also @ TechSpot: Google, Samsung unveil Chromebook, Chromebox with Chrome OS 19

TechSpot
Collaborate in the cloud with Office, Exchange, SharePoint, and Lync.
Microsoft Office 365. Pay-as-you-go starting at $8/user/month. Begin your free trial now.

[Solved] Can't access "My Documents" and programs not showing on start up menu

Discussion in 'Virus and Malware Removal' started by jaynes123, Sep 19, 2011.

Thread Status:
Not open for further replies.
Page 3 of 3

  1. Broni Malware Annihilator

    I still need OTL fix log.
    Broni, Sep 24, 2011
    #41

  2. jaynes123 Newcomer, in training

    OTL Extras Report

    OTL Extras logfile created on: 9/23/2011 5:38:29 PM - Run 1
    OTL by OldTimer - Version 3.2.29.1 Folder = C:\Documents and Settings\Richard\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1021.97 Mb Total Physical Memory | 578.88 Mb Available Physical Memory | 56.64% Memory free
    2.40 Gb Paging File | 1.64 Gb Available in Paging File | 68.25% Paging File free
    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 105.64 Gb Total Space | 90.68 Gb Free Space | 85.84% Space Free | Partition Type: NTFS

    Computer Name: DGTJRBF1 | User Name: Richard | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 0
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Dell\MediaDirect\PCMService.exe" = C:\Program Files\Dell\MediaDirect\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program -- (CyberLink Corp.)
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
    "C:\Program Files\Verizon\VSP\ServicepointService.exe" = C:\Program Files\Verizon\VSP\ServicepointService.exe:*:Enabled:Servicepoint Service -- (Radialpoint Inc.)
    "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" = C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host -- (McAfee, Inc.)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
    "{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
    "{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
    "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
    "{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
    "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
    "{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
    "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
    "{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
    "{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
    "{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
    "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
    "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
    "{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
    "{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
    "{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-A83000000003}" = Adobe Reader 8.3.0
    "{B0DF58A2-40DF-4465-AA56-38623EC9938C}" = Documentation & Support Launcher
    "{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
    "{B6884A07-0305-47AE-9969-8F26FADC17DE}" = Games, Music, & Photos Launcher
    "{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
    "{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
    "{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
    "{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
    "{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
    "{D1B5E9C8-4CCF-44E3-87D6-7C00D7DA5370}" = IntelliSonic Speech Enhancement
    "{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
    "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
    "{E42BD75A-FC23-4E3F-9F91-2658334C644F}" = Internet Service Offers Launcher
    "{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
    "{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
    "{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
    "Advanced Audio FX Engine" = Advanced Audio FX Engine
    "Advanced Video FX Engine" = Advanced Video FX Engine
    "ARO 2011_is1" = ARO 2011
    "AudibleManager" = AudibleManager
    "Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
    "CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
    "Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
    "Creative OEM002" = Laptop Integrated Webcam Driver (1.03.02.0719)
    "Dell Webcam Center" = Dell Webcam Center
    "Dell Webcam Manager" = Dell Webcam Manager
    "EPSON NX420 Series" = EPSON NX420 Series Printer Uninstall
    "Google Chrome" = Google Chrome
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "ie8" = Windows Internet Explorer 8
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
    "MSC" = McAfee Total Protection
    "NVIDIA Drivers" = NVIDIA Drivers
    "RadialpointClientGateway_is1" = Verizon Servicepoint 3.5.18
    "SearchAssist" = SearchAssist
    "SynTPDeinstKey" = Dell Touchpad
    "Windows Media Format Runtime" = Windows Media Format Runtime
    "Windows Media Player" = Windows Media Player 10
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "Yahoo! Messenger" = Yahoo! Messenger
    "Yahoo! Software Update" = Yahoo! Software Update
    "YInstHelper" = Yahoo! Install Manager

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 9/10/2011 5:48:05 PM | Computer Name = DGTJRBF1 | Source = Application Error | ID = 1000
    Description = Faulting application McSvHost.exe, version 2.0.230.0, faulting module
    unknown, version 0.0.0.0, fault address 0x01920296.

