Virus free (Trojan.Agent/Gen-Kryptik) but no Internet connection remains

Solved
By Ninja Teddybear
Jan 16, 2012
  1. A couple of days ago AVG AntiVirus detected an infection (Trojan.Agent/Gen-Kryptik) and, on my request, quarentined it but also located two additional files that were involved (NetBT - I forget the extensions). I rebooted and did not have any Internet access. I scanned my system with the following programs with a reboot between each for good measure. SuperAntiSpyware (Quick scan and Critial Points scan), Spybot Search and Destroy and a full scan by AVG AntiVirus. I used these programs because I had updated them on Friday for my usual 'end of the week scan'. No further infections were identified. However I still do not have an Internet connection. I do have connection within my home network (computer to wireless computer) and my wireless computer can access the Internet so the problem is definitely related only to the computer that was infected.

    I also tried the Startup Fix located on the recovery disc with a response that there were some corrupt files that could not be fixed. There was no indication of what these files were.

    I'm running Windows Vista Home Premium Service Pack 2.

    Any assistance would be helpful.
  2. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =================================================================

    Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.
  3. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    Here is the log file.

    Farbar Service Scanner
    Ran by Joe (administrator) on 16-01-2012 at 15:22:36
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Attempt to access Google IP returned error: Google IP is offline
    Attempt to access Yahoo IP returend error: Yahoo IP is offline


    Windows Firewall:
    =============
    MpsSvc Service is not running. Checking service configuration:
    Checking Start type: Attention! Unable to retrieve start type of MpsSvc. The value does not exist.
    Checking ImagePath: Attention! Unable to retrieve ImagePath of MpsSvc. The value does not exist.
    Unable to retrieve ServiceDll of MpsSvc. The value does not exist.
    Checking LEGACY_MpsSvc: Attention! Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist.

    bfe Service is not running. Checking service configuration:
    Checking Start type: Attention! Unable to open bfe registry key. The service key does not exist.
    Checking ImagePath: Attention! Unable to open bfe registry key. The service key does not exist.
    Checking ServiceDll: Attention! Unable to open bfe registry key. The service key does not exist.
    Checking LEGACY_bfe: Attention! Unable to open LEGACY_bfe\0000 registry key. The key does not exist.

    mpsdrv Service is not running. Checking service configuration:
    The start type of mpsdrv service is OK.
    The ImagePath of mpsdrv service is OK.


    Firewall Disabled Policy:
    ==================
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall"=DWORD:0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall"=DWORD:0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall"=DWORD:0


    System Restore:
    ============
    SDRSVC Service is not running. Checking service configuration:
    The start type of SDRSVC service is OK.
    The ImagePath of SDRSVC service is OK.
    The ServiceDll of SDRSVC service is OK.
    Checking LEGACY_SDRSVC: Attention! Unable to open LEGACY_SDRSVC\0000 registry key. The key does not exist.

    VSS Service is not running. Checking service configuration:
    The start type of VSS service is OK.
    The ImagePath of VSS service is OK.


    System Restore Disabled Policy:
    ========================


    Security Center:
    ============
    wscsvc Service is not running. Checking service configuration:
    Checking Start type: Attention! Unable to open wscsvc registry key. The service key does not exist.
    Checking ImagePath: Attention! Unable to open wscsvc registry key. The service key does not exist.
    Checking ServiceDll: Attention! Unable to open wscsvc registry key. The service key does not exist.
    Checking LEGACY_wscsvc: Attention! Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


    Windows Update:
    ===========

    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys
    [2010-10-23 13:52] - [2010-06-16 11:39] - 0912776 ____A (Microsoft Corporation) 6A10AFCE0B38371064BE41C1FBFD3C6B

    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll
    [2009-06-25 12:23] - [2009-04-11 01:28] - 0061440 ____A (Microsoft Corporation) 1CA6C40261DDC0425987980D0CD2AAAB

    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\wuaueng.dll => MD5 is legit
    C:\Windows\system32\qmgr.dll
    [2009-06-25 12:23] - [2009-04-11 01:28] - 0758784 ____A (Microsoft Corporation) 93952506C6D67330367F7E7934B6A02F

    C:\Windows\system32\es.dll
    [2009-06-25 12:23] - [2009-04-11 01:28] - 0268800 ____A (Microsoft Corporation) 67058C46504BC12D821F38CF99B7B28F

    C:\Windows\system32\cryptsvc.dll
    [2009-06-25 12:23] - [2009-04-11 01:28] - 0129024 ____A (Microsoft Corporation) FB27772BEAF8E1D28CCD825C09DA939B

    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****
  4. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    You have several registry keys missing but we'll take care of the later as they have no effect on your internet connection issue.

    Please download MiniToolBox and run it.

    Checkmark following boxes:
    • Report IE Proxy Settings
    • Report FF Proxy Settings
    • List content of Hosts
    • List IP configuration
    • List Winsock Entries
    • List last 10 Event Viewer log
    • List Installed Programs
    • List Devices (do NOT change any settings here)
    • List Users, Partitions and Memory size
    Click Go and post the result.
  5. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    Here is the log.

    MiniToolBox by Farbar
    Ran by Joe (administrator) on 16-01-2012 at 15:59:51
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
    Boot Mode: Normal
    ***************************************************************************

    ========================= IE Proxy Settings: ==============================

    Proxy is not enabled.
    No Proxy Server is set.

    ========================= FF Proxy Settings: ==============================

    Hosts file not detected in the default directory
    ========================= IP Configuration: ================================

    Intel(R) PRO/100 VE Network Connection = Local Area Connection (Connected)


    # ----------------------------------
    # IPv4 Configuration
    # ----------------------------------
    pushd interface ipv4

    reset
    set global icmpredirects=enabled


    popd
    # End of IPv4 configuration



    Windows IP Configuration

    Host Name . . . . . . . . . . . . : Athena
    Primary Dns Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Unknown
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No

    Ethernet adapter Local Area Connection:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Intel(R) PRO/100 VE Network Connection
    Physical Address. . . . . . . . . : 00-1A-92-B5-26-DF
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    Link-local IPv6 Address . . . . . : fe80::df3:fb15:f4fb:c822%8(Preferred)
    IPv4 Address. . . . . . . . . . . : 192.168.1.2(Preferred)
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Lease Obtained. . . . . . . . . . : January 16, 2012 3:13:28 PM
    Lease Expires . . . . . . . . . . : January 17, 2012 3:13:28 PM
    Default Gateway . . . . . . . . . : 192.168.1.1
    DHCP Server . . . . . . . . . . . : 192.168.1.1
    DHCPv6 IAID . . . . . . . . . . . : 201333394
    DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-11-81-70-4B-00-1A-92-B5-26-DF
    DNS Servers . . . . . . . . . . . : 192.168.1.1
    NetBIOS over Tcpip. . . . . . . . : Disabled

    Tunnel adapter Local Area Connection* 6:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{0E1ED207-6B49-408B-B476-BFC316FCD84B}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 7:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
    Physical Address. . . . . . . . . : 02-00-54-55-4E-01
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 11:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : 6TO4 Adapter
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes
    Server: UnKnown
    Address: 192.168.1.1

    Name: google.com
    Addresses: 74.125.226.244
    74.125.226.243
    74.125.226.240
    74.125.226.241
    74.125.226.242



    Pinging google.com [74.125.226.244] with 32 bytes of data:

    Request timed out.

    Request timed out.



    Ping statistics for 74.125.226.244:

    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),

    Server: UnKnown
    Address: 192.168.1.1

    Name: yahoo.com
    Addresses: 98.137.149.56
    98.139.180.149
    209.191.122.70
    72.30.2.43



    Pinging yahoo.com [209.191.122.70] with 32 bytes of data:

    Request timed out.

