also @ TechSpot: Google, Samsung unveil Chromebook, Chromebox with Chrome OS 19

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Active] Smart Engine picked up

Discussion in 'Virus and Malware Removal' started by hlratliff, Nov 4, 2010.

Thread Status:
Not open for further replies.
Page 2 of 2

  1. hlratliff Newcomer, in training

    Good morning Bobbye. Sorry to hear about your internet connection problems. That can be very frustrating. I really appreciate your help and figured you must be having problems because you are usually right on top of things. Anyway, below you will find the combofix log. I await to hear from you.

    ComboFix 10-11-10.03 - Hailey 11/11/2010 10:57:53.4.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.361 [GMT -5:00]
    Running from: c:\documents and settings\Hailey\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Hailey\Desktop\CFScript.txt
    AV: avast! antivirus 4.8.1368 [VPS 101111-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

    FILE ::
    "c:\docume~1\hailey\locals~1\temp\ftsbvcap.sys"
    "c:\docume~1\hailey\locals~1\temp\isffp_sd.sys"
    "c:\docume~1\hailey\locals~1\temp\lredbooo.sys"
    "c:\documents and settings\All Users\Application Data\TEMP"
    "d:\PciCon.sys"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\alluse~1\applic~1\SMWBSJMZDAE
    c:\docume~1\alluse~1\applic~1\SMWBSJMZDAE\SMBQUEBBE.cfg

    .
    ((((((((((((((((((((((((( Files Created from 2010-10-11 to 2010-11-11 )))))))))))))))))))))))))))))))
    .

    2010-11-05 18:44 . 2010-11-05 18:44 -------- d-----w- c:\program files\ESET
    2010-11-05 02:03 . 2010-11-05 02:03 -------- d-----w- c:\program files\7-Zip
    2010-11-04 19:24 . 2010-11-04 19:26 -------- d-----w- c:\program files\CCleaner
    2010-10-31 12:12 . 2010-10-31 12:12 -------- d-----w- c:\documents and settings\Hailey\Local Settings\Application Data\HP
    2010-10-31 12:11 . 2010-11-11 12:59 -------- d-----w- c:\documents and settings\Hailey\Local Settings\Application Data\ApplicationHistory
    2010-10-28 22:58 . 2010-10-28 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
    2010-10-28 22:56 . 2010-10-28 22:57 -------- d-----w- c:\program files\Common Files\HP
    2010-10-28 22:55 . 2010-10-28 22:55 -------- d-----w- c:\program files\Hewlett-Packard
    2010-10-28 22:54 . 2010-10-28 22:54 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
    2010-10-28 22:53 . 2010-10-28 22:53 -------- d-----w- c:\windows\system32\URTTEMP
    2010-10-28 22:48 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
    2010-10-28 22:48 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
    2010-10-28 22:38 . 2007-08-09 07:27 73728 ----a-w- c:\windows\system32\HPZipm12.exe
    2010-10-28 22:38 . 2004-09-29 16:15 204800 ----a-w- c:\windows\system32\HPZipr12.dll
    2010-10-28 22:38 . 2004-09-29 16:12 278584 ----a-w- c:\windows\system32\HPZidr12.dll
    2010-10-28 22:38 . 2004-09-29 16:09 57344 ----a-w- c:\windows\system32\HPZisn12.dll
    2010-10-28 22:38 . 2004-09-29 16:09 94208 ----a-w- c:\windows\system32\HPZipt12.dll
    2010-10-28 22:38 . 2004-09-29 16:08 61440 ----a-w- c:\windows\system32\HPZinw12.exe
    2010-10-28 22:37 . 2010-10-28 22:58 -------- d-----w- c:\program files\HP
    2010-10-28 22:19 . 2004-12-15 07:07 21744 ----a-w- c:\windows\system32\drivers\HPZius12.sys
    2010-10-28 22:19 . 2004-12-15 07:07 16496 ----a-w- c:\windows\system32\drivers\HPZipr12.sys
    2010-10-28 22:19 . 2004-12-15 07:07 51120 ----a-w- c:\windows\system32\drivers\HPZid412.sys
    2010-10-28 22:18 . 2004-12-15 07:07 274432 ----a-w- c:\windows\system32\HPZc3212.dll
    2010-10-28 22:18 . 2004-12-15 07:07 581632 ----a-w- c:\windows\system32\hpotscl.dll
    2010-10-28 22:18 . 2004-12-15 07:07 229376 ----a-w- c:\windows\system32\hpovst08.dll
    2010-10-28 22:18 . 2004-12-15 07:07 278528 ----a-w- c:\windows\system32\hpgwiamd.dll
    2010-10-28 22:17 . 2004-12-15 07:07 139345 ----a-w- c:\windows\system32\hpzlnt12.dll
    2010-10-28 22:17 . 2004-12-15 07:07 393216 ----a-w- c:\windows\system32\hpzcon12.dll
    2010-10-28 22:17 . 2004-12-15 07:07 196608 ----a-w- c:\windows\system32\hpzcoi12.dll
    2010-10-17 23:10 . 2010-10-17 23:10 -------- d-----w- c:\documents and settings\Hailey\Application Data\Malwarebytes
    2010-10-17 23:10 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-17 23:10 . 2010-10-17 23:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-10-17 23:10 . 2010-10-17 23:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-17 23:10 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-15 10:56 . 2010-10-15 10:56 -------- d-----w- c:\program files\iPod
    2010-10-15 10:56 . 2010-10-15 10:57 -------- d-----w- c:\program files\iTunes

