full scan (C:\|)
Objects scanned: 254594
Time elapsed: 1 hour(s), 34 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
________________________

DDS (Ver_10-03-17.01) - NTFSx86
Run by troubleshooter at 20:00:52.89 on Sat 09/18/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.184 [GMT -7:00]

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\vsnpstd2.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\troubleshooter\fall10\troubleshooting\security_sw_aug_10\dds.scr

============== Pseudo HJT Report ===============

uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58:29&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
mWinlogon: SFCDisable=4 (0x4)
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3"
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SNPSTD2] c:\windows\vsnpstd2.exe
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [SynTPStart] c:\program files\synaptics\syntp\SynTPStart.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min /ns
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226710311859
DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\troubl~1\applic~1\mozilla\firefox\profiles\euyovg51.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-9-5 64288]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-8-28 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-8-28 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-8-28 267432]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-8-28 60936]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2004-12-15 231424]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-6-21 1355928]

=============== Created Last 30 ================

2010-09-14 04:52:47 0 d-----w- c:\windows\system32\NtmsData
2010-09-06 08:00:44 0 d-----w- c:\windows\system32\Adobe
2010-09-06 03:14:30 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
2010-09-06 03:00:41 0 d-----w- c:\program files\CCleaner
2010-09-05 22:44:29 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-05 22:44:28 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-05 21:02:27 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-09-05 21:02:11 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-09-05 20:49:38 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
2010-09-05 20:47:23 0 d-----w- c:\program files\Lavasoft
2010-09-05 20:16:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-05 20:16:15 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-05 20:16:14 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-31 04:31:07 0 d-----w- c:\docume~1\troubl~1\applic~1\Avira
2010-08-28 23:33:54 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-08-28 23:33:46 0 d-----w- c:\program files\Avira
2010-08-28 23:33:46 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2010-08-22 23:39:15 1089601 ------w- c:\windows\system32\dllcache\ntprint.cat
2010-08-22 18:25:39 0 d-----w- C:\9b7c9b801108a1a6247ab5c9
2010-08-22 18:24:07 0 d-----w- c:\windows\SxsCaPendDel

==================== Find3M ====================

============= FINISH: 20:02:20.65 ===============
___________________
GMER log will be posted later tonight; I don't have it with me at this workstation.

Broni · Sep 30, 2010

Thank you for kudos

Please, never zip any logs.

I'll be waiting for your GMER scan....

drwizgeek · Oct 1, 2010

Hello Broni:

Thanks for your prompt response. DDS instructions were to zip and attach its "attach.txt" file instead of posting it. Here is the GMER log:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-17 23:05:06
Windows 5.1.2600 Service Pack 2
Running: n5smmqiu.exe; Driver: C:\DOCUME~1\TROUBL~1\LOCALS~1\Temp\kflyqaow.sys

---- System - GMER 1.0.15 ----

SSDT F7D39FC6 ZwCreateKey
SSDT F7D39FBC ZwCreateThread
SSDT F7D39FCB ZwDeleteKey
SSDT F7D39FD5 ZwDeleteValueKey
SSDT F7D39FDA ZwLoadKey
SSDT F7D39FA8 ZwOpenProcess
SSDT F7D39FAD ZwOpenThread
SSDT F7D39FE4 ZwReplaceKey
SSDT F7D39FDF ZwRestoreKey
SSDT F7D39FD0 ZwSetValueKey

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)

---- EOF - GMER 1.0.15 ----

I look forward to receiving your advice for a complete cleanup of this laptop with its limited resources. Thank you again!

Broni · Oct 1, 2010

Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

======================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

drwizgeek · Oct 2, 2010

MBRcheck and Combofix Reports, Part 1

Hello Broni:

Thank you very much for your prompt action. Combofix deleted several files and two folders. Here are the MBRcheck and Combofix Reports. We don't need anything from AOL, or any toolbars or updating/IM service from google, yahoo...