    Request timed out.



    Ping statistics for 209.191.122.70:

    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),

    Server: UnKnown
    Address: 192.168.1.1

    Name: bleepingcomputer.com
    Address: 208.43.87.2



    Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:

    Request timed out.

    Request timed out.



    Ping statistics for 208.43.87.2:

    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),



    Pinging 127.0.0.1 with 32 bytes of data:

    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



    Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

    Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

    ===========================================================================
    Interface List
    8 ...00 1a 92 b5 26 df ...... Intel(R) PRO/100 VE Network Connection
    1 ........................... Software Loopback Interface 1
    12 ...00 00 00 00 00 00 00 e0 isatap.{0E1ED207-6B49-408B-B476-BFC316FCD84B}
    9 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
    13 ...00 00 00 00 00 00 00 e0 6TO4 Adapter
    ===========================================================================

    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination Netmask Gateway Interface Metric
    0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.2 20
    127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
    127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
    127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    192.168.1.0 255.255.255.0 On-link 192.168.1.2 276
    192.168.1.2 255.255.255.255 On-link 192.168.1.2 276
    192.168.1.255 255.255.255.255 On-link 192.168.1.2 276
    224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
    224.0.0.0 240.0.0.0 On-link 192.168.1.2 276
    255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    255.255.255.255 255.255.255.255 On-link 192.168.1.2 276
    ===========================================================================
    Persistent Routes:
    None

    IPv6 Route Table
    ===========================================================================
    Active Routes:
    If Metric Network Destination Gateway
    1 306 ::1/128 On-link
    8 276 fe80::/64 On-link
    8 276 fe80::df3:fb15:f4fb:c822/128
    On-link
    1 306 ff00::/8 On-link
    8 276 ff00::/8 On-link
    ===========================================================================
    Persistent Routes:
    None
    ========================= Winsock entries =====================================

    Catalog5 01 C:\Windows\system32\NLAapi.dll [48128] (Microsoft Corporation)
    Catalog5 02 C:\Windows\system32\napinsp.dll [50176] (Microsoft Corporation)
    Catalog5 03 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)
    Catalog5 04 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)
    Catalog5 05 C:\Windows\System32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog5 06 C:\Windows\System32\winrnr.dll [19968] (Microsoft Corporation)
    Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
    Catalog9 01 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 02 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 03 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 04 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 05 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 07 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 08 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 09 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 10 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 11 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 12 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 13 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 14 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 15 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 16 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 17 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 18 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 19 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 20 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

    ========================= Event log errors: ===============================

    Application errors:
    ==================
    Error: (01/16/2012 02:46:34 PM) (Source: Perflib) (User: )
    Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

    Error: (01/15/2012 02:44:51 PM) (Source: Perflib) (User: )
    Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

    Error: (01/15/2012 01:03:08 PM) (Source: RasClient) (User: )
    Description: CoId={0E1C60C4-36DA-4700-9FBE-BACC38047EC3}: The user Athena\Joe dialed a connection named Olympus which has failed. The error code returned on failure is 815.

    Error: (01/15/2012 09:12:48 AM) (Source: Perflib) (User: )
    Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

    Error: (01/15/2012 03:16:44 AM) (Source: Windows Search Service) (User: )
    Description: The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.

    Context: Application, SystemIndex Catalog

    Error: (01/14/2012 02:37:04 PM) (Source: Perflib) (User: )
    Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

    Error: (01/14/2012 09:06:51 AM) (Source: Perflib) (User: )
    Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

    Error: (01/13/2012 02:31:20 PM) (Source: Perflib) (User: )
    Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

    Error: (01/13/2012 08:49:17 AM) (Source: Perflib) (User: )
    Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

    Error: (01/12/2012 02:28:33 PM) (Source: Perflib) (User: )
    Description: EmdCacheC:\Windows\system32\emdmgmt.dll4


    System errors:
    =============
    Error: (01/16/2012 08:53:46 AM) (Source: WMPNetworkSvc) (User: )
    Description: WMPNetworkSvc0x80070424

    Error: (01/16/2012 08:51:44 AM) (Source: Print) (User: SYSTEM)
    Description: The print spooler failed to share printer HP OfficeJet G55 with shared resource name HP OfficeJet G55. Error 1753. The printer cannot be used by others on the network.

    Error: (01/16/2012 08:50:42 AM) (Source: WMPNetworkSvc) (User: )
    Description: WMPNetworkSvc0x80070424

    Error: (01/16/2012 08:50:30 AM) (Source: Service Control Manager) (User: )
    Description: i8042prt

    Error: (01/16/2012 08:50:30 AM) (Source: Service Control Manager) (User: )
    Description: Internet Connection Sharing (ICS)BFE

    Error: (01/16/2012 08:50:30 AM) (Source: Service Control Manager) (User: )
    Description: IPsec Policy AgentBFE

    Error: (01/16/2012 08:50:30 AM) (Source: Service Control Manager) (User: )
    Description: MCSTRM%%2

    Error: (01/16/2012 08:50:30 AM) (Source: Service Control Manager) (User: )
    Description: IKE and AuthIP IPsec Keying ModulesBFE

    Error: (01/16/2012 08:50:30 AM) (Source: Service Control Manager) (User: )
    Description: Computer Browser%%1060

    Error: (01/16/2012 08:50:30 AM) (Source: Service Control Manager) (User: )
    Description: Parallel port driver%%1058