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-20 11:38 . 2009-11-07 18:36 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-09-20 11:38 . 2009-03-14 21:31 15880 ----a-w- c:\windows\system32\lsdelete.exe
    2010-09-20 11:38 . 2009-03-14 21:09 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-09-08 15:17 . 2010-09-08 15:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 15:17 . 2010-09-08 15:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
    .

    ((((((((((((((((((((((((((((( SnapShot@2010-11-05_19.32.21 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2010-11-11 12:59 . 2010-11-11 12:59 16384 c:\windows\Temp\Perflib_Perfdata_6dc.dat
    + 2010-11-11 12:59 . 2010-11-11 12:59 16384 c:\windows\Temp\Perflib_Perfdata_288.dat
    + 2004-08-04 12:00 . 2010-11-07 21:54 71002 c:\windows\system32\perfc009.dat
    - 2004-08-04 12:00 . 2010-10-28 22:53 71002 c:\windows\system32\perfc009.dat
    + 2004-08-04 12:00 . 2010-11-07 21:54 440684 c:\windows\system32\perfh009.dat
    - 2004-08-04 12:00 . 2010-10-28 22:53 440684 c:\windows\system32\perfh009.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
    "Google Update"="c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-18 136176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-25 5898240]
    "nwiz"="nwiz.exe" [2006-07-25 1519616]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-25 86016]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-09-20 864112]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]

    c:\documents and settings\Hailey\Start Menu\Programs\Startup\
    OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
    HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
    Wireless Configuration Utility HW.15.lnk - c:\program files\TRENDnet\TRENDnet TEW-421PC_TEW-423PI\WlanCU.exe [2007-1-30 577536]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [3/14/2009 4:09 PM 64288]
    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [9/14/2010 6:43 PM 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/14/2010 6:43 PM 20560]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 6:17 AM 1352832]
    R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [10/2/2002 8:57 AM 13532]
    S3 isffp_sd;isffp_sd;\??\c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys --> c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-11-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 11:37]

    2010-11-08 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

    2010-11-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-1275210071-839522115-1004Core.job
    - c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-04 11:39]

    2010-11-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-1275210071-839522115-1004UA.job
    - c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-04 11:39]
    .
    .
    ------- Supplementary Scan -------
    .
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    FF - ProfilePath - c:\documents and settings\Hailey\Application Data\Mozilla\Firefox\Profiles\mbvfz1x4.default\
    FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
    FF - component: c:\documents and settings\Hailey\Application Data\Mozilla\Firefox\Profiles\mbvfz1x4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
    FF - component: c:\documents and settings\Hailey\Application Data\Mozilla\Firefox\Profiles\mbvfz1x4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
    FF - plugin: c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-11 11:03
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2010-11-11 11:04:54
    ComboFix-quarantined-files.txt 2010-11-11 16:04
    ComboFix2.txt 2010-11-09 03:06
    ComboFix3.txt 2010-11-07 22:55
    ComboFix4.txt 2010-11-05 19:34

    Pre-Run: 49,045,602,304 bytes free
    Post-Run: 49,035,489,280 bytes free

    - - End Of File - - 5171EB988B66DB5F772C26CA5E144C57
    hlratliff, Nov 11, 2010
    #21

  2. Bobbye Helper on the Fringe

    Thanks for the patience. The problem started again this morning but there was already a tech on the way. I "think" he resolved the problem- which we couldn't find!!