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 134):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806CE000 \WINDOWS\system32\hal.dll
0xF7AFC000 \WINDOWS\system32\KDCOM.DLL
0xF7A0C000 \WINDOWS\system32\BOOTVID.dll
0xF74CD000 ACPI.sys
0xF7AFE000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF74BC000 pci.sys
0xF75FC000 isapnp.sys
0xF760C000 ohci1394.sys
0xF761C000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7A10000 compbatt.sys
0xF7A14000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7BC4000 pciide.sys
0xF787C000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7B00000 intelide.sys
0xF7B02000 viaide.sys
0xF7B04000 aliide.sys
0xF749E000 pcmcia.sys
0xF762C000 MountMgr.sys
0xF747F000 ftdisk.sys
0xF7A18000 ACPIEC.sys
0xF7BC5000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7884000 PartMgr.sys
0xF763C000 VolSnap.sys
0xF7467000 atapi.sys
0xF764C000 disk.sys
0xF765C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7447000 fltMgr.sys
0xF7435000 sr.sys
0xF766C000 Lbd.sys
0xF767C000 PxHelp20.sys
0xF741E000 KSecDD.sys
0xF7391000 Ntfs.sys
0xF7364000 NDIS.sys
0xF768C000 serial.sys
0xF7349000 Mup.sys
0xF7AB4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF6A30000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xF62B1000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF629D000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7924000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF627A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF792C000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6A20000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF76BC000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76CC000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6257000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7934000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys
0xF76DC000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF793C000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF6222000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7B1E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7944000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF6208000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0xF60B4000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
0xF605E000 \SystemRoot\system32\drivers\camc6hal.sys
0xF76EC000 \SystemRoot\system32\drivers\camc6aud.sys
0xF603A000 \SystemRoot\system32\drivers\portcls.sys
0xF76FC000 \SystemRoot\system32\drivers\drmk.sys
0xF6001000 \SystemRoot\system32\DRIVERS\HSFHWATI.sys
0xF5F04000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
0xF5E54000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xF794C000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7AE0000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF7BC7000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF770C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7AE4000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF5E3D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF771C000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF772C000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7954000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF5E2C000 \SystemRoot\system32\DRIVERS\psched.sys
0xF773C000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF795C000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7964000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF774C000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7B24000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5DF8000 \SystemRoot\system32\DRIVERS\update.sys
0xF7AF4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF775C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF778C000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B36000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C44000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B38000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7984000 \SystemRoot\System32\drivers\vga.sys
0xF7B3A000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B3C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF798C000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7994000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7AB0000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xED792000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xED73A000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xED712000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF63DB000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xED6F0000 \SystemRoot\System32\drivers\afd.sys
0xF77BC000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF799C000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xED62E000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF79A4000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xED603000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xED594000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF77DC000 \SystemRoot\System32\Drivers\Fips.SYS
0xED573000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF77EC000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF7B3E000 \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
0xF7C75000 \SystemRoot\System32\Drivers\BANTExt.sys
0xED529000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7B4A000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0xF785C000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xED511000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B58000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEDD48000 \SystemRoot\System32\drivers\Dxapi.sys
0xF78AC000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7D52000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF04E000 \SystemRoot\System32\ati2cqag.dll
0xBF080000 \SystemRoot\System32\atikvmag.dll
0xBF0B2000 \SystemRoot\System32\ati3duag.dll
0xBF2E3000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB867B000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xB866B000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB8497000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7B74000 \SystemRoot\System32\Drivers\ASCTRM.SYS
0xB8328000 \SystemRoot\system32\DRIVERS\srv.sys
0xB83EB000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB81FB000 \SystemRoot\system32\drivers\wdmaud.sys
0xB853B000 \SystemRoot\system32\drivers\sysaudio.sys
0xB7AE0000 \SystemRoot\System32\Drivers\HTTP.sys
0xB78FD000 \SystemRoot\system32\drivers\kmixer.sys
0xB7AC8000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 39):
0 System Idle Process
4 System
708 C:\WINDOWS\system32\smss.exe
756 csrss.exe
780 C:\WINDOWS\system32\winlogon.exe
824 C:\WINDOWS\system32\services.exe
844 C:\WINDOWS\system32\lsass.exe
1004 C:\WINDOWS\system32\ati2evxx.exe
1024 C:\WINDOWS\system32\svchost.exe
1124 svchost.exe
1164 C:\WINDOWS\system32\svchost.exe
1232 svchost.exe
1352 svchost.exe
1612 C:\WINDOWS\system32\spoolsv.exe
1656 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1700 svchost.exe
1836 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1872 C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
1892 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
1952 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2012 C:\WINDOWS\system32\HPZipm12.exe
2044 C:\WINDOWS\system32\svchost.exe
420 C:\WINDOWS\system32\ati2evxx.exe
532 C:\WINDOWS\explorer.exe
1796 wmiprvse.exe
208 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
356 C:\WINDOWS\vsnpstd2.exe
416 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
412 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
452 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
628 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
260 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
1752 C:\WINDOWS\system32\ctfmon.exe
2328 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
2688 C:\WINDOWS\system32\wuauclt.exe
2804 C:\Program Files\HPQ\Shared\hpqwmi.exe
2896 alg.exe
2120 C:\WINDOWS\system32\wuauclt.exe
2308 C:\troubleshooter\fall10\troubleshooting\security_sw_aug_10\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK6025GAS, Rev: KA201A

Size Device Name MBR Status
--------------------------------------------
55 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: BBF289AC40BA09F2CC1797655D4799D2AB148CB5

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
_________________________

Continued...

drwizgeek · Oct 2, 2010

MBRcheck and Combofix Reports, Part 2

ComboFix 10-10-01.01 - troubleshooter 10/01/2010 20:59:31.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.174 [GMT -7:00]
Running from: c:\documents and settings\troubleshooter\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\Companion Wizard
c:\program files\RcvSystem
c:\windows\ihghkj.ini
c:\windows\klopru.ini
c:\windows\mainms.vpi
c:\windows\megavid.cdt
c:\windows\muotr.so
c:\windows\system32\stera.log
c:\windows\system32\tmp.reg
c:\windows\vutttv.ini
c:\windows\wacehk.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FOPN
-------\Legacy_MSSECURITY1.209.4

((((((((((((((((((((((((( Files Created from 2010-09-02 to 2010-10-02 )))))))))))))))))))))))))))))))
.