    Microsoft Office Sessions:
    =========================

    =========================== Installed Programs ============================

    (Version: 6.9.1)
    7-Zip 4.57
    Acrobat.com (Version: 1.6.65)
    Ad-Aware (Version: 9.0.1)
    Ad-Aware (Version: 9.5.0)
    Ad-Aware (Version: 9.6.0)
    Adobe AIR (Version: 1.5.0.7220)
    Adobe Digital Editions
    Adobe Flash Player 10 ActiveX (Version: 10.0.42.34)
    Adobe Flash Player 10 Plugin (Version: 10.2.152.32)
    Adobe Flash Player 9 ActiveX (Version: 9)
    Adobe Reader 9.4.7 (Version: 9.4.7)
    Adobe Shockwave Player 11.5 (Version: 11.5.6.606)
    AnswerWorks 5.0 English Runtime (Version: 5.0.7)
    APC PowerChute Personal Edition 3.0 (Version: 3.0)
    Apple Application Support (Version: 1.5.1)
    Apple Mobile Device Support (Version: 3.4.0.25)
    Apple Software Update (Version: 2.1.2.120)
    ArcSoft PhotoImpression 6
    Audacity 1.3.13 (Unicode)
    AudibleManager (Version: -2.1997826301.1997825567.4528520)
    AusLogics Disk Defrag (Version: version 1.4)
    AutoRun Wizard (Version: 2.05.00001)
    AVG 2012 (Version: 12.0.1901)
    AVG 2012 (Version: 12.0.2109)
    AVG 2012 (Version: 2012.0.1901)
    Belarc Advisor 8.1
    Bonjour (Version: 2.0.5.0)
    Book Library
    CCleaner (Version: 3.12)
    Collectorz.com Book Collector
    Collectorz.com Movie Collector
    Collectorz.com Music Collector
    Compatibility Pack for the 2007 Office system (Version: 12.0.6514.5001)
    Complete Canadian Wills Kit (Version: 08-1)
    Core FTP LE 2.1
    Coupon Printer for Windows (Version: 5.0.0.1)
    Creative Audio Pack
    Creative System Information
    Creative ZEN (Version: 1.0)
    D3DX10 (Version: 15.4.2368.0902)
    DeLorme Street Atlas USA 2009 (Version: 9.02.0000)
    deskPDF 2.5 Professional Edition
    Digital Copy
    Digital Video
    DivX Converter (Version: 7.1.0)
    DivX Plus DirectShow Filters
    DivX Setup (Version: 2.1.2.2)
    DivX Version Checker (Version: 7.1.0.9)
    Docudesk GPL Ghostscript 8.15
    Documents To Go (Version: 11.000.501)
    Docupen
    Dragon NaturallySpeaking 10 (Version: 10.10.0)
    DriverAgent by eSupport.com
    Enhanced Multimedia Keyboard Solution
    Eraser
    Eraser (Version: 5.86)
    Eraser 5.8.7 (Version: Eraser 5.8.7)
    ESET Online Scanner v3
    FastStone Capture 5.3 (Version: 5.3)
    FitDay PC version 2.0 (Version: 2.0)
    Garmin Communicator Plugin (Version: 2.9.1)
    Garmin MapSource (Version: 6.15.11)
    Garmin TOPO Canada v4 (Version: 4.0.0.0)
    Garmin Training Center (Version: 3.5.3)
    Garmin Training Center (Version: 3.6.5)
    Garmin USB Drivers (Version: 1.0.0.0)
    Garmin USB Drivers (Version: 2.3.0.0)
    GearDrvs (Version: 1)
    GearDrvs (Version: 1.00.0000)
    Glucofacts (Version: 1.05.01)
    GLUCOFACTS® Deluxe (Version: 2.11.12)
    Google Earth (Version: 6.1.0.5001)
    Google Toolbar for Internet Explorer
    Google Toolbar for Internet Explorer (Version: 4.0.0.002)
    Google Update Helper (Version: 1.3.21.79)
    Google Updater (Version: 2.4.1808.5272)
    Hardware Diagnostic Tools (Version: 5.00.4323.13)
    Hauppauge WinTV (Version: 6.0.26351)
    Hauppauge WinTV Location Manager
    Hauppauge WinTV Scheduler
    Hauppauge WinTV TV Services
    HP Connections (remove only)
    HP Customer Experience Enhancements (Version: 1.00.0000)
    HP Customer Feedback (Version: 1.0.0)
    HP Easy Setup - Core (Version: 1.00.0000)
    HP Easy Setup - Frontend (Version: 5.00.0000)
    HP Picasso Media Center Add-In (Version: 1.0.0)
    HP Total Care Advisor (Version: 1.0.95)
    HP Update (Version: 4.000.012.001)
    Index.dat Analyzer v2.5 (Version: 2.5)
    Intel(R) Matrix Storage Manager
    Intel(R) Network Connections Drivers
    Intel® Viiv™ Software (Version: 1.6.361.6)
    InterVideo FilterSDK for Hauppauge
    IrfanView (remove only)
    Jalbum (Version: 8.7.2)
    Java 2 Runtime Environment, SE v1.4.1_02
    Java Auto Updater (Version: 2.0.2.1)
    Java Web Start
    Java(TM) 6 Update 20 (Version: 6.0.200)
    Junk Mail filter update (Version: 15.4.3502.0922)
    Kobo (Version: 2.1.2)
    LightScribe 1.4.136.1 (Version: 1.4.136.1)
    Logo Design Studio Pro (Version: 3.3.0)
    Malwarebytes' Anti-Malware
    MapArt Canada Street Locator (Version: 1.0.0.0)
    Mesh Runtime (Version: 15.4.5722.2)
    Messenger Companion (Version: 15.4.3502.0922)
    Microlife BPA 3.2 English (Version: 3.2.3)
    Microsoft .NET Framework 1.1 (Version: 1.1.4322)
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
    Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
    Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
    Microsoft Application Error Reporting (Version: 12.0.6012.5000)
    Microsoft FrontPage Client - English (Version: 7.00.9209)
    Microsoft Office 2003 Primary Interop Assemblies (Version: 11.0.6553.0)
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access 2007 (Version: 12.0.6425.1000)
    Microsoft Office Access MUI (English) 2007 (Version: 12.0.6425.1000)
    Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
    Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
    Microsoft Office FrontPage 2003 (Version: 11.0.8173.0)
    Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
    Microsoft Office OneNote 2003 (Version: 11.0.8173.0)
    Microsoft Office Outlook 2003 with Business Contact Manager Update (Version: 2.0.5324.0)
    Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
    Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
    Microsoft Office Project Professional 2003 (Version: 11.0.8173.0)
    Microsoft Office Proof (English) 2007 (Version: 12.0.6425.1000)
    Microsoft Office Proof (French) 2007 (Version: 12.0.6425.1000)
    Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6425.1000)
    Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6425.1000)
    Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
    Microsoft Silverlight (Version: 4.0.60531.0)
    Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
    Microsoft SQL Server 2008 Management Objects (Version: 10.0.1600.22)
    Microsoft SQL Server Compact 3.5 SP1 Design Tools English (Version: 3.5.5692.0)
    Microsoft SQL Server Compact 3.5 SP1 English (Version: 3.5.5692.0)
    Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ) (Version: 8.00.2039)
    Microsoft Visio Professional 2002 [English] (Version: 10.2.5110)
    Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
    Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (Version: 9.0.30729)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
    Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
    Microsoft Visual J# .NET Redistributable Package 1.1 (Version: 1.1.4322)
    Microsoft Visual Studio .NET Professional 2003 - English
    Microsoft Visual Studio 2005 Tools for Office Runtime (Version: 8.0.60940.0)
    Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu (Version: 3.5.30729)
    Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32 (Version: 6.1.5295.17011)
    Microsoft Works (Version: 08.05.0818)
    Mihov Gallery Creator 0.9.2 (Version: 0.9.2)
    Movie Library
    Movienizer 5.0
    Mozilla Firefox (3.6.12) (Version: 3.6.12 (en-US))
    MSDN Library for Visual Studio .NET 2003 (Version: 7.38.3053)
    MSVCRT (Version: 15.4.2862.0708)
    MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
    MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
    MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
    Music Library
    Musicnizer 4.1
    muvee autoProducer 5.0 (Version: 5.00.050)
    MyDeluxeInvoices & Estimates
    Netscape (7.2)
    Network Stumbler 0.4.0 (remove only)
    Notepad++ (Version: 5.6.8)
    NTFS Undelete v0.94 (Version: 0.94)
    Nuance PDF Professional 6 (Version: 6.00.3201)
    NVIDIA Drivers (Version: 1.4)
    Organizer And Filing Cabinet (Version: 2.74.1)
    OVT Scanner X86 (Version: 1.00.0000)
    Palm Desktop by ACCESS (Version: 6.4.0.0)
    PenScanner Twain Driver
    Photo to Cartoon (Version: 3.0.0)
    POP Peeper
    Punch! Home and Landscape Design Suite
    Python 2.4.3 (Version: 2.4.3150)
    Quick To-Do Light ver. 3.1
    QuickBooks (Version: 19.0.4007.1091)
    QuickBooks EasyStart 2010 (Version: 19.0.4007.1091)
    Quicken 2011 (Version: 20.1.1.43)
    QuickTax 2009 (Version: 1.00.0000)
    QuickTime (Version: 7.69.80.9)
    RealPlayer
    Realtek High Definition Audio Driver (Version: 6.0.1.5789)
    RecipeMaster (Version: 2.0.2)
    Rhapsody
    Rhapsody Player Engine (Version: 1.0.604)
    Roxio Creator Audio (Version: 3.3.0)
    Roxio Creator Basic v9 (Version: 3.3.0)
    Roxio Creator Copy (Version: 3.3.0)
    Roxio Creator Data (Version: 3.3.0)
    Roxio Creator EasyArchive (Version: 3.3.0)
    Roxio Creator Tools (Version: 3.3.0)
    Roxio Express Labeler 3 (Version: 2.1.0)
    Roxio MyDVD Basic v9 (Version: 9.0.095)
    SAMSUNG CDMA Modem Driver Set
    Samsung Contacts Copier (Version: 1.0.2.9)
    SAMSUNG Mobile USB Modem 1.0 Software
    SAMSUNG Mobile USB Modem Software
    Scansoft PDF Professional
    Seagate Dashboard (Version: 1.0.0.809)
    Segoe UI (Version: 15.4.2271.0615)
    ShadowExplorer 0.8 (Version: 0.8.430.0)
    Skype Toolbars (Version: 5.0.4137)
    Skype™ 5.1 (Version: 5.1.112)
    SmartList To Go (Version: 3.50.1370)
    Soft Data Fax Modem with SmartCP (Version: 7.74.00)
    Speccy (Version: 1.13)
    SpeedFan (remove only)
    Spybot - Search & Destroy (Version: 1.6.2)
    SQL Server System CLR Types (Version: 10.0.1600.22)
    Stamps.com Internet Postage
    SUPERAntiSpyware (Version: 4.52.1000)
    SupportSoft Assisted Service (Version: 15)
    SureThing CD Labeler Deluxe 5 (Version: 5.2.636.0)
    SyncBack
    Trillian
    TurboTax 2010 (Version: 1.00.0000)
    Undelete Plus 2.98
    Uninstall OVT Scanner
    Unlocker 1.8.7 (Version: 1.8.7)
    VC 9.0 Runtime (Version: 1.0.0)
    VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
    Visual C++ 8.0 CRT (x86) WinSXS MSM (Version: 8.0.50727.762)
    Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM (Version: 8.0.50727.762)
    Visual C++ 8.0 MFC (x86) WinSXS MSM (Version: 8.0.50727.762)
    Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM (Version: 8.0.50727.762)
    Visual C++ Runtime for Dragon NaturallySpeaking (Version: 10.00.200.184)
    Visual Studio .NET Professional 2003 - English (Version: 7.1.3088)
    Visual Studio 2005 Tools for Office Second Edition Runtime
    Visual Studio.NET Baseline - English (Version: 7.1.3088)
    Weight Tracker (Version: 7.1)
    Winamp (Version: 5.581 )
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0) (Version: 03/08/2007 2.2.1.0)
    Windows Live Communications Platform (Version: 15.4.3502.0922)
    Windows Live Essentials (Version: 15.4.3502.0922)
    Windows Live Essentials (Version: 15.4.3508.1109)
    Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
    Windows Live Installer (Version: 15.4.3502.0922)
    Windows Live Mail (Version: 15.4.3502.0922)
    Windows Live Mesh (Version: 15.4.3502.0922)
    Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
    Windows Live Messenger (Version: 15.4.3502.0922)
    Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
    Windows Live MIME IFilter (Version: 15.4.3502.0922)
    Windows Live Movie Maker (Version: 15.4.3502.0922)
    Windows Live OneCare safety scanner (Version: 1.0.0.0)
    Windows Live Photo Common (Version: 15.4.3502.0922)
    Windows Live Photo Gallery (Version: 15.4.3502.0922)
    Windows Live PIMT Platform (Version: 15.4.3508.1109)
    Windows Live Remote Client (Version: 15.4.5722.2)
    Windows Live Remote Client Resources (Version: 15.4.5722.2)
    Windows Live Remote Service (Version: 15.4.5722.2)
    Windows Live Remote Service Resources (Version: 15.4.5722.2)
    Windows Live SOXE (Version: 15.4.3502.0922)
    Windows Live SOXE Definitions (Version: 15.4.3502.0922)
    Windows Live UX Platform (Version: 15.4.3502.0922)
    Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
    Windows Live Writer (Version: 15.4.3502.0922)
    Windows Live Writer Resources (Version: 15.4.3502.0922)
    Windows Media Player Firefox Plugin (Version: 1.0.0.8)
    WordPerfect Office X3
    WordPerfect Office X3 (Version: 13.3)
    WYO Home Inventory 4.17 (Version: 4.17)
    ZENcast Organizer
    ZIP Reader 8.00.0018 (Version: 8.00.0018)
    ZoneAlarm Firewall (Version: 10.1.065.000)
    ZoneAlarm Free (Version: 10.1.065.000)
    ZoneAlarm Security (Version: 10.1.065.000)
    ZoneAlarm Spy Blocker Toolbar (Version: 4.1.0.5)
    ZoneAlarm Toolbar