    Do you have any idea what this is?
    c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys
    I removed it with script, it shows deleted but it's back on this Combofix log. I'm going to try and get some info on it: The closet I came for an ID was related to the Forrestry Service Symposium in Malysia which did not ppear to be computer related.

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      
:file
c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys

:service
isffp_sd
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
    Bobbye, Nov 11, 2010
    #22

  3. hlratliff Newcomer, in training

    I have no idea what c:\docume~1\Hailey etc... is. Below is the log.



    SystemLook 04.09.10 by jpshortstuff
    Log created at 14:09 on 11/11/2010 by Hailey
    Administrator - Elevation successful

    ========== file ==========

    c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys - Unable to find/read file.

    ========== service ==========

    isffp_sd
    isffp_sd
    (No Description)
    Current Status: Stopped
    Startup Type: Demand
    Error Control: Critical
    Binary: \??\C:\DOCUME~1\Hailey\LOCALS~1\Temp\isffp_sd.sys
    Group: (none)
    SafeBoot:
    Dependencies:
    (none)
    Dependant Services:
    (none)

    -= EOF =-
    hlratliff, Nov 11, 2010
    #23

  4. Bobbye Helper on the Fringe

    Please run this Custom CFScript

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad and copy/paste the text in the code below into it:
    Code:
    File::
c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys 

Driver::
isffp_sd
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste into to your next reply.
    ====================
    The Service is stopped, set to run on Demand. When you finish running the script again, Please do the following:
    Use Windows Exxplorer: Windows key + E> with WE open> click on Tools> Folder Options> View tab> Check 'show hidden files and folders'> uncheck 'hide operating system files (Recommended)> Apply> OK
    Now click on My Computer> Local Drive (C)> Documents and Settings> Hailey documents and settings> look for the following> delete if found:
    \c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys --> c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys.
    Go back and rehide the files and folders
    Bobbye, Nov 12, 2010
    #24

  5. hlratliff Newcomer, in training

    Good evening Bobbye. I ran the script and will post the log. I also unhid the files and folders and the operating system files. I did not find the document or file. I will await to hear from you as to what we are going to do next. Thank you again for all your help.

    ComboFix 10-11-12.01 - Hailey 11/12/2010 18:27:41.5.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.426 [GMT -5:00]
    Running from: c:\documents and settings\Hailey\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Hailey\Desktop\CFScript.txt
    AV: avast! antivirus 4.8.1368 [VPS 101112-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

    FILE ::
    "c:\docume~1\Hailey\LOCALS~1\Temp\isffp_sd.sys"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_isffp_sd


    ((((((((((((((((((((((((( Files Created from 2010-10-12 to 2010-11-12 )))))))))))))))))))))))))))))))
    .

