[Closed] Another redirect victim. I've tried everything and it won't go away

By sccomputerguys
Jul 11, 2011
Topic Status:
Not open for further replies.
  1. Hi, my name is Gene. Like many other posts, I recently was infected with a re-direct virus that re-directs virtually all searches. Any help is appreciated!! I will post my logs from the 7 step process above as soon as possible. Thanks!!
  2. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    FYI... I have already tried using

    ComboFix
    MBAM
    TDSSKiller
    aswMBR
    CCLeaner
    TFC
    DDS
    Defogger

    RKUnhooker wont run (Exception erreor) and I can't install AVG (Windows Installer error).
  3. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 7068

    Windows 6.1.7601 Service Pack 1 (Safe Mode)
    Internet Explorer 8.0.7601.17514

    7/10/2011 4:54:14 PM
    mbam-log-2011-07-10 (16-54-14).txt

    Scan type: Full scan (C:\|)
    Objects scanned: 344013
    Time elapsed: 32 minute(s), 49 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  4. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    GMER log was empty and DDS didn't show a result. Also, I am running Windows 7 64bit.
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Welcome to TechSpot, Gene. I'll help with the redirect.

    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.
    • Please let me know if there is any change in the system.
    If I have not replied for 2 days, you can send me a PM reminder. Include the URL of your thread. Please do not send me a PM to tell me your logs are up.
    If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
    =====================================
    As for this:
    When users panic and gather scans from the internet indiscriminately, they frequently make things work The only program above that could have been run within instructions were Mbam and CCleaner. DDS doesn't 'find' things> it generates 2 logs that show me what's going on in the system. The others should only be run if appropriate and clearly you do not know if you have a rootkit or what/where it is.
    ================================
    We have stopped using TFC because we found a glitch on the system that was removing programs and they could not be recovered. Please uninstall the following
    TFC
    aswMBR
    TDSKiller

    Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]
    ========================================
    Here are our steps for preliminary cleaning: Preliminary Virus and Malware Removal thread HERE.

    NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.

    When you have finished, leave the logs for review in your next reply .
    NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.
  6. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    Thanks for your reply... I uninstalled the programs you asked. I'm working on the logs as we speak (or chat). I do notice that after everytime I reboot the pc, all my custom changes (i.e. placing Run on the Start menu, reverts back to how it was before I made the change). None of my personalization changes are kept... FYI
  7. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    Malwarebytes' Anti-Malware 1.51.0.1200
    www.malwarebytes.org

    Database version: 7074

    Windows 6.1.7601 Service Pack 1
    Internet Explorer 8.0.7601.17514

    7/11/2011 10:53:16 AM
    mbam-log-2011-07-11 (10-53-16).txt

    Scan type: Quick scan
    Objects scanned: 200243
    Time elapsed: 2 minute(s), 13 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  8. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    GMER says "GMER hasn't found any system modification." and doesn't give me anything to copy and post.
  9. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    When I run DDS
    a pop up appeared stating "C:\Users' is not recognized as an internal or external command, operable program or batch file.
    The system cannot find the path specified."
  10. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    when Avast was installed
    a pop up stating
    "MALICIOUS URL BLOCKED
    avast! Network Shield blocked a harmful site.
    Object: 64.111.211.165
    Infection: URL:Mal
    Process: C:\Program Files\ Internet Explorer\iexplorer.exe
  11. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    I've gone through the 7 steps... not sure if we got the results we were looking for. What next?
  12. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    Finally got GMER to run...


    GMER 1.0.15.15640 - http://www.gmer.net
    Rootkit scan 2011-07-12 06:06:02
    Windows 6.1.7601 Service Pack 1
    Running: gmer.exe


    ---- Files - GMER 1.0.15 ----

    File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26L8AJ2B\bullet[1] 3169 bytes
    File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26L8AJ2B\ErrorPageTemplate[1] 2168 bytes
    File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VAWGL4IA\httpErrorPagesScripts[1] 8601 bytes
    File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNF7SILJ\background_gradient[1] 453 bytes
    File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNF7SILJ\errorPageStrings[1] 1817 bytes
    File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN03EK19\navcancl[1] 2713 bytes
    File C:\Users\scadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN03EK19\info_48[1] 6993 bytes