    ========================= Devices: ================================


    ========================= Memory info: ===================================

    Percentage of memory in use: 59%
    Total physical RAM: 2045.76 MB
    Available physical RAM: 826.93 MB
    Total Pagefile: 4332.78 MB
    Available Pagefile: 2400.14 MB
    Total Virtual: 2047.88 MB
    Available Virtual: 1929.27 MB

    ========================= Partitions: =====================================

    1 Drive c: (HP) (Fixed) (Total:296.11 GB) (Free:24.71 GB) NTFS
    2 Drive d: (Recovery) (Fixed) (Total:7.79 GB) (Free:0.88 GB) NTFS
    8 Drive j: (Windows 7) (Fixed) (Total:68.71 GB) (Free:68.61 GB) NTFS
    10 Drive l: () (Removable) (Total:0.47 GB) (Free:0.47 GB) FAT
    11 Drive s: (JOE WEST) (Removable) (Total:1.68 GB) (Free:1.41 GB) FAT

    ========================= Users: ========================================

    User accounts for \\ATHENA

    Administrator ASPNET Guest
    IUSR_NMPR Joe SQLDebugger


    **** End of log ****
  6. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    All settings seem to be OK, so something else is blocking the internet.

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    NOTE.
    To manually update MBAM, download this file: http://data.mbamupdates.com/tools/mbam-rules.exe
    Double click on downloaded file to update the program.
  7. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    MalwareBytes stalled after 2 minutes so I ran it in Safe Mode. Here is the log followed by the logs of the other two programs. I now have the Internet on that computer.

    Step 5: Log Handling Instructions

    Include the following logs into your next reply (copy & paste them). Do not put logs in a quote box or code box.

    Malwarebytes Anti-Malware log
    GMER log
    DDS logs: both DDS.txt and Attach.txt


    Extended Guidelines

    All required logs have to be PASTED. Attached logs will NOT be reviewed.

    If a log or logs exceed the limit for one reply, you may use more than one reply. The above rule will be strictly enforced.

    Pasted logs can be handled easier and faster by malware helper.
  8. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    GMER report

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-01-16 17:27:11
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 SAMSUNG_ rev.ZZ10
    Running: h7wvlmji.exe; Driver: C:\Users\Joe\AppData\Local\Temp\awldrpow.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    ---- EOF - GMER 1.0.15 ----
  9. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    duplicate.........
  10. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    DDS Attach file