    2010-11-05 18:44 . 2010-11-05 18:44 -------- d-----w- c:\program files\ESET
    2010-11-05 02:03 . 2010-11-05 02:03 -------- d-----w- c:\program files\7-Zip
    2010-11-04 19:24 . 2010-11-04 19:26 -------- d-----w- c:\program files\CCleaner
    2010-10-31 12:12 . 2010-10-31 12:12 -------- d-----w- c:\documents and settings\Hailey\Local Settings\Application Data\HP
    2010-10-31 12:11 . 2010-11-12 23:32 -------- d-----w- c:\documents and settings\Hailey\Local Settings\Application Data\ApplicationHistory
    2010-10-28 22:58 . 2010-10-28 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
    2010-10-28 22:56 . 2010-10-28 22:57 -------- d-----w- c:\program files\Common Files\HP
    2010-10-28 22:55 . 2010-10-28 22:55 -------- d-----w- c:\program files\Hewlett-Packard
    2010-10-28 22:54 . 2010-10-28 22:54 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
    2010-10-28 22:53 . 2010-10-28 22:53 -------- d-----w- c:\windows\system32\URTTEMP
    2010-10-28 22:48 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
    2010-10-28 22:48 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
    2010-10-28 22:38 . 2007-08-09 07:27 73728 ----a-w- c:\windows\system32\HPZipm12.exe
    2010-10-28 22:38 . 2004-09-29 16:15 204800 ----a-w- c:\windows\system32\HPZipr12.dll
    2010-10-28 22:38 . 2004-09-29 16:12 278584 ----a-w- c:\windows\system32\HPZidr12.dll
    2010-10-28 22:38 . 2004-09-29 16:09 57344 ----a-w- c:\windows\system32\HPZisn12.dll
    2010-10-28 22:38 . 2004-09-29 16:09 94208 ----a-w- c:\windows\system32\HPZipt12.dll
    2010-10-28 22:38 . 2004-09-29 16:08 61440 ----a-w- c:\windows\system32\HPZinw12.exe
    2010-10-28 22:37 . 2010-10-28 22:58 -------- d-----w- c:\program files\HP
    2010-10-28 22:19 . 2004-12-15 07:07 21744 ----a-w- c:\windows\system32\drivers\HPZius12.sys
    2010-10-28 22:19 . 2004-12-15 07:07 16496 ----a-w- c:\windows\system32\drivers\HPZipr12.sys
    2010-10-28 22:19 . 2004-12-15 07:07 51120 ----a-w- c:\windows\system32\drivers\HPZid412.sys
    2010-10-28 22:18 . 2004-12-15 07:07 274432 ----a-w- c:\windows\system32\HPZc3212.dll
    2010-10-28 22:18 . 2004-12-15 07:07 581632 ----a-w- c:\windows\system32\hpotscl.dll
    2010-10-28 22:18 . 2004-12-15 07:07 229376 ----a-w- c:\windows\system32\hpovst08.dll
    2010-10-28 22:18 . 2004-12-15 07:07 278528 ----a-w- c:\windows\system32\hpgwiamd.dll
    2010-10-28 22:17 . 2004-12-15 07:07 139345 ----a-w- c:\windows\system32\hpzlnt12.dll
    2010-10-28 22:17 . 2004-12-15 07:07 393216 ----a-w- c:\windows\system32\hpzcon12.dll
    2010-10-28 22:17 . 2004-12-15 07:07 196608 ----a-w- c:\windows\system32\hpzcoi12.dll
    2010-10-17 23:10 . 2010-10-17 23:10 -------- d-----w- c:\documents and settings\Hailey\Application Data\Malwarebytes
    2010-10-17 23:10 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-17 23:10 . 2010-10-17 23:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-10-17 23:10 . 2010-10-17 23:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-17 23:10 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-15 10:56 . 2010-10-15 10:56 -------- d-----w- c:\program files\iPod
    2010-10-15 10:56 . 2010-10-15 10:57 -------- d-----w- c:\program files\iTunes

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-20 11:38 . 2009-11-07 18:36 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
    2010-09-20 11:38 . 2009-03-14 21:31 15880 ----a-w- c:\windows\system32\lsdelete.exe
    2010-09-20 11:38 . 2009-03-14 21:09 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2010-09-08 15:17 . 2010-09-08 15:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 15:17 . 2010-09-08 15:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
    "Google Update"="c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-10-18 136176]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-25 5898240]
    "nwiz"="nwiz.exe" [2006-07-25 1519616]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-25 86016]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-09-20 864112]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]

    c:\documents and settings\Hailey\Start Menu\Programs\Startup\
    OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
    HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
    Wireless Configuration Utility HW.15.lnk - c:\program files\TRENDnet\TRENDnet TEW-421PC_TEW-423PI\WlanCU.exe [2007-1-30 577536]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [3/14/2009 4:09 PM 64288]
    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [9/14/2010 6:43 PM 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/14/2010 6:43 PM 20560]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 6:17 AM 1352832]
    R3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [10/2/2002 8:57 AM 13532]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-11-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 11:37]

    2010-11-08 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

    2010-11-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-1275210071-839522115-1004Core.job
    - c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-04 11:39]