    ---- EOF - GMER 1.0.15 ----
  13. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    .
    DDS (Ver_2011-06-23.01) - NTFSAMD64 NETWORK
    Internet Explorer: 8.0.7601.17514
    Run by scadmin at 6:08:42 on 2011-07-12
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4085.2872 [GMT -7:00]
    .
    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    C:\Windows\Explorer.EXE
    C:\Windows\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Users\scadmin\AppData\Local\temp\Temp1_gmer.zip\gmer.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Windows\system32\REGSVR32.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    mURLSearchHooks: H - No File
    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: {9030d464-4c02-4abf-8ecc-5164760863c6} - Windows Live Sign-in Helper
    BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    BHO: {dbc80044-a445-435b-bc74-9c25c1c588a9} - Java(tm) Plug-In 2 SSV Helper
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    mRun: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    StartupFolder: C:\Users\scadmin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
    DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files%20(x86)/Jigsaw%20Puzzle%20Platinum/Images/stg_drm.ocx
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA975} - hxxp://www.3dvista.com/downloads/viewer3dv2.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files%20(x86)/Jigsaw%20Puzzle%20Platinum/Images/armhelper.ocx
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 192.168.137.1
    TCP: Interfaces\{5AF1A215-7054-49B8-8BFC-D023297881A1} : DhcpNameServer = 192.168.137.1
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
    BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
    BHO-X64: 0x1 - No File
    BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    BHO-X64: HP Print Enhancer - No File
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO-X64: Search Helper - No File
    BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO-X64: {9030D464-4C02-4ABF-8ECC-5164760863C6} - Windows Live Sign-in Helper
    BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: SkypeIEPluginBHO - No File
    BHO-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    BHO-X64: Ask Toolbar BHO - No File
    BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - Java(tm) Plug-In 2 SSV Helper
    BHO-X64: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    BHO-X64: HP Smart BHO Class - No File
    TB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
    TB-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    mRun-x64: [dellsupportcenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
    mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
    R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    S1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
    S1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
    S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
    S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
    S2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-10-23 92160]
    S2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
    S2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
    S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-7-11 42184]
    S2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-6-3 136176]
    S2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-6-8 375176]
    S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2011-1-11 15928]
    S2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\Windows\system32\drivers\LMIRfsDriver.sys --> C:\Windows\system32\drivers\LMIRfsDriver.sys [?]
    S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-7-11 366640]
    S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-3-14 632792]
    S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-5-5 206064]
    S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-6-3 136176]
    S3 lvpopf64;Logitech POP Suppression Filter;C:\Windows\system32\DRIVERS\lvpopf64.sys --> C:\Windows\system32\DRIVERS\lvpopf64.sys [?]
    S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?]
    S3 LVUVC64;Logitech Webcam 250(UVC);C:\Windows\system32\DRIVERS\lvuvc64.sys --> C:\Windows\system32\DRIVERS\lvuvc64.sys [?]
    S3 rcmirror;rcmirror;C:\Windows\system32\DRIVERS\rcmirror.sys --> C:\Windows\system32\DRIVERS\rcmirror.sys [?]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    .
    =============== Created Last 30 ================
    .
    2011-07-12 13:00:03 -------- d-sh--w- C:\$RECYCLE.BIN
    2011-07-12 08:31:20 -------- d-----w- C:\ComboFix
    2011-07-12 08:21:56 -------- d-----w- C:\## aswSnx private storage
    2011-07-12 08:21:41 -------- d-----w- C:\Users\scadmin\AppData\Local\SupportSoft
    2011-07-12 08:20:03 -------- d-----w- C:\Users\scadmin\AppData\Local\LogMeIn
    2011-07-12 07:36:35 208896 ----a-w- C:\Windows\MBR.exe
    2011-07-12 07:36:34 98816 ----a-w- C:\Windows\sed.exe
    2011-07-12 07:36:34 518144 ----a-w- C:\Windows\SWREG.exe
    2011-07-12 07:36:34 256000 ----a-w- C:\Windows\PEV.exe
    2011-07-12 07:11:20 -------- d-----w- C:\Users\scadmin\AppData\Roaming\Malwarebytes
    2011-07-11 17:50:06 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-07-11 16:58:14 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
    2011-07-11 16:58:12 64856 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
    2011-07-11 16:57:28 40112 ----a-w- C:\Windows\avastSS.scr
    2011-07-11 16:57:23 -------- d-----w- C:\ProgramData\AVAST Software
    2011-07-11 16:57:23 -------- d-----w- C:\Program Files\AVAST Software
    2011-07-11 08:09:29 607017 ------r- C:\dds.scr
    2011-07-11 05:59:07 -------- d-----w- C:\GeneFix12890G
    2011-07-11 03:08:16 -------- d-----w- C:\b34d75abe2bba4ba63fd22c4
    2011-07-10 22:13:13 -------- d-----w- C:\GeneFix
    2011-07-10 21:58:07 35712 ----a-w- C:\Windows\SysWow64\drivers\BlackBox.sys
    2011-07-10 04:01:05 60800 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\LMIproc.dll
    2011-07-10 04:01:04 33152 ----a-w- C:\Windows\System32\LMIport.dll
    2011-07-10 04:01:03 87456 ----a-w- C:\Windows\System32\LMIRfsClientNP.dll