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 09-04-22 8:42:19 PM
    System Uptime: 12-01-16 5:16:28 PM (0 hours ago)
    .
    Motherboard: ASUSTek Computer INC. | | LEONITE
    Processor: Intel(R) Core(TM)2 CPU 4400 @ 2.00GHz | Socket 775 | 1200/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 296 GiB total, 24.57 GiB free.
    D: is FIXED (NTFS) - 8 GiB total, 0.881 GiB free.
    E: is CDROM ()
    F: is Removable
    G: is Removable
    H: is Removable
    I: is Removable
    J: is FIXED (NTFS) - 69 GiB total, 68.607 GiB free.
    L: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP406: 12-01-16 10:26:30 AM - Scheduled Checkpoint
    .
    ==== Installed Programs ======================
    .
    .
    Update for Microsoft Office 2007 (KB2508958)
    1.1
    7-Zip 4.57
    Acrobat.com
    Ad-Aware
    Adobe AIR
    Adobe Digital Editions
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 9 ActiveX
    Adobe Reader 9.4.7
    Adobe Shockwave Player 11.5
    AnswerWorks 5.0 English Runtime
    APC PowerChute Personal Edition 3.0
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft PhotoImpression 6
    Audacity 1.3.13 (Unicode)
    AudibleManager
    AusLogics Disk Defrag
    AutoRun Wizard
    AVG 2012
    Belarc Advisor 8.1
    Bonjour
    Book Collector
    Book Library
    CCleaner
    Collectorz.com Book Collector
    Collectorz.com Movie Collector
    Collectorz.com Music Collector
    Compatibility Pack for the 2007 Office system
    Complete Canadian Wills Kit
    Core FTP LE 2.1
    Coupon Printer for Windows
    Creative Audio Pack
    Creative System Information
    Creative ZEN
    D3DX10
    DeLorme Street Atlas USA 2009
    deskPDF 2.5 Professional Edition
    Digital Copy
    Digital Video
    DivX Converter
    DivX Plus DirectShow Filters
    DivX Setup
    DivX Version Checker
    Docudesk GPL Ghostscript 8.15
    Documents To Go
    Docupen
    Dragon NaturallySpeaking 10
    DriverAgent by eSupport.com
    Enhanced Multimedia Keyboard Solution
    Eraser
    Eraser 5.8.7
    ESET Online Scanner v3
    FastStone Capture 5.3
    FitDay PC version 2.0
    Garmin Communicator Plugin
    Garmin MapSource
    Garmin TOPO Canada v4
    Garmin Training Center
    Garmin USB Drivers
    GearDrvs
    Glucofacts
    GLUCOFACTS® Deluxe
    Google Earth
    Google Toolbar for Internet Explorer
    Google Update Helper
    Google Updater
    Hardware Diagnostic Tools
    Hauppauge WinTV
    Hauppauge WinTV Location Manager
    Hauppauge WinTV Scheduler
    Hauppauge WinTV TV Services
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB945282)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946040)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946308)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB946344)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947540)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB947789)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB948127)
    Hotfix for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB951708)
    HP Connections (remove only)
    HP Customer Experience Enhancements
    HP Customer Feedback
    HP Easy Setup - Core
    HP Easy Setup - Frontend
    HP Picasso Media Center Add-In
    HP Total Care Advisor
    HP Update
    Index.dat Analyzer v2.5
    Intel(R) Matrix Storage Manager
    Intel(R) Network Connections Drivers
    Intel® Viiv™ Software
    InterVideo FilterSDK for Hauppauge
    IrfanView (remove only)
    Jalbum
    Java 2 Runtime Environment, SE v1.4.1_02
    Java Auto Updater
    Java Web Start
    Java(TM) 6 Update 20
    Junk Mail filter update
    Kobo
    LightScribe 1.4.136.1
    Logo Design Studio Pro
    Malwarebytes' Anti-Malware
    MapArt Canada Street Locator
    Mesh Runtime
    Messenger Companion
    Microlife BPA 3.2 English
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Application Error Reporting
    Microsoft FrontPage Client - English
    Microsoft Office 2003 Primary Interop Assemblies
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access 2007
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office File Validation Add-In
    Microsoft Office FrontPage 2003
    Microsoft Office Live Add-in 1.5
    Microsoft Office OneNote 2003
    Microsoft Office Outlook 2003 with Business Contact Manager Update
    Microsoft Office Outlook Connector
    Microsoft Office Professional Edition 2003
    Microsoft Office Project Professional 2003
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft SQL Server 2008 Management Objects
    Microsoft SQL Server Compact 3.5 SP1 Design Tools English
    Microsoft SQL Server Compact 3.5 SP1 English
    Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)
    Microsoft Visio Professional 2002 [English]
    Microsoft Visual Basic 2008 Express Edition with SP1 - ENU
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual J# .NET Redistributable Package 1.1
    Microsoft Visual Studio .NET Professional 2003 - English
    Microsoft Visual Studio 2005 Tools for Office Runtime
    Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
    Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
    Microsoft Works
    Mihov Gallery Creator 0.9.2
    Movie Collector
    Movie Library
    Movienizer 5.0
    Mozilla Firefox (3.6.12)
    MSDN Library for Visual Studio .NET 2003
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP2 Parser and SDK
    Music Collector
    Music Library
    Musicnizer 4.1
    muvee autoProducer 5.0
    MyDeluxeInvoices & Estimates
    Netscape (7.2)
    Network Stumbler 0.4.0 (remove only)
    Notepad++
    NTFS Undelete v0.94
    Nuance PDF Professional 6
    NVIDIA Drivers
    Organizer And Filing Cabinet
    OVT Scanner X86
    Palm Desktop by ACCESS
    PenScanner Twain Driver
    Photo to Cartoon
    POP Peeper
    Punch! Home and Landscape Design Suite
    Python 2.4.3
    Quick To-Do Light ver. 3.1
    QuickBooks
    QuickBooks EasyStart 2010
    Quicken 2011
    QuickTax 2009
    QuickTime
    RealPlayer
    Realtek High Definition Audio Driver
    RecipeMaster
    Rhapsody
    Rhapsody Player Engine
    Roxio Creator Audio
    Roxio Creator Basic v9
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator EasyArchive
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio MyDVD Basic v9
    SAMSUNG CDMA Modem Driver Set
    Samsung Contacts Copier
    SAMSUNG Mobile USB Modem 1.0 Software
    SAMSUNG Mobile USB Modem Software
    Scansoft PDF Professional
    Seagate Dashboard
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2288931)
    Security Update for 2007 Microsoft Office System (KB2509488)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Visual Basic 2008 Express Edition with SP1 - ENU (KB2251487)
    Segoe UI
    ShadowExplorer 0.8
    Skype Toolbars
    Skype™ 5.1
    SmartList To Go
    Soft Data Fax Modem with SmartCP
    Speccy
    SpeedFan (remove only)
    Spybot - Search & Destroy
    SQL Server System CLR Types
    Stamps.com Internet Postage
    SUPERAntiSpyware
    SupportSoft Assisted Service
    SureThing CD Labeler Deluxe 5
    SyncBack
    Trillian
    TurboTax 2010
    Undelete Plus 2.98
    Uninstall OVT Scanner
    Unlocker 1.8.7
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2007 System (KB2539530)
    Update for Microsoft Office Access 2007 Help (KB963663)
    Update for Microsoft Office Script Editor Help (KB963671)
    VC 9.0 Runtime
    VC80CRTRedist - 8.0.50727.4053
    Visual C++ 8.0 CRT (x86) WinSXS MSM
    Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM
    Visual C++ 8.0 MFC (x86) WinSXS MSM
    Visual C++ 8.0 MFC.Policy (x86) WinSXS MSM
    Visual C++ Runtime for Dragon NaturallySpeaking
    Visual Studio .NET Professional 2003 - English
    Visual Studio 2005 Tools for Office Second Edition Runtime
    Visual Studio.NET Baseline - English
    Weight Tracker
    Winamp
    Winamp Detector Plug-in
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live OneCare safety scanner
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows Media Player Firefox Plugin
    WordPerfect Office X3
    WYO Home Inventory 4.17
    ZENcast Organizer
    ZIP Reader 8.00.0018
    ZoneAlarm Firewall
    ZoneAlarm Free
    ZoneAlarm Security
    ZoneAlarm Spy Blocker Toolbar
    ZoneAlarm Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    12-01-16 8:50:04 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 001A92B526DF has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
    12-01-16 5:22:12 PM, Error: Microsoft-Windows-WMPNSS-Service [14325] - Service 'WMPNetworkSvc' did not start correctly because QueryService encountered error '0x80070424'. In Windows Media Player, turn off media sharing, and then turn it back on.
    12-01-16 5:19:18 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer HP OfficeJet G55 with shared resource name HP OfficeJet G55. Error 1753. The printer cannot be used by others on the network.
    12-01-16 5:17:22 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
    12-01-16 5:17:22 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
    12-01-16 5:17:22 PM, Error: Service Control Manager [7003] - The TCP/IP NetBIOS Helper service depends the following service: NetBT. This service might not be installed.
    12-01-16 5:17:22 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
    12-01-16 5:17:22 PM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed.
    12-01-16 5:17:22 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
    12-01-16 5:17:22 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    12-01-16 5:17:22 PM, Error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified.
    12-01-16 5:07:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    12-01-16 5:07:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    12-01-16 5:06:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12-01-16 5:06:54 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 i8042prt SASDIFSV SASKUTIL spldr Wanarpv6
    12-01-16 5:06:54 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    12-01-16 5:06:47 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    12-01-16 5:06:26 PM, Error: EventLog [6008] - The previous system shutdown at 4:48:22 PM on 16/01/2012 was unexpected.
    12-01-15 9:07:40 AM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer HP OfficeJet G55 with shared resource name HP OfficeJet G55. Error 2114. The printer cannot be used by others on the network.
    12-01-15 7:53:57 AM, Error: Microsoft-Windows-SharedAccess_NAT [31004] - The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
    12-01-15 10:20:09 AM, Error: Microsoft-Windows-SharedAccess_NAT [30013] - The DHCP allocator has disabled itself on IP address 192.168.1.2, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, change the scope to include the IP address, or change the IP address to fall within the scope.
    12-01-15 10:20:00 AM, Error: Microsoft-Windows-SharedAccess_NAT [30013] - The DHCP allocator has disabled itself on IP address 169.254.200.34, since the IP address is outside the 192.168.0.0/255.255.255.0 scope from which addresses are being allocated to DHCP clients. To enable the DHCP allocator on this IP address, change the scope to include the IP address, or change the IP address to fall within the scope.
    12-01-15 10:19:33 AM, Error: Microsoft-Windows-SharedAccess_NAT [34001] - The ICS_IPV6 failed to configure IPv6 stack.
    12-01-14 10:53:17 AM, Error: volsnap [35] - The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.
    12-01-12 8:56:31 AM, Error: Service Control Manager [7009] - A timeout was reached (120000 milliseconds) while waiting for the Windows Search service to connect.
    12-01-12 8:56:31 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12-01-12 8:56:30 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
    12-01-12 8:56:30 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    12-01-12 8:55:55 AM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
    12-01-12 2:08:38 PM, Error: Microsoft-Windows-Dhcp-Client [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001A92B526DF. The following error occurred: The wait operation timed out.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
    12-01-10 2:53:13 AM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer HP OfficeJet G55 with shared resource name HP OfficeJet G55. Error 1722. The printer cannot be used by others on the network.
    .
    ==== End Of File ===========================
  11. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    What happened? Did you fix anything?