2010-09-14 04:52 . 2010-09-14 04:54 -------- d-----w- c:\windows\system32\NtmsData
2010-09-06 08:00 . 2010-09-06 08:00 -------- d-----w- c:\windows\system32\Adobe
2010-09-06 03:14 . 2008-02-27 21:49 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
2010-09-06 03:02 . 2010-09-06 03:02 388096 ----a-r- c:\documents and settings\troubleshooter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-06 03:00 . 2010-09-06 03:00 -------- d-----w- c:\program files\CCleaner
2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\program files\Common Files\Apple
2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Apple
2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\program files\Apple Software Update
2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-09-05 22:44 . 2010-09-05 22:44 503808 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcp71.dll
2010-09-05 22:44 . 2010-09-05 22:44 499712 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\jmc.dll
2010-09-05 22:44 . 2010-09-05 22:44 61440 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-sse.dll
2010-09-05 22:44 . 2010-09-05 22:44 348160 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcr71.dll
2010-09-05 22:44 . 2010-09-05 22:44 12800 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-d3d.dll
2010-09-05 22:44 . 2010-09-05 22:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-05 21:02 . 2010-09-05 21:02 -------- dc----w- c:\windows\system32\DRVSTORE
2010-09-05 21:02 . 2010-06-21 17:44 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-09-05 21:02 . 2010-09-05 21:02 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-09-05 20:50 . 2010-09-05 20:50 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Sunbelt Software
2010-09-05 20:49 . 2010-06-21 17:52 2978768 -c--a-w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe
2010-09-05 20:49 . 2010-09-05 20:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
2010-09-05 20:47 . 2010-09-05 20:47 -------- d-----w- c:\program files\Lavasoft
2010-09-05 20:38 . 2010-09-20 01:53 63488 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-05 20:38 . 2010-09-05 20:38 52224 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-05 20:38 . 2010-09-20 01:53 117760 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-05 20:16 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-05 20:16 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-05 20:16 . 2010-09-05 20:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-20 01:57 . 2008-11-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-20 01:56 . 2008-11-11 03:26 -------- d-----w- c:\program files\SpywareBlaster
2010-09-06 07:54 . 2005-10-13 23:28 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-06 02:03 . 2008-11-25 07:05 1 ----a-w- c:\documents and settings\troubleshooter\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-05 23:44 . 2006-05-24 00:14 -------- d-----w- c:\program files\QuickTime
2010-09-05 23:43 . 2005-04-29 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-09-05 23:23 . 2005-04-29 12:19 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-05 23:00 . 2005-04-29 12:33 -------- d-----w- c:\program files\Java
2010-09-05 20:37 . 2008-11-11 03:28 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-05 20:36 . 2008-11-11 03:28 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com
2010-08-31 04:31 . 2010-08-31 04:31 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Avira
2010-08-29 02:37 . 2008-11-11 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-29 00:18 . 2008-11-11 03:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\program files\Avira
2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-08-20 15:48 . 2010-08-20 15:48 -------- d-----w- c:\program files\7-Zip
2010-08-10 06:26 . 2010-08-10 06:26 -------- d-----w- c:\program files\Panasonic
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-31 286720]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

c:\documents and settings\Hamid Mirzad\Start Menu\Programs\Startup\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0?????

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 ----a-w- c:\program files\Common Files\AOL\1128995550\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-19 10:41 49152 ----a-w- c:\program files\Hp\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
2006-02-17 16:59 124520 ----a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 12:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2008-01-24 21:39 26112 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\AOLServiceHost.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/5/2010 2:02 PM 64288]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/28/2010 4:33 PM 135336]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 231424]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [6/21/2010 10:44 AM 1355928]
.
.
------- Supplementary Scan -------
.
uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
FF - ProfilePath - c:\documents and settings\troubleshooter\Application Data\Mozilla\Firefox\Profiles\euyovg51.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

Notify-WgaLogon - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-01 21:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????7?6?5?7??????? ???B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(784)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2976)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\HPZipm12.exe
c:\program files\HPQ\SHARED\HPQWMI.exe
.
**************************************************************************
.
Completion time: 2010-10-01 21:24:39 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-02 04:24

Pre-Run: 28,695,224,320 bytes free
Post-Run: 28,628,676,608 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - F0C50485B4E68E2CCCD75CEF17683FE9
____________________
Please let me know if you need any other information. Thank you again!

Best regards,
Wiz:wave:

Broni · Oct 2, 2010

You're welcome

Your MBR seems to be infected.

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)

Place a blank CD in your CD drive.
Double click on NTBR_CD.exe file and a folder of the same name will appear.
Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
Follow the prompts to burn the CD.

Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.

Insert the newly created CD into your infected PC and reboot your computer.
Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
Read the warning and then continue as prompted.
You first need to select your keyboard layout - press Enter for English.
Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
On the following screen enter 5 to select Install Standard MBR code.
Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
When asked to confirm please do so.
Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
Eject the disc and then press ctrl+alt+del to reboot the PC.

Once rebooted, run MBRCheck again and post its log.

drwizgeek · Oct 3, 2010

MBR seems clean now; Thanks!

Hello Broni:

Thank you very much for your thorough instructions. The good news is that I finally managed to successfully complete this task. The bad news is that we may have a DVD/CD drive problem. Here are the challenges that I faced:

1. BurnItCD.cmd first failed to complete the CD burn at the default 16X speed, which probably is the maximum CD speed of the drive. I used a trial-and-error process to finally burn a second CD at 4X speed with some manual pressure at strategic spots on the DVD/CD drive to get it to work! The first CD may have been corrupted, though.

2. My first attempt to boot from this second CD was also a failure! It first resulted in a very scratchy Windows startup screen of the old over-the-air, B&W TV variety! I had to restart the laptop and tweak the drive again to make it work. After that everything went according to the plan.

I had noticed some frame skipping and scratchy audio when I played a couple of DVDs over the past month. Thus, my plan is to clean up the DVD drive lens, dust the drive, and upgrade its driver. But the problem could also be the drive's sitting or its moor. Have you run into similar problems with other DVD/CD drives? Is there a more viable solution for it?

3. Another good news is that the following MBRcheck log looks clean and indicates a valid Windows XP MBR now. Please advise how to proceed from here. Thank you again.