    Error - 9/10/2011 9:52:40 PM | Computer Name = DGTJRBF1 | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 9/12/2011 3:28:16 AM | Computer Name = DGTJRBF1 | Source = McLogEvent | ID = 5051
    Description = A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    took longer than 90000 ms to complete a request. The process will be terminated.
    Thread
    id : 4092 (0xffc) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.4.0.333
    / 5400.1158 Object being scanned = \Device\HarddiskVolume2\Documents and Settings\Richard\Local
    Settings\Temporary Internet Files\Content.IE5\IVKDPSLL\afr[1].php by C:\Program
    Files\Internet Explorer\IEXPLORE.EXE 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)

    5003(0)(0) 5002(0)(1) 15002(0)(0) 5000(0)(0)

    Error - 9/12/2011 10:45:29 AM | Computer Name = DGTJRBF1 | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 9/13/2011 5:53:03 PM | Computer Name = DGTJRBF1 | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: This operation returned because the timeout period expired.

    Error - 9/13/2011 6:28:31 PM | Computer Name = DGTJRBF1 | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: This operation returned because the timeout period expired.

    Error - 9/13/2011 6:28:33 PM | Computer Name = DGTJRBF1 | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: The specified server cannot perform the requested operation.

    Error - 9/14/2011 7:26:53 PM | Computer Name = DGTJRBF1 | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 9/16/2011 8:00:46 AM | Computer Name = DGTJRBF1 | Source = Application Hang | ID = 1002
    Description = Hanging application EXCEL.EXE, version 12.0.6550.5004, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 9/16/2011 7:37:32 PM | Computer Name = DGTJRBF1 | Source = Application Hang | ID = 1002
    Description = Hanging application WINWORD.EXE, version 12.0.6545.5000, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    [ OSession Events ]
    Error - 3/18/2011 11:44:44 AM | Computer Name = DGTJRBF1 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
    12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 183613
    seconds with 2400 seconds of active time. This session ended with a crash.

    Error - 7/20/2011 3:07:11 PM | Computer Name = DGTJRBF1 | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
    12.0.6550.5004, Microsoft Office Version: 12.0.6425.1000. This session lasted 171834
    seconds with 15420 seconds of active time. This session ended with a crash.

    [ System Events ]
    Error - 9/23/2011 10:53:34 AM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7031
    Description = The McAfee Services service terminated unexpectedly. It has done
    this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
    Restart the service.

    Error - 9/23/2011 10:53:34 AM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7031
    Description = The McAfee VirusScan Announcer service terminated unexpectedly. It
    has done this 1 time(s). The following corrective action will be taken in 60000
    milliseconds: Restart the service.

    Error - 9/23/2011 10:53:34 AM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7031
    Description = The McAfee Network Agent service terminated unexpectedly. It has
    done this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
    Restart the service.

    Error - 9/23/2011 10:53:34 AM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7031
    Description = The McAfee Proxy Service service terminated unexpectedly. It has
    done this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
    Restart the service.

    Error - 9/23/2011 10:53:34 AM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7031
    Description = The McAfee Anti-Spam Service service terminated unexpectedly. It
    has done this 1 time(s). The following corrective action will be taken in 60000
    milliseconds: Restart the service.

    Error - 9/23/2011 4:51:01 PM | Computer Name = DGTJRBF1 | Source = DCOM | ID = 10010
    Description = The server {7379F0FF-EA46-4536-BEF5-68B6B5E54F9B} did not register
    with DCOM within the required timeout.

    Error - 9/23/2011 5:03:45 PM | Computer Name = DGTJRBF1 | Source = DCOM | ID = 10010
    Description = The server {5EFBB572-1CBD-47DA-8BBA-5BAB9CADD108} did not register
    with DCOM within the required timeout.

    Error - 9/23/2011 5:05:18 PM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7034
    Description = The Roxio Hard Drive Watcher 9 service terminated unexpectedly. It
    has done this 1 time(s).

    Error - 9/23/2011 5:05:18 PM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7031
    Description = The McAfee McShield service terminated unexpectedly. It has done
    this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
    Restart the service.