    MBAM didn't run even in safe mode?

    I still need DDS.txt log.
     
  12. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    I stand corrected. I have Internet access when Zonealarm is off. But once Zonealarm is on I lose it.

    DDS log is in message #9

    It appears I copied the wrong file for the MBAM log (in the best Sheldon impersonation I have to say, "I don't know how that happened"). Here is the MBAM log

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 8357

    Windows 6.0.6002 Service Pack 2 (Safe Mode)
    Internet Explorer 8.0.6001.19088

    12-01-16 5:13:43 PM
    mbam-log-2012-01-16 (17-13-43).txt

    Scan type: Quick scan
    Objects scanned: 206145
    Time elapsed: 4 minute(s), 57 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  13. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    Sorry again. I thought the DDS log was message #9. Here is the DDS log. I hope I got this all right this time.

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.6001.19088 BrowserJavaVersion: 1.6.0_20
    Run by Joe at 17:28:10 on 2012-01-16
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.2046.526 [GMT -5:00]
    .
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
    AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
    FW: ZoneAlarm Free Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
    .
    ============== Running Processes ===============
    .
    C:\PROGRA~1\AVG\AVG2012\avgrsx.exe
    C:\Program Files\AVG\AVG2012\avgcsrvx.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\AskBarDis\bar\bin\AskService.exe
    C:\Program Files\AVG\AVG2012\avgwdsvc.exe
    C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Creative Labs Shared\Service\APLicensing.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
    C:\Program Files\Nuance\PDF Professional 6\PDFProFiltSrv.exe
    C:\Windows\system32\PSIService.exe
    C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
    C:\Program Files\AVG\AVG2012\avgnsx.exe
    C:\Program Files\AVG\AVG2012\avgemcx.exe
    C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe
    C:\Program Files\ShadowExplorer\sesvc.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\dataserv.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\hp\support\hpsysdrv.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\Nuance\PDF Professional 6\PdfPro6Hook.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\AVG\AVG2012\avgtray.exe
    C:\Program Files\AVG Secure Search\vprot.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
    C:\Garmin\gStart.exe
    C:\Program Files\Palm\Hotsync.exe
    C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Lavasoft\Ad-Aware\AWSC.exe
    C:\Program Files\Lavasoft\Ad-Aware\AWSC.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Windows\ehome\ehsched.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehRecvr.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\hp\kbd\kbd.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\conime.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = about:blank
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
    mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: H - No File
    uURLSearchHooks: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
    mURLSearchHooks: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
    mURLSearchHooks: H - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar2.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
    BHO: PlusIEEventHelper Class: {551a852f-39a6-44a7-9c13-afbec9185a9d} - c:\program files\nuance\pdf professional 6\bin\PlusIEContextMenu.dll
    BHO: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
    BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\9.0.0.18\AVG Secure Search_toolbar.dll
    BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
    BHO: ZeonIEEventHelper Class: {da986d7d-ccaf-47b2-84fe-bfa1549bebf9} - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
    TB: ZoneAlarm Spy Blocker Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar2.dll
    TB: Nuance PDF: {e3286bf1-e654-42ff-b4a6-5e111731df6b} - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll
    TB: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZone.dll
    TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
    TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\9.0.0.18\AVG Secure Search_toolbar.dll
    {e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
    uRun: [CTSyncU.exe] "c:\program files\creative\sync manager unicode\CTSyncU.exe"
    uRun: [gStart] c:\garmin\gStart.exe
    uRun: [PhotoJoy] c:\program files\photojoy\bin\PhotoJoy.exe /c
    mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    mRun: [KBD] c:\hp\kbd\KbdStub.EXE
    mRun: [RtHDVCpl] RtHDVCpl.exe
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [CTCheck] c:\program files\creative\creative zen\zen media explorer\CTCheck.exe
    mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [PDFHook] c:\program files\nuance\pdf professional 6\pdfpro6hook.exe
    mRun: [PDF6 Registry Controller] c:\program files\nuance\pdf professional 6\RegistryController.exe
    mRun: [Nuance PDF Professional 6-reminder] "c:\program files\nuance\pdf professional 6\ereg\ereg.exe" -r "c:\programdata\nuance\pdf professional 6\ereg\Ereg.ini"
    mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
    mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking10\ereg\ereg.exe" -r "c:\programdata\nuance\naturallyspeaking10\Ereg.ini
    mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
    mRun: [<NO NAME>]
    mRun: [Display] c:\program files\apc\apc powerchute personal edition\DataCollectionLauncher.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
    mRun: [ISW]
    mRun: [ZoneAlarm] "c:\program files\checkpoint\zonealarm\zatray.exe"
    mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
    mRun: [QuickFinder Scheduler] "c:\program files\wordperfect office x3\programs\QFSCHD130.EXE"
    StartupFolder: c:\users\joe\appdata\roaming\micros~1\windows\startm~1\programs\startup\launch~1.lnk - c:\program files\microsoft office\office11\OUTLOOK.EXE
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\apcups~1.lnk - c:\program files\apc\apc powerchute personal edition\Display.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\Hotsync.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpconn~1.lnk - c:\program files\hp connections\6811507\program\HP Connections.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
    uPolicies-explorer: HideSCAHealth = 1 (0x1)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: &Search - ?p=GRxdm067YYCA
    IE: Append the content of the link to existing PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
    IE: Append the content of the selected links to existing PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML
    IE: Append to existing PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
    IE: Create PDF file - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
    IE: Create PDF file from the content of the link - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
    IE: Create PDF files from the selected links - c:\program files\nuance\pdf professional 6\bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
    IE: Open with Nuance PDF Converter 6.0 - c:\program files\nuance\pdf professional 6\cnvres_eng.dll /100
    IE: Open with PDF Professional 6 - c:\program files\nuance\pdf professional 6\bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
    IE: Open with WordPerfect - c:\program files\wordperfect office x3\programs\WPLauncher.hta
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
    Trusted Zone: real.com\rhap-app-4-0
    Trusted Zone: real.com\rhapreg
    DPF: {44990B00-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlcm.cab
    DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F} - hxxp://download.microsoft.com/download/B/3/A/B3A2EA73-793D-4ABE-992D-C81140384044/igdtoolx.cab
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{0E1ED207-6B49-408B-B476-BFC316FCD84B} : DhcpNameServer = 192.168.1.1
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
    Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - c:\program files\quicktax 2009\ic2009pp.dll
    Handler: intu-tt2010 - {97A0575E-2309-4e75-8509-B1F9390C4DE7} - c:\program files\turbotax 2010\ic2010pp.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\9.0.1\ViProtocol.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\joe\appdata\roaming\mozilla\firefox\profiles\fetmiiu1.default\
    FF - prefs.js: browser.startup.homepage -
    FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4da782a2&v=7.008.031.001&i=23&tp=ab&iy=&ychte=ca&lng=en-US&q=
    FF - component: c:\program files\avg\avg2012\firefox4\components\avgssff5.dll
    FF - component: c:\program files\avg\avg2012\firefox4\components\avgssff6.dll
    FF - component: c:\program files\avg\avg2012\firefox4\components\avgssff7.dll
    FF - component: c:\program files\avg\avg2012\firefox4\components\avgssff8.dll
    FF - component: c:\program files\avg\avg2012\firefox4\components\avgssff9.dll
    FF - plugin: c:\progra~1\palm\packag~1\NPInstal.dll
    FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
    FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\google updater\2.4.1808.5272\npCIDetect14.dll
    FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\j2re1.4.1_02\bin\NPJava11.dll
    FF - plugin: c:\program files\java\j2re1.4.1_02\bin\NPJava12.dll
    FF - plugin: c:\program files\java\j2re1.4.1_02\bin\NPJava13.dll
    FF - plugin: c:\program files\java\j2re1.4.1_02\bin\NPJava32.dll
    FF - plugin: c:\program files\java\j2re1.4.1_02\bin\NPJPI141_02.dll
    FF - plugin: c:\program files\java\j2re1.4.1_02\bin\NPOJI610.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
    FF - plugin: c:\program files\nuance\pdf professional 6\bin\nppdf.dll
    FF - plugin: c:\program files\nuance\pdf professional 6\bin\nppdf.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\users\joe\appdata\roaming\mozilla\firefox\profiles\fetmiiu1.default\extensions\{1bc9ba34-1eed-42ca-a505-6d2f1a935bbb}\plugins\npietab2.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\avg\avg2012\Firefox4
    FF - Ext: IE Tab 2 (FF 3.6+): {1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} - %profile%\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592]
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-5-16 64512]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664]
    R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-5-4 116608]
    R2 APC Data Service;APC Data Service;c:\program files\apc\apc powerchute personal edition\dataserv.exe [2010-9-14 21880]
    R2 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-4-28 464264]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]
    R2 BayerHealthcareService;BayerHealthcareService;c:\program files\bayer healthcare smartlaunch\bin\BayerHCService.exe [2011-6-1 128512]
    R2 Creative Audio Pack Licensing Service;Creative Audio Pack Licensing Service;c:\program files\common files\creative labs shared\service\APLicensing.exe [2010-5-6 72704]
    R2 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.exe [2006-9-3 208896]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-4-28 21504]
    R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2011-11-3 27016]
    R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2011-11-3 497280]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-11-3 2152152]
    R2 PDFProFiltSrv;PDFProFiltSrv;c:\program files\nuance\pdf professional 6\PDFProFiltSrv.exe [2009-7-27 134944]
    R2 SeagateDashboardService;Seagate Dashboard Service;c:\program files\seagate\seagate dashboard\SeagateDashboardService.exe [2010-4-30 14088]
    R2 sesvc;ShadowExplorer Service;c:\program files\shadowexplorer\sesvc.exe [2011-2-21 9216]
    R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\9.0.1\ToolbarUpdater.exe [2011-12-7 855904]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134736]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720]
    R3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2009-3-19 391168]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate1c9e18e8778ef0d;Google Update Service (gupdate1c9e18e8778ef0d);c:\program files\google\update\GoogleUpdate.exe [2009-5-30 133104]
    S2 HidCom;USB-HID -> COM Driver Service;c:\windows\system32\drivers\HidCom.sys [2010-6-14 21016]
    S2 IntelDHSvcConf;Intel DH Service;c:\program files\intel\inteldh\intel media server\tools\IntelDHSvcConf.exe [2006-5-10 29696]
    S3 APL531;OVT Scanner;c:\windows\system32\drivers\ov550i.sys [2006-7-31 580992]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-1-1 947528]
    S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2011-3-30 23456]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-5-30 133104]
    S3 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\wintv\HCWTVS~1.EXE [2009-7-11 827392]
    S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-11-3 15232]
    S3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2010-6-24 21504]
    S3 MCLServiceATL;Intel(R) Application Tracker;c:\program files\intel\inteldh\intel media server\shells\MCLServiceATL.exe [2006-9-11 167936]
    S3 optousb;OPTO ELECTRONICS optousb;c:\windows\system32\drivers\optousb.sys [2008-4-4 18432]
    S3 optovcm;OPTO ELECTRONICS optovcm;c:\windows\system32\drivers\optovcm.sys [2008-4-4 26368]
    S3 RK28USB;Driver for RK28USB Device;c:\windows\system32\drivers\rk28usb.sys [2011-7-1 43944]
    S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\common files\surething shared\stllssvr.exe [2006-11-1 74392]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
    S3 WideUsb;WideUSB Generic USB Bulk driver;c:\windows\system32\drivers\WideUSB.sys [2009-10-3 41600]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
    .
    =============== Created Last 30 ================
    .
    2012-01-16 08:14:39 0 ---ha-w- c:\users\joe\appdata\local\BIT8375.tmp
    2012-01-08 21:06:14 -------- d-----w- c:\windows\Complete Canadian Wills Kit
    2012-01-08 21:06:14 -------- d-----w- c:\program files\Complete Canadian Wills Kit
    .
    ==================== Find3M ====================
    .
    2011-12-11 17:30:39 1264 --sha-w- c:\windows\system32\KGyGaAvL.sys
    2011-11-03 17:06:56 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
    .
    ============= FINISH: 17:31:54.97 ===============
  14. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    I suggest you leave ZA off.
    Make sure Windows firewall is ON.

    You're running two AV programs, Lavasoft Ad-Watch Live! Anti-Virus and AVG.
    One of them has to go.
    I suggest Lavasoft goes.

    Next....

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    ==============================================================

    Download Bootkit Remover to your Desktop.