    2011-07-10 04:01:03 72216 ----a-w- C:\Windows\System32\drivers\LMIRfsDriver.sys
    2011-07-10 04:00:59 80768 ----a-w- C:\Windows\System32\LMIinit.dll
    2011-07-10 04:00:54 -------- d-----w- C:\ProgramData\LogMeIn
    2011-07-10 04:00:46 -------- d-----w- C:\Program Files (x86)\LogMeIn
    2011-07-10 03:28:02 -------- d-----w- C:\Program Files\WiseFixer
    2011-07-10 00:52:05 -------- d-----w- C:\Program Files (x86)\Actual Installer
    2011-07-09 20:09:10 8873296 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{21376A12-41A2-499D-809C-57ADF3380CA1}\mpengine.dll
    2011-07-09 19:16:11 -------- d-----w- C:\ProgramData\MFAData
    2011-07-09 19:01:02 -------- d-----w- C:\ProgramData\Malwarebytes
    2011-07-09 19:00:58 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-07-09 19:00:33 -------- d-----w- C:\Program Files\CCleaner
    2011-07-09 18:47:29 -------- d-----w- C:\Downloads
    2011-07-02 16:43:59 -------- d-----w- C:\Windows\System32\SPReview
    2011-07-02 16:42:42 -------- d-----w- C:\Windows\System32\EventProviders
    2011-07-01 19:07:09 48976 ----a-w- C:\Windows\System32\netfxperf.dll
    2011-07-01 19:07:09 1942856 ----a-w- C:\Windows\System32\dfshim.dll
    2011-07-01 19:07:02 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
    2011-07-01 19:05:59 905216 ----a-w- C:\Windows\SysWow64\mmsys.cpl
    2011-07-01 19:04:58 323072 ----a-w- C:\Windows\SysWow64\drvstore.dll
    2011-07-01 19:04:58 257024 ----a-w- C:\Windows\SysWow64\dpx.dll
    2011-07-01 19:04:56 606208 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll
    2011-07-01 19:04:56 363008 ----a-w- C:\Windows\SysWow64\wbemcomn.dll
    2011-07-01 19:03:38 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
    2011-07-01 19:03:38 524288 ----a-w- C:\Windows\System32\wmicmiplugin.dll
    2011-07-01 19:03:38 1225216 ----a-w- C:\Windows\System32\wbem\wbemcore.dll
    2011-07-01 19:03:35 933376 ----a-w- C:\Windows\System32\SmiEngine.dll
    2011-07-01 19:03:33 199168 ----a-w- C:\Windows\System32\PkgMgr.exe
    2011-07-01 19:03:13 422912 ----a-w- C:\Windows\System32\drvstore.dll
    2011-07-01 19:03:13 399872 ----a-w- C:\Windows\System32\dpx.dll
    2011-06-16 16:01:08 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    2011-06-16 16:01:07 499200 ----a-w- C:\Windows\System32\drivers\afd.sys
    2011-06-16 16:01:07 288640 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
    2011-06-16 16:01:02 759296 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-06-16 16:01:02 1110528 ----a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-06-16 16:01:00 3135488 ----a-w- C:\Windows\System32\win32k.sys
    2011-06-16 16:01:00 289280 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
    2011-06-16 16:01:00 158208 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
    2011-06-16 16:01:00 128000 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
    2011-06-16 15:59:50 321024 ----a-w- C:\Windows\System32\d3d10_1core.dll
    2011-06-16 15:59:50 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
    2011-06-16 15:59:50 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
    2011-06-16 15:59:49 467456 ----a-w- C:\Windows\System32\drivers\srv.sys
    2011-06-16 15:59:49 410112 ----a-w- C:\Windows\System32\drivers\srv2.sys
    2011-06-16 15:59:49 219136 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
    2011-06-16 15:59:49 168448 ----a-w- C:\Windows\System32\drivers\srvnet.sys
    2011-06-16 15:59:48 861696 ----a-w- C:\Windows\System32\oleaut32.dll
    2011-06-16 15:59:48 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2011-06-16 15:59:44 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2011-06-16 15:59:44 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    .
    ==================== Find3M ====================
    .
    2011-07-02 16:51:43 175616 ----a-w- C:\Windows\System32\msclmd.dll
    2011-07-02 16:51:43 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
    2011-05-28 03:30:09 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-05-28 02:53:58 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-05-25 02:14:10 270720 ------w- C:\Windows\System32\MpSigStub.exe
    2011-05-24 11:42:55 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll
    2011-05-24 10:40:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll
    2011-05-24 10:40:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll
    2011-05-24 10:39:38 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll
    2011-05-24 10:37:54 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe
    2011-05-04 05:25:03 2315776 ----a-w- C:\Windows\System32\tquery.dll
    2011-05-04 05:22:25 778752 ----a-w- C:\Windows\System32\mssvp.dll
    2011-05-04 05:22:25 2223616 ----a-w- C:\Windows\System32\mssrch.dll
    2011-05-04 05:22:24 75264 ----a-w- C:\Windows\System32\msscntrs.dll
    2011-05-04 05:22:24 491520 ----a-w- C:\Windows\System32\mssph.dll
    2011-05-04 05:22:24 288256 ----a-w- C:\Windows\System32\mssphtb.dll
    2011-05-04 05:19:28 591872 ----a-w- C:\Windows\System32\SearchIndexer.exe
    2011-05-04 05:19:28 249856 ----a-w- C:\Windows\System32\SearchProtocolHost.exe
    2011-05-04 05:19:28 113664 ----a-w- C:\Windows\System32\SearchFilterHost.exe
    2011-05-04 04:34:43 1549312 ----a-w- C:\Windows\SysWow64\tquery.dll
    2011-05-04 04:32:02 666624 ----a-w- C:\Windows\SysWow64\mssvp.dll
    2011-05-04 04:32:01 337408 ----a-w- C:\Windows\SysWow64\mssph.dll
    2011-05-04 04:32:01 197120 ----a-w- C:\Windows\SysWow64\mssphtb.dll
    2011-05-04 04:32:01 1401344 ----a-w- C:\Windows\SysWow64\mssrch.dll
    2011-05-04 04:32:00 59392 ----a-w- C:\Windows\SysWow64\msscntrs.dll
    2011-05-04 04:28:31 86528 ----a-w- C:\Windows\SysWow64\SearchFilterHost.exe
    2011-05-04 04:28:31 427520 ----a-w- C:\Windows\SysWow64\SearchIndexer.exe
    2011-05-04 04:28:31 164352 ----a-w- C:\Windows\SysWow64\SearchProtocolHost.exe
    2011-04-22 22:15:29 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
    2011-04-22 22:08:29 1188864 ----a-w- C:\Windows\System32\wininet.dll
    2011-04-22 19:10:01 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    .
    ============= FINISH: 6:16:49.87 ===============
     