Best wishes,
Wiz:wave:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 133):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806CE000 \WINDOWS\system32\hal.dll
0xF7AFC000 \WINDOWS\system32\KDCOM.DLL
0xF7A0C000 \WINDOWS\system32\BOOTVID.dll
0xF74CD000 ACPI.sys
0xF7AFE000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF74BC000 pci.sys
0xF75FC000 isapnp.sys
0xF760C000 ohci1394.sys
0xF761C000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7A10000 compbatt.sys
0xF7A14000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7BC4000 pciide.sys
0xF787C000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7B00000 intelide.sys
0xF7B02000 viaide.sys
0xF7B04000 aliide.sys
0xF749E000 pcmcia.sys
0xF762C000 MountMgr.sys
0xF747F000 ftdisk.sys
0xF7A18000 ACPIEC.sys
0xF7BC5000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7884000 PartMgr.sys
0xF763C000 VolSnap.sys
0xF7467000 atapi.sys
0xF764C000 disk.sys
0xF765C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7447000 fltMgr.sys
0xF7435000 sr.sys
0xF766C000 Lbd.sys
0xF767C000 PxHelp20.sys
0xF741E000 KSecDD.sys
0xF7391000 Ntfs.sys
0xF7364000 NDIS.sys
0xF768C000 serial.sys
0xF7349000 Mup.sys
0xF7AB4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF6AD3000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xF6348000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF6334000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7934000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6311000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF793C000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF6AC3000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF6AB3000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF6AA3000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF62EE000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7944000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys
0xF6A93000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF794C000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF62B9000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7B28000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7954000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF629F000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0xF614B000 \SystemRoot\system32\DRIVERS\bcmwl5.sys
0xF60F5000 \SystemRoot\system32\drivers\camc6hal.sys
0xF6A83000 \SystemRoot\system32\drivers\camc6aud.sys
0xF60D1000 \SystemRoot\system32\drivers\portcls.sys
0xF6A73000 \SystemRoot\system32\drivers\drmk.sys
0xF6098000 \SystemRoot\system32\DRIVERS\HSFHWATI.sys
0xF5F9B000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
0xF5EEB000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xF795C000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7AE4000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF7C15000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF76BC000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7AE8000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF5ED4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76CC000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF76DC000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7964000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF5EC3000 \SystemRoot\system32\DRIVERS\psched.sys
0xF76EC000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF796C000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7974000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF76FC000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7B2A000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5E8F000 \SystemRoot\system32\DRIVERS\update.sys
0xF7AF8000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF770C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF773C000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B30000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C8F000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B32000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7994000 \SystemRoot\System32\drivers\vga.sys
0xF7B34000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B36000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF799C000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF79A4000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7AA0000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEDDA8000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEDD50000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEDD28000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF7AA4000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xEDD06000 \SystemRoot\System32\drivers\afd.sys
0xF776C000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF79AC000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xEDC44000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF79B4000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xEDC19000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEDBAA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF778C000 \SystemRoot\System32\Drivers\Fips.SYS
0xEDB89000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF779C000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF7B3C000 \??\C:\WINDOWS\system32\drivers\EABFiltr.sys
0xF7CB2000 \SystemRoot\System32\Drivers\BANTExt.sys
0xEDB1F000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7B42000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0xF77FC000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xEDB07000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B46000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEDDFB000 \SystemRoot\System32\drivers\Dxapi.sys
0xF79EC000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C19000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF04E000 \SystemRoot\System32\ati2cqag.dll
0xBF080000 \SystemRoot\System32\atikvmag.dll
0xBF0B2000 \SystemRoot\System32\ati3duag.dll
0xBF2E3000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB8653000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xB864B000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB846F000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7BB2000 \SystemRoot\System32\Drivers\ASCTRM.SYS
0xB836A000 \SystemRoot\system32\drivers\wdmaud.sys
0xB840F000 \SystemRoot\system32\drivers\sysaudio.sys
0xB803D000 \SystemRoot\system32\DRIVERS\srv.sys
0xB82C6000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB7AAC000 \SystemRoot\System32\Drivers\HTTP.sys
0xB7969000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 39):
0 System Idle Process
4 System
704 C:\WINDOWS\system32\smss.exe
752 csrss.exe
776 C:\WINDOWS\system32\winlogon.exe
820 C:\WINDOWS\system32\services.exe
832 C:\WINDOWS\system32\lsass.exe
1000 C:\WINDOWS\system32\ati2evxx.exe
1020 C:\WINDOWS\system32\svchost.exe
1116 svchost.exe
1156 C:\WINDOWS\system32\svchost.exe
1224 svchost.exe
1340 svchost.exe
1612 C:\WINDOWS\system32\spoolsv.exe
1656 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1700 svchost.exe
1756 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1868 C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
1932 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2036 C:\WINDOWS\system32\ati2evxx.exe
208 C:\WINDOWS\explorer.exe
364 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
492 C:\WINDOWS\system32\HPZipm12.exe
524 C:\WINDOWS\system32\svchost.exe
1956 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
1900 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1984 C:\WINDOWS\vsnpstd2.exe
2016 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
124 C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
1944 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
464 wmiprvse.exe
304 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
580 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
1284 C:\WINDOWS\system32\ctfmon.exe
1456 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
2648 C:\WINDOWS\system32\wuauclt.exe
3328 C:\Program Files\HPQ\Shared\hpqwmi.exe
3400 alg.exe
2608 C:\troubleshooter\fall10\troubleshooting\security_sw_aug_10\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK6025GAS, Rev: KA201A

Size Device Name MBR Status
--------------------------------------------
55 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!