    2010-11-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-1275210071-839522115-1004UA.job
    - c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-04 11:39]
    .
    .
    ------- Supplementary Scan -------
    .
    IE: &Search
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    FF - ProfilePath - c:\documents and settings\Hailey\Application Data\Mozilla\Firefox\Profiles\mbvfz1x4.default\
    FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/
    FF - component: c:\documents and settings\Hailey\Application Data\Mozilla\Firefox\Profiles\mbvfz1x4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
    FF - component: c:\documents and settings\Hailey\Application Data\Mozilla\Firefox\Profiles\mbvfz1x4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
    FF - plugin: c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-12 18:40
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3492)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Alwil Software\Avast4\aswUpdSv.exe
    c:\program files\Alwil Software\Avast4\ashServ.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\nvsvc32.exe
    c:\program files\Alwil Software\Avast4\ashMaiSv.exe
    c:\program files\Alwil Software\Avast4\ashWebSv.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\documents and settings\Hailey\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    c:\program files\OpenOffice.org 3\program\soffice.exe
    c:\program files\OpenOffice.org 3\program\soffice.bin
    c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Common Files\Java\Java Update\jucheck.exe
    .
    **************************************************************************
    .
    Completion time: 2010-11-12 18:46:17 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-11-12 23:46
    ComboFix2.txt 2010-11-11 16:04
    ComboFix3.txt 2010-11-09 03:06
    ComboFix4.txt 2010-11-07 22:55
    ComboFix5.txt 2010-11-12 23:23

    Pre-Run: 49,041,879,040 bytes free
    Post-Run: 49,031,966,720 bytes free

    - - End Of File - - 2392808DE67CFC998D577315F7AFA5FA
    hlratliff, Nov 12, 2010
    #25

  6. hlratliff Newcomer, in training

    Good morning Bobbye. Hope you had a wonderful weekend. I'm hoping the last log is showing that all is well. :)
    hlratliff, Nov 15, 2010
    #26

  7. Bobbye Helper on the Fringe

    By gosh- I think we did it! Any indications remain on the system? It should be running well now, Let's just do a quick check with HijackThis and make sure no bad entries are running. If it's good, I'll have you remove the cleaning tools and logs they created.

    Download the HijackThis Installer and save to the desktop:
    1. Double-click on HJTInstall.exe to run the program.
    2. By default it will install to C:\Program Files\Trend Micro\HijackThis.
    3. Accept the license agreement by clicking the "I Accept" button.
    4. Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
    5. Click "Save log" to save the log file and then the log will open in notepad.
    6. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    7. Come back here to this thread and paste (Ctrl+V) the log in your next reply.

    NOTE: Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

    I will finish you up as soon as I get that log. You have been very patient- thanks.
    Bobbye, Nov 16, 2010
    #27

  8. hlratliff Newcomer, in training

    Hi Bobbye. The comp seems to be running just fine, haven't noticed any problems. Below is the log. I await your further instructions. Thank you again. :)

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 4:12:31 PM, on 11/16/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16915)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Documents and Settings\Hailey\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
    C:\Program Files\TRENDnet\TRENDnet TEW-421PC_TEW-423PI\WlanCU.exe
    C:\Program Files\OpenOffice.org 3\program\soffice.exe
    C:\Program Files\OpenOffice.org 3\program\soffice.bin
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Hailey\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Wireless Configuration Utility HW.15.lnk = C:\Program Files\TRENDnet\TRENDnet TEW-421PC_TEW-423PI\WlanCU.exe
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} -
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -
    O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} -
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 7601 bytes
    hlratliff, Nov 16, 2010
    #28

  9. Bobbye Helper on the Fringe

    Watch out for possible conflict between Tea Timer and Ad Watch> they both run in Real Time. Either alone can cause conflict, together doubles the chance. HijackThis log is fine. Look into those auto-updaters you have running. Do you really want all those programs contacting the internet several time a day every day looking for an update, when you could check yourself occasionally?
    ===========================================
    Removing all of the tools we used and the files and folders they created
    • Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [IMG]
    • Download OTCleanIt by OldTimer and save it to your Desktop.
    • Double click OTCleanIt.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.

    Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.
    • You should now set a new Restore Point and remove the old restore points to prevent infection from any previous Restore Points.
    • Go to Start > All Programs > Accessories > System Tools
    • Click "System Restore".
    • Choose "Create a Restore Point" on the first screen then click "Next".
    • Give the Restore Point a name> click "Create".
    • Go back and follow the path to > System Tools.
      [*]Choose Disc Cleanup
      [*]Click "OK" to select the partition or drive you want.
      [*]Click the "More Options" Tab.
      [*]Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one.


    Empty the Recycle Bin

    Let me know if you have any more problems,
    Bobbye, Nov 16, 2010
    #29

  10. hlratliff Newcomer, in training

    Did everything in your last post. Thank you so very much for all your help. I would like to make a donation if that is alright. You saved me a lot of money by helping me to do this by myself. I think you and the other techs provide a wonderful service. May you and your family have a wonderful Thanksgiving. Hailey:wave:
    hlratliff, Nov 17, 2010
    #30

  11. Bobbye Helper on the Fringe

    You're very welcome- glad to help. I appreciate you offer of a donation however I don't accept donations. While some do, I know that TechSpot, the site, doesn't either.

    You can reward me though be staying clean and safe- here are some tips:
    Tips for added security and safer browsing:
    Note: Some of these programs might not work on Windows 7 or a 64bit OS.
    1. Browser Security Settings: Custom is fine if the user did the settings. Mine are Custom. Default is okay too, but sometimes too restrictive.
      This Tutorial will help guide you through Configuring Security Settings, Managing Active X Controls and other safety features: Make Internet Explorer safer.
    2. Have layered Security:
      • Antivirus Software(only one):Both of the following programs are free and known to be good:
        [o]Avira Free
        [o]Avast Home
      • Firewall (only one): Use bi-directional firewall. Both of the following programs are free and known to be good:
        [o]Comodo
        [o]Zone Alarm
      • Antispyware: I recommend all of the following:
        [o]Spywareblaster: SpywareBlaster protects against bad ActiveX. It places kill bits to stop bad Active X controls from being installed. Remember to update it regularly.
      [o]Download ZonedOut and save to your desktop. this replaces IE/Spyad and manages the Zones in Internet explorer. This places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
      For IE7 and IE8, Windows 2000 thru Vista. No Windows 7 yet.
      IE/Spyad is not longer being supported. If you have this on your system, you should replace it with the following program. Make sure your IE8 is Up-to-date before adding sites to your restricted zone.
      Known issue: If you have "immunized" your computer with Spybot Search and Destroy, and use ZonedOut to "Remove All" restricted sites - ZonedOut will remove your trusted sites as well. Note that if you remove Spybot Search and Destroys Immunization the problem goes away...
      [o]MVPS Hosts files This replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
      [o]Google Toolbar Get the free google toolbar to help stop pop up windows.
    3. Stay current on updates:
      [o] Visit the Microsoft Download Sitefrequently. You should get All updates marked Critical and the current SP updates.
      [o]Visit this Adobe Reader site often and make sure you have the most current update. Uninstall any earlier updates as they are vulnerabilities.
      [o]Check this site .Java Updates Stay current as most updates are for security. Uninstall any earlier versions in Add/Remove Programs.
    4. Reset Cookies to prevent Tracking Cookies:
      [o]For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> check 'override automatic Cookie handling'> check 'accept first party Cookies'> check 'Block third party Cookies'> check 'allow per session Cookies'> Apply> OK.
      [o]For Firefox: Tools> Options> Privacy> Cookies> check ‘accept Cookies from Sites’> Uncheck 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')
      I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
      AdBlock Plus
      Easy List
    5. Do regular Maintenance
      Remove Temporary Internet Files regularly:
      [o]ATF Cleaner by Atribune
      OR
      [o]TFC
      Disable and Enable System Restore:
      [o]See System Restore Guide This will help you understand what this is, why you need to clean and set restore points and what information is in them.
    6. Practice Safe Email Handling
      [o] Don't open email from anyone you don't know.
      [o] Don't open Attachments in the email. Safe to your desktop and scan for viruses using a right click
      [o] Don't leave your personal email address on the internet. Have a separate email account at one of the free web-based emails like Yahoo.

    Best wishes also for you and your loved ones for a Peaceful and Happy Holiday!
    Bobbye, Nov 17, 2010
    #31
Page 2 of 2
Thread Status:
Not open for further replies.