  14. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-06-23.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 11/10/2009 8:12:53 PM
    System Uptime: 7/12/2011 2:08:44 AM (4 hours ago)
    .
    Motherboard: Dell Inc. | | 0T287N
    Processor: Pentium(R) Dual-Core CPU E5300 @ 2.60GHz | Socket 775 | 2593/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 581 GiB total, 546.905 GiB free.
    D: is CDROM ()
    E: is Removable
    F: is Removable
    G: is Removable
    H: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: Security Processor Loader Driver
    Device ID: ROOT\LEGACY_SPLDR\0000
    Manufacturer:
    Name: Security Processor Loader Driver
    PNP Device ID: ROOT\LEGACY_SPLDR\0000
    Service: spldr
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: avast! Network Shield Support
    Device ID: ROOT\LEGACY_ASWTDI\0000
    Manufacturer:
    Name: avast! Network Shield Support
    PNP Device ID: ROOT\LEGACY_ASWTDI\0000
    Service: aswTdi
    .
    ==== System Restore Points ===================
    .
    RP533: 7/11/2011 9:51:04 AM - ComboFix created restore point
    RP534: 7/11/2011 9:57:16 AM - avast! Free Antivirus Setup
    .
    ==== Installed Programs ======================
    .
    Actual Installer 3.8
    Adobe AIR
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.1.2
    Adobe Reader 9.3
    Adobe Shockwave Player 11.5
    Ask Toolbar
    avast! Free Antivirus
    Belarc Advisor 8.1
    Boatload of Crosswords
    BufferChm
    CameraHelperMsi
    Championship Five Hundred All-Stars 7.30
    Championship Gin All-Stars 7.30
    Choice Guard
    Compatibility Pack for the 2007 Office system
    Consumer In-Home Service Agreement
    D1500
    Dealio Toolbar v4.0.1
    Dell Communications (Support Software)
    Dell Getting Started Guide
    Dell Support Center (Support Software)
    DeviceDiscovery
    DJ_SF_03_D1500_Software_Min
    Download Updater (AOL LLC)
    erLT
    Google Earth Plug-in
    Google Talk Plugin
    Google Toolbar for Internet Explorer
    Google Update Helper
    GoToAssist 8.0.0.514
    GPBaseService2
    Hardwood Solitaire III
    Hardwood Spades
    HP Update
    HPPhotoGadget
    HPPhotoSmartDiscLabelContent1
    HPPhotosmartEssential
    HPProductAssistant
    HPSSupply
    Infinite Crosswords
    Java Auto Updater
    Java(TM) 6 Update 20
    Junk Mail filter update
    Logitech Webcam Software
    LogMeIn
    LWS Facebook
    LWS Gallery
    LWS Help_main
    LWS Launcher
    LWS Motion Detection
    LWS Pictures And Video
    LWS Twitter
    LWS Video Mask Maker
    LWS Webcam Software
    LWS WLM Plugin
    LWS YouTube Plugin
    Malwarebytes' Anti-Malware version 1.51.0.1200
    MarketResearch
    Mavis Beacon Teaches Typing 17
    Microsoft Corporation
    Microsoft Digital Image Library 9 - Blocker
    Microsoft Digital Image Suite 2006
    Microsoft Digital Image Suite 2006 Editor
    Microsoft Digital Image Suite 2006 Library
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Word Viewer 2003
    Microsoft Picture It! Photo Premium 2001
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Works
    MSVCRT
    NetZero For Riverdeep
    Picasa 3
    PowerDVD DX
    Print Artist 2003
    Realtek High Definition Audio Driver
    Registry Mechanic 10.0
    Roxio Burn
    Roxio Update Manager
    Ruckus Buck's Dangerous Mines
    SCRABBLE
    Security Update for CAPICOM (KB931906)
    Shockwave
    SierraAddressBook 3.0
    Simply Money 2.5
    Skype Toolbars
    Skype™ 4.2
    SmartWebPrinting
    SolutionCenter
    Status
    Sudoku Quest
    Super Jigsaw - Puppies (remove only)
    Toolbox
    TrayApp
    UnloadSupport
    Verizon High Speed Internet
    Visual C++ 8.0 Runtime Setup Package (x64)
    Vz In Home Agent
    Web Games Player Plugin
    WebReg
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    WinPatrol 2009
    WordUp
    Works Suite OS Pack
    .
    ==== Event Viewer Messages From Past Week ========
    .
    7/9/2011 9:52:01 AM, Error: Service Control Manager [7034] - The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:15:01 AM, Error: Service Control Manager [7034] - The Windows installer service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:13:16 AM, Error: Service Control Manager [7034] - The SupportSoft Sprocket Service (DellSupportCenter) service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:42 AM, Error: Service Control Manager [7034] - The AVG9IDSAgent service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:36 AM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 2 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The SupportSoft Sprocket Service (DellComms) service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The SAS Core Service service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The PC Tools Startup and Shutdown Monitor service service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The MSCamSvc service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The Dock Login Service service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7034] - The AVG Firewall service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 9:11:35 AM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    7/9/2011 4:33:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service stisvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    7/9/2011 12:56:55 PM, Error: Application Popup [1060] - \??\C:\GeneFix7300G\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
    7/9/2011 12:53:57 PM, Error: Service Control Manager [7034] - The SoftThinks Agent Service service terminated unexpectedly. It has done this 1 time(s).
    7/9/2011 12:08:25 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004
    7/9/2011 11:33:35 AM, Error: Service Control Manager [7000] - The AVG WatchDog service failed to start due to the following error: The system cannot find the file specified.
    7/9/2011 11:33:35 AM, Error: Service Control Manager [7000] - The AVG Firewall service failed to start due to the following error: The system cannot find the file specified.
    7/9/2011 11:33:31 AM, Error: Service Control Manager [7002] - The AVG9IDSAgent service depends on the AVGIDSDriver group and no member of this group started.
    7/9/2011 11:33:31 AM, Error: Service Control Manager [7001] - The AVG9IDSDriver service depends on the AVG9IDSFilter service which failed to start because of the following error: The system cannot find the path specified.
    7/9/2011 11:33:31 AM, Error: Service Control Manager [7000] - The AVG9IDSFilter service failed to start due to the following error: The system cannot find the path specified.
    7/9/2011 11:24:28 AM, Error: Application Popup [1060] - \??\C:\GeneFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
    7/9/2011 10:25:55 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx64 AvgMfx64 discache SASDIFSV SASKUTIL spldr Wanarpv6
    7/9/2011 1:28:53 PM, Error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
    7/8/2011 9:02:01 AM, Error: Service Control Manager [7034] - The Windows installer service terminated unexpectedly. It has done this 2 time(s).
    7/8/2011 11:36:05 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the AVG WatchDog service to connect.
    7/8/2011 11:36:05 AM, Error: Service Control Manager [7000] - The AVG WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    7/7/2011 9:20:01 PM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 4 time(s).
    7/7/2011 9:19:59 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    7/7/2011 9:19:58 PM, Error: Service Control Manager [7034] - The AVG Firewall service terminated unexpectedly. It has done this 2 time(s).
    7/7/2011 9:19:58 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    7/7/2011 9:15:06 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgfwfd AvgLdx64 AvgMfx64 AvgTdiA DfsC discache NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx Wanarpv6 WfpLwf
    7/7/2011 8:30:39 PM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 5 time(s).
    7/7/2011 8:30:39 PM, Error: Service Control Manager [7034] - The AVG Firewall service terminated unexpectedly. It has done this 3 time(s).
    7/7/2011 8:30:38 PM, Error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
    7/7/2011 10:54:07 PM, Error: Service Control Manager [7034] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s).
    7/12/2011 6:16:20 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    7/12/2011 2:09:55 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    7/12/2011 2:09:54 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    7/12/2011 2:09:54 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    7/12/2011 2:09:48 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    7/12/2011 2:09:07 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx aswSP aswTdi discache SASDIFSV SASKUTIL spldr Wanarpv6
    7/12/2011 2:07:57 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    7/12/2011 12:18:12 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
    7/12/2011 12:18:12 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    7/12/2011 1:33:13 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
    7/12/2011 1:22:07 AM, Error: Service Control Manager [7001] - The MBAMService service depends on the MBAMProtector service which failed to start because of the following error: The system cannot find the file specified.
    7/12/2011 1:22:07 AM, Error: Service Control Manager [7000] - The MBAMProtector service failed to start due to the following error: The system cannot find the file specified.
    7/12/2011 1:21:49 AM, Error: Microsoft-Windows-WMPNSS-Service [14324] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(WindowsMediaPlayer) encountered error '0x80004002'. If possible, reinstall Windows Media Player.
    7/11/2011 9:51:41 AM, Error: Service Control Manager [7034] - The Andrea RT Filters Service service terminated unexpectedly. It has done this 1 time(s).
    7/11/2011 9:32:05 AM, Error: Service Control Manager [7034] - The hpqcxs08 service terminated unexpectedly. It has done this 1 time(s).
    7/11/2011 9:32:05 AM, Error: Service Control Manager [7034] - The HP CUE DeviceDiscovery Service service terminated unexpectedly. It has done this 1 time(s).
    7/11/2011 8:20:14 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package (KB2538243).
    7/11/2011 1:05:11 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache SASDIFSV SASKUTIL spldr Wanarpv6
    7/10/2011 9:25:36 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff800030685ed, 0xfffff88007304ce0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071011-24039-01.
    7/10/2011 8:09:24 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 4 Client Profile for Windows 7 x64-based Systems (KB982670).
    7/10/2011 4:21:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    7/10/2011 4:14:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service LMIGuardianSvc with arguments "" in order to run the server: {D4258A22-CF85-489D-83AE-49FCD0DFAD29}
    7/10/2011 3:08:26 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    7/10/2011 3:06:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    7/10/2011 3:06:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    7/10/2011 3:06:00 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx Wanarpv6 WfpLwf
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    7/10/2011 3:05:59 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    .
    ==== End Of File ===========================
  15. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Okay, let's start with some questions and comments:

    1. Are you a developer? What are you using this for> Actual Installer 3.8? Is it still in the Trial Period or have you paid for it. If in Trial, recommend uninstall.
    2, It appears you have received remote at some period. Processes for LogMeIn are still running. It would be best to stop and remove if not using now.
    07-10 04:00:46 -------- d-----w- C:\Program Files (x86)\LogMeIn
    3. There are numerous entries for Ask Toolbar We can remove them. But I wanted to caution you that this is often pre-checked on some download screens. It's best to check all download screens and uncheck any pre-checks before you download.
    ====================================================
    There is still a directory for Combofix on the C Drive. IF you haven't uninstalled Combofix, please do so as follows. IF you have uninstalled Combofix, use Windows Explorer to navigate to the C Drive > right click> Delete C:\ComboFix
    Please note: If you have Combofix on the desktop already, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    I also see entries for AVG9 on the system. Combofix won't run with AVG so you will need to temporarily remove it as follows:
    Download AppRemover and save to the desktop
    1. Double click the setup on the desktop> click Next
    2. Select “Remove Security Application”
    3. Let scan finish to determine security apps
    4. A screen like below will appear:
      [​IMG]
    5. Click on Next after choice has been made
    6. Check the AVG program you want to uninstall
    7. After uninstall shows complete, follow online prompts to Exit the program.