Broni · Oct 3, 2010

Good

The bad news is, that lens cleaners are rather waste of money ($8-$10).
The good news is, you can get new DVD burner shipped for $20+
Optical drives don't need any extra drivers. They're plug-and-play devices.

I want you to re-run Combofix and post fresh log.

drwizgeek · Oct 3, 2010

Combofix Log

Hello Broni:

Thanks for your prompt response. I was thinking of IPA and cotton swob for cleaning the DVD lens. I could buy a drive online!

Running ComboFix generated this MS error message a few times:

"MS (r) Console Based Script Host has encountered a problem..."

I clicked on "Don't Send" report every time. Here is the log, which still lists lots of bells and whistles that should not be running at all times. shopperreports.com is still there. Please advise how to get rid of them all. Thank you again.

Best wishes,
Wiz:wave:

ComboFix 10-10-02.02 - troubleshooter 10/03/2010 8:03.2.1 - x86
Running from: c:\documents and settings\troubleshooter\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-09-03 to 2010-10-03 )))))))))))))))))))))))))))))))
.

2010-10-03 03:40 . 2010-10-03 03:40 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Sonic
2010-10-03 03:39 . 2010-10-03 03:39 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Leadertech
2010-09-14 04:52 . 2010-09-14 04:54 -------- d-----w- c:\windows\system32\NtmsData
2010-09-06 08:00 . 2010-09-06 08:00 -------- d-----w- c:\windows\system32\Adobe
2010-09-06 03:14 . 2008-02-27 21:49 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
2010-09-06 03:02 . 2010-09-06 03:02 388096 ----a-r- c:\documents and settings\troubleshooter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-06 03:00 . 2010-09-06 03:00 -------- d-----w- c:\program files\CCleaner
2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\program files\Common Files\Apple
2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Apple
2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\program files\Apple Software Update
2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-09-05 22:44 . 2010-09-05 22:44 503808 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcp71.dll
2010-09-05 22:44 . 2010-09-05 22:44 499712 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\jmc.dll
2010-09-05 22:44 . 2010-09-05 22:44 61440 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-sse.dll
2010-09-05 22:44 . 2010-09-05 22:44 348160 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcr71.dll
2010-09-05 22:44 . 2010-09-05 22:44 12800 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-d3d.dll
2010-09-05 22:44 . 2010-09-05 22:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-05 21:02 . 2010-09-05 21:02 -------- dc----w- c:\windows\system32\DRVSTORE
2010-09-05 21:02 . 2010-06-21 17:44 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-09-05 21:02 . 2010-09-05 21:02 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-09-05 20:50 . 2010-09-05 20:50 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Sunbelt Software
2010-09-05 20:49 . 2010-06-21 17:52 2978768 -c--a-w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe
2010-09-05 20:49 . 2010-09-05 20:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
2010-09-05 20:47 . 2010-09-05 20:47 -------- d-----w- c:\program files\Lavasoft
2010-09-05 20:38 . 2010-09-20 01:53 63488 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-05 20:38 . 2010-09-05 20:38 52224 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-05 20:38 . 2010-09-20 01:53 117760 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-05 20:16 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-05 20:16 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-05 20:16 . 2010-09-05 20:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-03 05:34 . 2008-11-25 07:05 1 ----a-w- c:\documents and settings\troubleshooter\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-20 01:57 . 2008-11-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-20 01:56 . 2008-11-11 03:26 -------- d-----w- c:\program files\SpywareBlaster
2010-09-06 07:54 . 2005-10-13 23:28 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-05 23:44 . 2006-05-24 00:14 -------- d-----w- c:\program files\QuickTime
2010-09-05 23:43 . 2005-04-29 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-09-05 23:23 . 2005-04-29 12:19 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-05 23:00 . 2005-04-29 12:33 -------- d-----w- c:\program files\Java
2010-09-05 20:37 . 2008-11-11 03:28 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-05 20:36 . 2008-11-11 03:28 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com
2010-08-31 04:31 . 2010-08-31 04:31 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Avira
2010-08-29 02:37 . 2008-11-11 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-29 00:18 . 2008-11-11 03:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\program files\Avira
2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-08-20 15:48 . 2010-08-20 15:48 -------- d-----w- c:\program files\7-Zip
2010-08-10 06:26 . 2010-08-10 06:26 -------- d-----w- c:\program files\Panasonic
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-31 286720]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

c:\documents and settings\Hamid Mirzad\Start Menu\Programs\Startup\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0?????

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 ----a-w- c:\program files\Common Files\AOL\1128995550\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-19 10:41 49152 ----a-w- c:\program files\Hp\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
2006-02-17 16:59 124520 ----a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 12:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2008-01-24 21:39 26112 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\AOLServiceHost.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/5/2010 2:02 PM 64288]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/28/2010 4:33 PM 135336]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 231424]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [6/21/2010 10:44 AM 1355928]
.
.
------- Supplementary Scan -------
.
uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {8694A8C7-0C71-487C-B8E0-F94637295661} = 69.19.190.116 69.19.190.120
FF - ProfilePath - c:\documents and settings\troubleshooter\Application Data\Mozilla\Firefox\Profiles\euyovg51.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-03 08:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????7?6?5?7??????? ???B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(784)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3564)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-10-03 08:20:24
ComboFix-quarantined-files.txt 2010-10-03 15:20
ComboFix2.txt 2010-10-02 04:24

Pre-Run: 28,590,624,768 bytes free
Post-Run: 28,580,257,792 bytes free

- - End Of File - - 163D2F9FF4C502046C6F3866F4F8C846

Broni · Oct 3, 2010

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=-
"FirewallOverride"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

drwizgeek · Oct 3, 2010

Another Combofix Log

Hello Broni:

Thanks for your prompt response. Running ComboFix did not generate any MS error messages this time; thanks!