    Error - 9/23/2011 5:09:32 PM | Computer Name = DGTJRBF1 | Source = Service Control Manager | ID = 7031
    Description = The McAfee McShield service terminated unexpectedly. It has done
    this 2 time(s). The following corrective action will be taken in 5000 milliseconds:
    Restart the service.


    < End of report >
    jaynes123, Sep 24, 2011
    #42

  3. Broni Malware Annihilator

    This is not correct log.
    Re-read the beginning of my reply #37.
    Broni, Sep 24, 2011
    #43

  4. jaynes123 Newcomer, in training

    OTL Fix Log

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Registry value HKEY_USERS\S-1-5-21-3774226034-813364458-292287962-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\WINDOWS\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    File/Folder C:\WINDOWS\System32\*.tmp not found.
    File/Folder C:\WINDOWS\*.tmp not found.
    C:\Documents and Settings\Richard\Application Data\Uniblue\RegistryBooster folder moved successfully.
    C:\Documents and Settings\Richard\Application Data\Uniblue folder moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus\\DisableMonitoring deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Richard
    ->Temp folder emptied: 3131637 bytes
    ->Temporary Internet Files folder emptied: 24722187 bytes
    ->Java cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 32768 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 604312 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 27.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService

    User: NetworkService

    User: Richard
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.29.1 log created on 09242011_183729

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\YDIDRZ1X\default[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\YDIDRZ1X\eBayISAPI[2].html moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\YDIDRZ1X\eBayISAPI[3].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\YDIDRZ1X\EditMessageLight[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\YDIDRZ1X\partner[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\YDIDRZ1X\resourcespreload[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\YDIDRZ1X\xmlProxy[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\01[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\280743411740[1].txt moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\adloader[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\ads[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\eBayISAPI[1].html moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\resourcespreload[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\topic171034-2[1].html moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\topic171034-3[2].html moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\tt[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\OM2TL6ZB\xmlProxy[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\FI0LW2QX\eBayISAPI[3].html moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\FI0LW2QX\LocalStorage[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\FI0LW2QX\Messenger[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\FI0LW2QX\pixel[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\7GG8YK32\ads[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\7GG8YK32\eBayISAPI[2].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\7GG8YK32\eBayISAPI[2].html moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\7GG8YK32\like[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\7GG8YK32\like[2].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\7GG8YK32\RteFrame_16.0.1859.0906[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\7GG8YK32\ViewItemDescV4[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
    C:\WINDOWS\temp\Perflib_Perfdata_c3c.dat moved successfully.

    Registry entries deleted on Reboot...
    jaynes123, Sep 24, 2011
    #44

  5. Broni Malware Annihilator

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
    Broni, Sep 24, 2011
    #45

  6. jaynes123 Newcomer, in training

    OTL Restore Report

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Richard
    ->Temp folder emptied: 1380783 bytes
    ->Temporary Internet Files folder emptied: 3842325 bytes
    ->Java cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 16384 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 5.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService

    User: NetworkService

    User: Richard
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.29.1 log created on 09242011_210218

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\3YQQAUF5\login[1].htm moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\Content.IE5\3YQQAUF5\showthread[1].php moved successfully.
    C:\Documents and Settings\Richard\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
    C:\WINDOWS\temp\Perflib_Perfdata_ba0.dat moved successfully.

    Registry entries deleted on Reboot...
    jaynes123, Sep 24, 2011
    #46

  7. jaynes123 Newcomer, in training

    proceeding with step 2, just wanted to get that posted
    jaynes123, Sep 24, 2011
    #47

  8. Broni Malware Annihilator

    OK.....................
    Broni, Sep 24, 2011
    #48

  9. jaynes123 Newcomer, in training

    my computer is still running well - thank you so very much broni!

    did the installations you recommended and will run the ones you suggested regularly. appreciate the great job you work youve done, my speed is better and ideally the black screen crashes is behind me. the link about how infections are caused - lots of good info. thank you again!
    jaynes123, Sep 25, 2011
    #49

  10. Broni Malware Annihilator

    Way to go!! [IMG]
    Good luck and stay safe :)
    Broni, Sep 25, 2011
    #50
Page 3 of 3
Thread Status:
Not open for further replies.