    Since you have Avast on the system, you will not need a temporary replacement for AVG.
    =============================
    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.

    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
    =========================================
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESETOnlineScan
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
      [​IMG]
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish

    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    ==================================
    Note: Some of what I have to do is to remove left-over processes from programs you gathered to 'fix' the system.
  16. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    From the time that I last posted till the time that I recevied your post (~12 hrs) the computer seems to be reinfected as if I had not run any scans at all. I have a fake security alert, I can NOT run any executables (a little popup says I am infected by a Blaster virus), no task manager, all my desktop and document files are hidden. I'm going to reboot in safe mode and run a combofix. I think it is best to keep this computer off the internet till we know it is cured. I'll post the ComboFix log next.
  17. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    It's wierd... ComboFix isn't detecting anything.

    ComboFix 11-07-07.03 - scadmin 07/12/2011 19:13:44.10.2 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4085.2800 [GMT -7:00]
    Running from: c:\users\scadmin\Desktop\ComboFix.exe
    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    - REDUCED FUNCTIONALITY MODE -
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-06-13 to 2011-07-13 )))))))))))))))))))))))))))))))
    .
    .
    2011-07-13 02:17 . 2011-07-13 02:17 -------- d-----w- c:\users\MERV\AppData\Local\temp
    2011-07-13 02:17 . 2011-07-13 02:17 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-07-13 02:17 . 2011-07-13 02:17 -------- d-----w- c:\users\Merv & Fran\AppData\Local\temp
    2011-07-12 22:44 . 2011-07-12 22:44 920576 ----a-w- c:\programdata\defender.exe
    2011-07-12 07:02 . 2011-07-12 08:21 -------- d-----w- c:\users\scadmin
    2011-07-11 17:50 . 2011-05-29 16:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
    2011-07-11 16:58 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2011-07-11 16:58 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2011-07-11 16:58 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2011-07-11 16:58 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2011-07-11 16:58 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2011-07-11 16:58 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
    2011-07-11 16:58 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2011-07-11 16:57 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
    2011-07-11 16:57 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
    2011-07-11 16:57 . 2011-07-11 16:57 -------- d-----w- c:\programdata\AVAST Software
    2011-07-11 16:57 . 2011-07-11 16:57 -------- d-----w- c:\program files\AVAST Software
    2011-07-11 08:09 . 2011-07-10 21:56 607017 ------r- C:\dds.scr
    2011-07-11 03:08 . 2011-07-11 03:09 -------- d-----w- C:\b34d75abe2bba4ba63fd22c4
    2011-07-10 22:13 . 2011-07-10 23:08 -------- d-----w- C:\GeneFix
    2011-07-10 21:58 . 2011-07-11 03:33 35712 ----a-w- c:\windows\SysWow64\drivers\BlackBox.sys
    2011-07-10 04:18 . 2011-07-11 04:29 -------- d-----w- c:\users\LogMeInRemoteUser
    2011-07-10 04:01 . 2011-07-10 04:01 -------- d-----w- c:\users\Merv & Fran\AppData\Local\LogMeIn
    2011-07-10 04:01 . 2011-06-08 20:06 60800 ----a-w- c:\windows\system32\Spool\prtprocs\x64\LMIproc.dll
    2011-07-10 04:01 . 2011-06-08 20:06 33152 ----a-w- c:\windows\system32\LMIport.dll
    2011-07-10 04:01 . 2011-06-08 20:06 87456 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
    2011-07-10 04:01 . 2011-01-12 02:04 72216 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys
    2011-07-10 04:00 . 2011-06-08 20:06 80768 ----a-w- c:\windows\system32\LMIinit.dll
    2011-07-10 04:00 . 2011-07-13 07:00 -------- d-----w- c:\programdata\LogMeIn
    2011-07-10 04:00 . 2011-07-10 04:00 -------- d-----w- c:\program files (x86)\LogMeIn
    2011-07-10 03:28 . 2011-07-10 03:28 -------- d-----w- c:\program files\WiseFixer
    2011-07-10 00:52 . 2011-07-10 00:52 -------- d-----w- c:\program files (x86)\Actual Installer
    2011-07-09 20:09 . 2011-06-20 15:57 8873296 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{21376A12-41A2-499D-809C-57ADF3380CA1}\mpengine.dll
    2011-07-09 19:16 . 2011-07-09 19:16 -------- d-----w- c:\programdata\MFAData
    2011-07-09 19:01 . 2011-07-09 19:01 -------- d-----w- c:\users\Merv & Fran\AppData\Roaming\Malwarebytes
    2011-07-09 19:01 . 2011-07-09 19:01 -------- d-----w- c:\programdata\Malwarebytes
    2011-07-09 19:00 . 2011-07-11 17:50 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2011-07-09 19:00 . 2011-07-09 19:00 -------- d-----w- c:\program files\CCleaner
    2011-07-09 18:47 . 2011-07-12 21:55 -------- d-----w- C:\Downloads
    2011-07-02 16:43 . 2011-07-02 16:43 -------- d-----w- c:\windows\system32\SPReview
    2011-07-02 16:42 . 2011-07-02 16:42 -------- d-----w- c:\windows\system32\EventProviders
    2011-07-01 19:07 . 2010-11-05 01:57 48976 ----a-w- c:\windows\system32\netfxperf.dll
    2011-07-01 19:07 . 2010-11-05 01:57 1942856 ----a-w- c:\windows\system32\dfshim.dll
    2011-07-01 19:07 . 2010-11-05 01:58 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
    2011-07-01 19:05 . 2010-11-20 13:34 363392 ----a-w- c:\windows\system32\drivers\volmgrx.sys
    2011-07-01 19:04 . 2010-11-20 12:18 323072 ----a-w- c:\windows\SysWow64\drvstore.dll
    2011-07-01 19:04 . 2010-11-20 12:18 257024 ----a-w- c:\windows\SysWow64\dpx.dll
    2011-07-01 19:04 . 2010-11-20 12:21 363008 ----a-w- c:\windows\SysWow64\wbemcomn.dll
    2011-07-01 19:04 . 2010-11-20 12:19 606208 ----a-w- c:\windows\SysWow64\wbem\fastprox.dll
    2011-07-01 19:03 . 2010-11-20 13:27 524288 ----a-w- c:\windows\system32\wmicmiplugin.dll
    2011-07-01 19:03 . 2010-11-20 13:27 529408 ----a-w- c:\windows\system32\wbemcomn.dll
    2011-07-01 19:03 . 2010-11-20 13:27 1225216 ----a-w- c:\windows\system32\wbem\wbemcore.dll
    2011-07-01 19:03 . 2010-11-20 13:27 933376 ----a-w- c:\windows\system32\SmiEngine.dll
    2011-07-01 19:03 . 2010-11-20 13:25 199168 ----a-w- c:\windows\system32\PkgMgr.exe
    2011-07-01 19:03 . 2010-11-20 13:26 422912 ----a-w- c:\windows\system32\drvstore.dll
    2011-07-01 19:03 . 2010-11-20 13:26 399872 ----a-w- c:\windows\system32\dpx.dll
    2011-06-16 16:01 . 2011-04-25 05:33 1923968 ----a-w- c:\windows\system32\drivers\tcpip.sys
    2011-06-16 16:01 . 2011-04-25 02:34 499200 ----a-w- c:\windows\system32\drivers\afd.sys
    2011-06-16 16:01 . 2010-11-20 13:33 288640 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
    2011-06-16 16:01 . 2011-04-29 05:55 1110528 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-06-16 16:01 . 2011-04-29 04:57 759296 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
    2011-06-16 16:01 . 2011-05-28 03:06 3135488 ----a-w- c:\windows\system32\win32k.sys
    2011-06-16 16:01 . 2011-04-27 02:40 158208 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2011-06-16 16:01 . 2011-04-27 02:39 289280 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2011-06-16 16:01 . 2011-04-27 02:39 128000 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
    2011-06-16 15:59 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
    2011-06-16 15:59 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