Here is the new log, which still lists lots of s/w that need not be running at all times. shopperreports.com is still there. Please advise how best to clean them all. Thank you again.

Best wishes,
Wiz

ComboFix 10-10-02.02 - troubleshooter 10/03/2010 10:44:55.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.187 [GMT -7:00]
Running from: c:\documents and settings\troubleshooter\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\troubleshooter\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Files Created from 2010-09-03 to 2010-10-03 )))))))))))))))))))))))))))))))
.

2010-10-03 03:40 . 2010-10-03 03:40 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Sonic
2010-10-03 03:39 . 2010-10-03 03:39 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Leadertech
2010-09-14 04:52 . 2010-09-14 04:54 -------- d-----w- c:\windows\system32\NtmsData
2010-09-06 08:00 . 2010-09-06 08:00 -------- d-----w- c:\windows\system32\Adobe
2010-09-06 03:14 . 2008-02-27 21:49 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
2010-09-06 03:02 . 2010-09-06 03:02 388096 ----a-r- c:\documents and settings\troubleshooter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-06 03:00 . 2010-09-06 03:00 -------- d-----w- c:\program files\CCleaner
2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\program files\Common Files\Apple
2010-09-05 23:41 . 2010-09-05 23:41 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Apple
2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\program files\Apple Software Update
2010-09-05 23:40 . 2010-09-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-09-05 22:44 . 2010-09-05 22:44 503808 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcp71.dll
2010-09-05 22:44 . 2010-09-05 22:44 499712 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\jmc.dll
2010-09-05 22:44 . 2010-09-05 22:44 61440 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-sse.dll
2010-09-05 22:44 . 2010-09-05 22:44 348160 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-39ea7450-n\msvcr71.dll
2010-09-05 22:44 . 2010-09-05 22:44 12800 ----a-w- c:\documents and settings\troubleshooter\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-4c3cdc79-n\decora-d3d.dll
2010-09-05 22:44 . 2010-09-05 22:43 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-05 21:02 . 2010-09-05 21:02 -------- dc----w- c:\windows\system32\DRVSTORE
2010-09-05 21:02 . 2010-06-21 17:44 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-09-05 21:02 . 2010-09-05 21:02 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-09-05 20:50 . 2010-09-05 20:50 -------- d-----w- c:\documents and settings\troubleshooter\Local Settings\Application Data\Sunbelt Software
2010-09-05 20:49 . 2010-06-21 17:52 2978768 -c--a-w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}\Ad-AwareInstall.exe
2010-09-05 20:49 . 2010-09-05 20:50 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{90FF8911-FC06-4E49-8959-C3CF1CA226BB}
2010-09-05 20:47 . 2010-09-05 20:47 -------- d-----w- c:\program files\Lavasoft
2010-09-05 20:38 . 2010-09-20 01:53 63488 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-05 20:38 . 2010-09-05 20:38 52224 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-05 20:38 . 2010-09-20 01:53 117760 ----a-w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-05 20:16 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-05 20:16 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-05 20:16 . 2010-09-05 20:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-03 05:34 . 2008-11-25 07:05 1 ----a-w- c:\documents and settings\troubleshooter\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-20 01:57 . 2008-11-11 03:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-09-20 01:56 . 2008-11-11 03:26 -------- d-----w- c:\program files\SpywareBlaster
2010-09-06 07:54 . 2005-10-13 23:28 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-05 23:44 . 2006-05-24 00:14 -------- d-----w- c:\program files\QuickTime
2010-09-05 23:43 . 2005-04-29 13:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-09-05 23:23 . 2005-04-29 12:19 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-05 23:00 . 2005-04-29 12:33 -------- d-----w- c:\program files\Java
2010-09-05 20:37 . 2008-11-11 03:28 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-05 20:36 . 2008-11-11 03:28 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\SUPERAntiSpyware.com
2010-08-31 04:31 . 2010-08-31 04:31 -------- d-----w- c:\documents and settings\troubleshooter\Application Data\Avira
2010-08-29 02:37 . 2008-11-11 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-29 00:18 . 2008-11-11 03:13 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\program files\Avira
2010-08-28 23:33 . 2010-08-28 23:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-08-20 15:48 . 2010-08-20 15:48 -------- d-----w- c:\program files\7-Zip
2010-08-10 06:26 . 2010-08-10 06:26 -------- d-----w- c:\program files\Panasonic
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
"SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-31 286720]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 290816]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-02-17 233534]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

c:\documents and settings\Hamid Mirzad\Start Menu\Programs\Startup\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-6-23 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0?????