    2011-06-16 15:59 . 2010-11-20 13:26 321024 ----a-w- c:\windows\system32\d3d10_1core.dll
    2011-06-16 15:59 . 2011-04-29 03:06 467456 ----a-w- c:\windows\system32\drivers\srv.sys
    2011-06-16 15:59 . 2011-04-29 03:05 410112 ----a-w- c:\windows\system32\drivers\srv2.sys
    2011-06-16 15:59 . 2011-04-29 03:05 168448 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-06-16 15:59 . 2010-11-20 12:18 219136 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
    2011-06-16 15:59 . 2011-02-25 06:22 861696 ----a-w- c:\windows\system32\oleaut32.dll
    2011-06-16 15:59 . 2011-02-25 05:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
    2011-06-16 15:59 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
    2011-06-16 15:59 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-07-02 16:51 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
    2011-07-02 16:51 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
    2011-05-25 02:14 . 2009-11-11 19:04 270720 ------w- c:\windows\system32\MpSigStub.exe
    2011-04-22 22:15 . 2011-05-24 23:40 27520 ----a-w- c:\windows\system32\drivers\Diskdump.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-07-12_09.10.39 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2009-07-14 04:54 . 2011-07-12 08:22 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:54 . 2011-07-13 15:17 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-07-14 04:54 . 2011-07-12 08:22 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 04:54 . 2011-07-13 15:17 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2011-07-12 08:22 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2011-07-13 15:17 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-10-23 05:22 . 2011-07-12 23:09 67764 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2011-07-13 15:17 55338 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2009-11-11 01:58 . 2011-07-13 15:15 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-11-11 01:58 . 2011-07-12 08:19 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2011-07-11 00:31 . 2011-07-12 08:19 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2011-07-11 00:31 . 2011-07-13 15:15 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2011-07-12 08:19 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2011-07-13 15:15 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-11-11 19:02 . 2011-07-12 09:09 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-11-11 19:02 . 2011-07-13 15:15 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-11-11 19:02 . 2011-07-12 09:09 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-11-11 19:02 . 2011-07-13 15:15 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-11-11 19:02 . 2011-07-12 09:09 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-11-11 19:02 . 2011-07-13 15:15 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-11-11 06:11 . 2011-07-12 06:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-11-11 06:11 . 2011-07-13 15:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-11-11 06:11 . 2011-07-13 15:03 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-11-11 06:11 . 2011-07-12 06:02 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2011-07-12 09:09 . 2011-07-12 09:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2011-07-13 02:19 . 2011-07-13 15:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2011-07-13 02:19 . 2011-07-13 15:15 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2011-07-12 09:09 . 2011-07-12 09:09 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-07-14 05:01 . 2011-07-13 02:18 392972 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    - 2009-07-14 05:01 . 2011-07-12 08:22 392972 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2011-04-16 15:44 . 2011-04-16 15:44 2770944 c:\windows\Installer\2ca31.msi
    + 2011-04-16 07:14 . 2011-04-16 07:14 3186176 c:\windows\Installer\2b81f1.msi
    + 2011-04-16 07:14 . 2011-04-16 07:14 3186176 c:\windows\Installer\2928e.msi
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    2010-09-29 06:44 1400712 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "dellsupportcenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 136176]
    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
    R3 BlackBox;BlackBox SR2; [x]
    R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 136176]
    R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
    R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
    R3 LVUVC64;Logitech Webcam 250(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
    R3 rcmirror;rcmirror;c:\windows\system32\DRIVERS\rcmirror.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
    S1 aswSnx;aswSnx; [x]
    S1 aswSP;aswSP; [x]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2010-02-17 14920]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2010-02-17 12360]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2010-06-29 128752]
    S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-03-31 92160]
    S2 aswFsBlk;aswFsBlk; [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
    S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
    S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-06-08 375176]
    S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [2011-01-12 15928]
    S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-10-01 632792]
    S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-05-05 206064]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 21:51]
    .
    2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-03 21:51]
    .
    2011-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-767072614-1521476138-1784173723-1000Core.job
    - c:\users\Merv & Fran\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-15 01:14]
    .
    2011-07-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-767072614-1521476138-1784173723-1000UA.job
    - c:\users\Merv & Fran\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-15 01:14]
    .
    2011-07-13 c:\windows\Tasks\RMSchedule.job
    - c:\program files (x86)\Registry Mechanic\RegMech.exe [2011-03-14 00:05]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2011-01-12 57928]
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\system32\blank.htm
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    TCP: DhcpNameServer = 192.168.137.1
    DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
    DPF: {2D72C39D-53F6-4AEA-A9DB-1298429DA975} - hxxp://www.3dvista.com/downloads/viewer3dv2.cab
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVAST Software\Avast\AvastSvc.exe
    c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe
    .
    **************************************************************************
    .
    Completion time: 2011-07-13 08:35:29 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-07-13 15:35
    ComboFix2.txt 2011-07-12 18:45
    ComboFix3.txt 2011-07-12 09:28
    ComboFix4.txt 2011-07-11 09:26
    .
    Pre-Run: 588,377,141,248 bytes free
    Post-Run: 587,202,760,704 bytes free
    .
    - - End Of File - - C13D9720D6FFC7209D438771DDB05F93
  18. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    1) I am not a developer... Actual Installer is uninstalled.
    2) LogMeIn is uninstalled.
    3) I tried to uninstall Ask ToolBar, but it is prompting me that it can not find the uninstall files. I tried reinstalling Ask, but it says it wont because there is already and existing installation.
  19. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    I just plugged in the internet long enough to download and install ESET. I've unplugged the network cable and I'm running the scan now.
  20. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    ESET log...

    C:\ProgramData\defender.exe a variant of Win32/Kryptik.QIA trojan
    C:\Users\All Users\defender.exe a variant of Win32/Kryptik.QIA trojan
  21. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    Also... AppFinder did NOT detect AVG. Before contacting you, I did run a AVG remover tool downloaded directly from AVG just so I could run ComboFix. This is probably why AppFinder isn't detecting anything. What shall I do next?
  22. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    Let's talk about this. According to Combofix, this is the third time you've run it. You were instructed to uninstall Combofix and download it from the link given.

    Combofix also show me thast you did not disable the security as directed:
    Combofix also ran in the Reduced Functionality Mode. This can be:
    1. Because you didn't disable the security program.
    2. Because it's an old version.
    3. Because the activation failed.
    4. Because the OS isn't legitimate:
    You've had this system for 9 months and there are no update or hotfixes.
  23. sccomputerguys

    sccomputerguys Newcomer, in training Topic Starter Posts: 20

    Thank you for your time, however, my client became impatient and instructed me to backup their data and reload the OS. Obviously, everything is working smoothly.
  24. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +32

    For 22 posts, you presented this as your system, Gene. Now, when I ask a question you can't or won't answer, the system now belongs to "my client" and that client is impatient!

    Possible are you part of this? Southern California Computer Guys

    This thread is closed
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.