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-05-10 00:24 50760 ----a-w- c:\program files\Common Files\AOL\1128995550\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-19 10:41 49152 ----a-w- c:\program files\Hp\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]
2006-02-17 16:59 124520 ----a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 12:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2008-01-24 21:39 26112 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1128995550\\ee\\AOLServiceHost.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/5/2010 2:02 PM 64288]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 8:18 AM 231424]
.
.
------- Supplementary Scan -------
.
uStart Page = https://login.yahoo.com/config/login_verify2?&.src=ym
uInternet Connection Wizard,ShellNext = hxxp://www.shopperreports.com/Installation/Browsing/Uninstall.aspx?partner=ShopperReports&group=SR&UID=&bar_ver=2.0.26&CID=BD924F070000000000000014A51343C00B21AC31&IID=890900BC3EE54E4D8584B98326A40A5B675F4DD3&BANNER_ID=7012000003&REQUESTOR_ID=431303&COUNTRY=US&SG=&USER_CREATE_DATE=05/07/2008%2006:58&Affiliate_Id=1000007012&ie_user_agent=Mozilla%2f4%2e0%20%28compatible%3b%20MSIE%207%2e0%3b%20Windows%20NT%205%2e1%3b%20%2eNET%20CLR%201%2e1%2e4322%3b%20SpamBlockerUtility%204%2e8%2e4%29
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: {8694A8C7-0C71-487C-B8E0-F94637295661} = 69.19.190.116 69.19.190.120
FF - ProfilePath - c:\documents and settings\troubleshooter\Application Data\Mozilla\Firefox\Profiles\euyovg51.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/login_verify2?&.src=ym
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-03 10:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????7?6?5?7??????? ???B?????????????hLC? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4012)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-10-03 11:02:40
ComboFix-quarantined-files.txt 2010-10-03 18:02
ComboFix2.txt 2010-10-02 04:24

Pre-Run: 28,587,716,608 bytes free
Post-Run: 28,572,790,784 bytes free

- - End Of File - - 228D4CB6528D3A98B3234413A02557F4

Broni · Oct 3, 2010

Looks good

How is computer doing?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

drwizgeek · Oct 3, 2010

OTL.txt and OTL EXtras Logs

Hello Broni:

Thanks for your prompt response. It is running better. OTL.txt and OTL EXtras Log were each way over 20,000-word limit. Thus, I had to attach them; sorry!

They still list many missing items and lots of s/w that need not be running at all. For example, no printers are attached to this laptop. Thus, no HP s/w is needed. No AOL, Intuit updater, shopperreports.com... is needed, either. Please advise how best to clean them all. Thank you again.

Best wishes,
Wiz

Broni · Oct 3, 2010

Thus, no HP s/w is needed. No AOL, Intuit updater, shopperreports.com... is needed, either. Please advise how best to clean them all.

While I'm looking at your OTL logs....

Download, and install Quick Startup: http://www.glarysoft.com/qs.html
Go File>Export, save report, and paste it into your next post.

Broni · Oct 3, 2010

You don't have much RAM. Your computer would greatly benefit from adding another 512MB of RAM.
For now, you uninstall Spybot, which is definitely hogging your low-RAM system.

==========================================================================

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103471 -Mozilla\5.0 ( File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
[2008/11/09 10:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34


:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

======================================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
IMPORTANT! UN-check Remove found threats
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

drwizgeek · Oct 3, 2010

OTL.exe, SecurityCheck.exe, & QuickStartup.exe Reports

Hello Broni:

Laptop now boots in two minutes! Here are the reports in the execution order. I decided to post them for your review while I complete the ESET Online Scan since it may take some time! Thank you again!

Regards,
Wiz
___________________OTL.exe Report Starts Here____________

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Shockwave Updater deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\ deleted successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9Plus folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: bb60877f2dd807555cb5ae96

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Dorna
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Hamid Mirzad
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: troubleshooter
->Temp folder emptied: 1726 bytes
->Temporary Internet Files folder emptied: 2675728 bytes
->Java cache emptied: 2023 bytes
->FireFox cache emptied: 61654103 bytes
->Flash cache emptied: 1733 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 61.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: bb60877f2dd807555cb5ae96

User: Default User

User: Dorna
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Hamid Mirzad
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: troubleshooter
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 10032010_143807

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

___________________SecurityCheck.exe Report Starts Here____________

Results of screen317's Security Check version 0.99.5
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Avira AntiVir Personal - Free Antivirus
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 21
Adobe Flash Player 10.1.82.76
Adobe Reader 9.3.3
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

___________________quickstartup.exe Report Starts Here____________

Startup List report created on 10/3/2010 by Startup Manager

Name: SynTPLpr
Path: C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: SynTPEnh
Path: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: SNPSTD2
Path: C:\WINDOWS\vsnpstd2.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: LSBWatcher
Path: c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: hpWirelessAssistant
Path: C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: eabconfg.cpl
Path: C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: ATIPTA
Path: C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: ISUSPM Startup
Path: C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Cpqset
Path: C:\Program Files\HPQ\Default Settings\cpqset.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: ISUSScheduler
Path: "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: SynTPStart
Path: C:\Program Files\Synaptics\SynTP\SynTPStart.exe
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: avgnt
Path: "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min /ns
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: SunJavaUpdateSched
Path: "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: QuickTime Task
Path: "C:\Program Files\QuickTime\QTTask.exe" -atboottime
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Adobe Reader Speed Launcher
Path: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: Adobe ARM
Path: "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: SpybotSD TeaTimer
Path: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------

Name: ctfmon.exe
Path: C:\WINDOWS\system32\ctfmon.exe
Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Status: Enabled
------------------------------------------------------------------------------------------
Total 18 Items

Broni · Oct 3, 2010

Very good

We have to remember to install SP3, when Eset comes up clean.

Re-run QuickStartup and UN-check following unneeded startups:

LSBWatcher - up to you - HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling, do not prevent from starting.
eabconfg.cpl - up to you - Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
ATIPTA - up to you - Control panel for the ATI series of video cards allowing access to such features as display resolution, colour depth, etc. Available via Start -> Settings -> Control Panel -> Display. Some users may need it if they have optimised their settings
ISUSPM Startup
Cpqset
ISUSScheduler
SunJavaUpdateSched
Adobe ARM

drwizgeek · Oct 4, 2010

ESET Scan Results

Hello Broni:

ESET Online Scan did take a long time! The following ESET Scan results indicate several infections. Most are "false positives" of a couple of cleanup s/w, such as ComboFix, and their quarantined infections. Others are probably serious and need cleanup. Sorry for the bad news!

I agree with you on the startup s/w but will wait for your advice on ESET scan results. ATIPTA may need special attention, however, because about a month ago I noticed that the display setting options have changed. They now allow many other resolutions way beyond the 1024*768, native resolution. Device Manager lists a default monitor in addition to the actual display monitor. I am not sure if this is also new or correct. Thank you again!

Regards,
Wiz

ESET Scan results

C:\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe probably a variant of Win32/Agent.HZHBURL trojan
C:\Qoobox\Quarantine\C\WINDOWS\ihghkj.ini.vir Win32/Adware.Virtumonde.NEO application
C:\Qoobox\Quarantine\C\WINDOWS\klopru.ini.vir Win32/Adware.Virtumonde.NEO application
C:\Qoobox\Quarantine\C\WINDOWS\vutttv.ini.vir Win32/Adware.Virtumonde.NEO application
C:\Qoobox\Quarantine\C\WINDOWS\wacehk.ini.vir Win32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP330\A0180830.exe probably a variant of Win32/Spy.Agent.FBJQNLM trojan
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP330\A0180831.exe probably a variant of Win32/Agent.CBNUPOQ trojan
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181308.ini Win32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181309.ini Win32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181311.ini Win32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP336\A0181312.ini Win32/Adware.Virtumonde.NEO application
C:\troubleshooter\wagner_cleanup_software\ComboFix.exe probably a variant of Win32/Agent.CBNUPOQ trojan
C:\troubleshooter\wagner_cleanup_software\SDFix.exe probably a variant of Win32/Spy.Agent.FBJQNLM trojan

Broni · Oct 4, 2010

Eset actually didn't find much.
Most files are in Combofix quarantine folder (safe), which will be removed soon and in system restore points, which we'll reset in an moment.

========================================================================

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL

:Services

:Reg

:Files
C:\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe
C:\troubleshooter\wagner_cleanup_software\ComboFix.exe 
C:\troubleshooter\wagner_cleanup_software\SDFix.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

=======================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how is your computer doing.

drwizgeek · Oct 4, 2010

ESET Scan Results--Part 2

Hello Broni:

I just noticed that the other infections are the old ones burried in a few restore points. All we need to do is to get rid of the old restore points! Sorry for missing them; but it has been a long day! Thank you again.

Regards,
Wiz:wave:

Broni · Oct 4, 2010

This is what I just said.
If you follow my previous instructions, restore points will be reset.

drwizgeek · Oct 4, 2010

OTL logs

Hello Broni:

Of course, I had not seen your reply to my original "ESET Scan Results" before posting "ESET Scan Results--Part 2"! Here are the two OTL logs, as instructed. I will complete the rest of the tasks, starting Monday night, and post any results or issues then.

Any thoughts on the display-monitor-settings puzzle? Thank you again for such a great job, Broni!

Best wishes,
Wiz:wave:

__________________First OTL Run___________________

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\AOL Downloads\SUD4131\setup.exe moved successfully.
C:\troubleshooter\wagner_cleanup_software\ComboFix.exe moved successfully.
C:\troubleshooter\wagner_cleanup_software\SDFix.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: bb60877f2dd807555cb5ae96

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Dorna
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Hamid Mirzad
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: troubleshooter
->Temp folder emptied: 1726 bytes
->Temporary Internet Files folder emptied: 1183800 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: bb60877f2dd807555cb5ae96

User: Default User

User: Dorna
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Hamid Mirzad
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: troubleshooter
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 10032010_222147

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

__________________Second OTL Run___________________

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: bb60877f2dd807555cb5ae96

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Dorna
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Hamid Mirzad
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: troubleshooter
->Temp folder emptied: 1726 bytes
->Temporary Internet Files folder emptied: 6849859 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 7.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: bb60877f2dd807555cb5ae96

User: Default User

User: Dorna
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Hamid Mirzad
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: troubleshooter
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.14.1 log created on 10032010_215832

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Broni · Oct 4, 2010

Any thoughts on the display-monitor-settings puzzle?

Remind me, what was the issue?

drwizgeek · Oct 4, 2010

Display-monitor-settings Puzzle and RAM Upgrade

Hello Broni:

Thanks; here is what I said in my Post #19:

"I agree with you on the startup s/w but will wait for your advice on ESET scan results. ATIPTA may need special attention, however, because about a month ago I noticed that the display setting options have changed. They now allow many other resolutions way beyond the 1024*768, native resolution. Device Manager lists a default monitor in addition to the actual display monitor. I am not sure if this is also new or correct."

I looked for RAM sticks. The two slots currently have 256MB each. Thus, I have to replace both of them with a pair of 512MB sticks at $24 each, Corsair or Crucial brand. I found a generic one for $15 each. But, they are not in stock. 1GB sticks are too expensive. Do you recommend any RAM sticks or vendors? DVD player is doing better with a bit of cleaning. Thank you again!

Regards,
Wiz

Solved Broni: Please review these post-cleanup, Spymaxx logs!

Posts: 125 +0

Attachments

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Attachments

Posts: 56,041 +516

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Posts: 56,041 +516

Posts: 125 +0

Similar threads