    • Unzip downloaded file to your Desktop.
    • Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
  15. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    Here are the next two logs

    aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
    Run date: 2012-01-16 19:36:18
    -----------------------------
    19:36:18.489 OS Version: Windows 6.0.6002 Service Pack 2
    19:36:18.489 Number of processors: 2 586 0xF02
    19:36:18.489 ComputerName: ATHENA UserName: Joe
    19:36:45.929 Initialize success
    19:43:46.874 AVAST engine defs: 12011601
    20:05:56.223 The log file has been saved successfully to "L:\virus removal instructions\aswMBR\aswMBR.txt"


    Bootkit Remover
    (c) 2009 Esage Lab
    www.esagelab.com

    Program version: 1.2.0.1
    OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6
    002), 32-bit

    System volume is \\.\C:
    \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
    Boot sector MD5 is: ce8901d28a2b8c635e22b4216ab678c2

    Size Device Name MBR Status
    --------------------------------------------
    372 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>


    Done;
    Press any key to quit...
  16. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    Zonealarm is off as is Lavasoft. However, i received the following error when trying to start Windows firewall "Due to an unidentified problem, Windows cannot display Windows Firewall settings.":
  17. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    If you're behind a router we can take care of the above little bit later.
    Let me know.

    Please download and run ListParts by Farbar (for 32-bit system)

    Please download and run ListParts64 by Farbar (for 64-bit system)

    Click on Scan button.

    Scan result will open in Notepad.
    Post it in your next reply.
  18. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    ListParts by Farbar
    Ran by Joe on 17-01-2012 at 01:25:09
    Windows Vista (X86)
    Running From: L:\virus removal instructions\ListParts64
    ************************************************************

    ========================= Memory info ======================

    Percentage of memory in use: 54%
    Total physical RAM: 2045.76 MB
    Available physical RAM: 940.75 MB
    Total Pagefile: 4330.78 MB
    Available Pagefile: 2626.36 MB
    Total Virtual: 2047.88 MB
    Available Virtual: 1955.7 MB

    ======================= Partitions =========================

    1 Drive c: (HP) (Fixed) (Total:296.11 GB) (Free:24.24 GB) NTFS ==>[Drive with boot components (obtanied from BCD)]
    2 Drive d: (Recovery) (Fixed) (Total:7.79 GB) (Free:0.88 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    8 Drive j: (Windows 7) (Fixed) (Total:68.71 GB) (Free:68.61 GB) NTFS
    9 Drive l: () (Removable) (Total:0.47 GB) (Free:0.46 GB) FAT

    Disk ### Status Size Free Dyn Gpt
    -------- ---------- ------- ------- --- ---
    Disk 0 Online 373 GB 0 B
    Disk 1 No Media 0 B 0 B
    Disk 2 No Media 0 B 0 B
    Disk 3 No Media 0 B 0 B
    Disk 4 No Media 0 B 0 B
    Disk 5 Online 484 MB 0 B

    Partitions of Disk 0:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 296 GB 32 KB
    Partition 2 Primary 69 GB 296 GB
    Partition 3 Primary 7978 MB 365 GB

    Disk: 0
    Partition 1
    Type : 07
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 C HP NTFS Partition 296 GB Healthy System (partition with boot components)

    Disk: 0
    Partition 2
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 2 J Windows 7 NTFS Partition 69 GB Healthy

    Disk: 0
    Partition 3
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 3 D Recovery NTFS Partition 7978 MB Healthy

    Partitions of Disk 5:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 483 MB 16 KB

    Disk: 5
    Partition 1
    Type : 06
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 8 L FAT Removable 483 MB Healthy



    ****** End Of Log ******
  19. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  20. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    CombFix is almost finished but ZoneAlarm, which starts automatically when I had to reboot has stopped a file called pef.3xe and I couldn't find any useful information about it. Should I allow pef.3xe to run or not? ComboFix appears to be in a holding pattern until something is done about this file.
  21. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    It's legit Combofix file.
  22. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    It's official, ComboFix is frozen. After your last message, I allowed ZoneAlarm to permit the file to run, shut down ZA since it kept asking and CF has not finished. It was at the point were it was creating the report. Any ideas for a next step?
  23. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    Restart manually and Combofix report may pop-up.
    If not re-run Combofix from Safe Mode.
    IMPORTANT! When Combofix is done make sure it restarts to Safe Mode so ZA won't interfere.
  24. Ninja Teddybear

    Ninja Teddybear Newcomer, in training Topic Starter Posts: 39

    Here is the ComboFix log:

    ComboFix 12-01-17.01 - Joe 12-01-17 17:49:49.2.2 - x86 NETWORK
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.2046.1345 [GMT -5:00]
    Running from: c:\users\Joe\Desktop\ComboFix.exe
    AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
    FW: ZoneAlarm Free Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
    SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\windows\jestertb.dll
    c:\windows\system32\drivers\etc\hosts.ics
    c:\windows\system32\zip32.dll
    .
    ---- Previous Run -------
    .
    c:\users\Joe\AppData\Local\brlj.exe
    c:\users\Joe\AppData\Local\jjsi.exe
    c:\users\Joe\AppData\Local\xysb.exe
    c:\users\Joe\AppData\Local\ywgu.exe
    c:\users\Joe\Documents\~WRL0066.tmp
    c:\users\Joe\Documents\~WRL0500.tmp
    c:\windows\$NtUninstallKB2808$\3287945666
    c:\windows\HPCPCUninstaller-6.3.2.139-6811507.exe
    c:\windows\system32\drivers\OCA_LOG.TXT
    c:\windows\system32\SET85E7.tmp
    c:\windows\system32\SET8639.tmp
    J:\install.exe
    .
    -- Previous Run --
    .
    c:\windows\system32\drivers\netbt.sys was missing
    Restored copy from - c:\combofix\HarddiskVolumeShadowCopy1_!Windows!System32!drivers!netbt.sys
    .
    --------
    .
    c:\windows\system32\drivers\netbt.sys was missing
    Restored copy from - c:\combofix\HarddiskVolumeShadowCopy1_!Windows!System32!drivers!netbt.sys
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-12-17 to 2012-01-17 )))))))))))))))))))))))))))))))
    .
    .
    2012-01-17 23:05 . 2012-01-17 23:15 -------- d-----w- c:\users\Joe\AppData\Local\temp
    2012-01-17 23:05 . 2012-01-17 23:05 -------- d-----w- c:\users\IUSR_NMPR\AppData\Local\temp
    2012-01-17 23:05 . 2012-01-17 23:05 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-01-17 13:44 . 2012-01-17 17:20 -------- d-----w- C:\New Folder (2)
    2012-01-16 08:14 . 2012-01-16 08:14 0 ---ha-w- c:\users\Joe\AppData\Local\BIT8375.tmp
    2012-01-08 21:06 . 2012-01-08 21:06 -------- d-----w- c:\program files\Complete Canadian Wills Kit
    2012-01-08 21:06 . 2012-01-08 21:06 -------- d-----w- c:\windows\Complete Canadian Wills Kit
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-03 17:06 . 2011-05-16 09:53 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]
    .
    [HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
    2008-10-16 23:22 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar2.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
    2010-05-09 15:50 2517088 ----a-w- c:\program files\ZoneAlarm\tbZone.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
    2011-12-07 09:56 1547104 ----a-w- c:\program files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar2.dll" [2008-10-16 333192]
    "{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]
    "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll" [2011-12-07 1547104]
    .
    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
    .
    [HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
    .
    [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
    [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
    [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]
    "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar2.dll" [2008-10-16 333192]
    .
    [HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
    .
    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
    "gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
    "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 4349952]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
    "CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
    "Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-11-18 623880]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "PDFHook"="c:\program files\Nuance\PDF Professional 6\pdfpro6hook.exe" [2009-07-27 1275168]
    "PDF6 Registry Controller"="c:\program files\Nuance\PDF Professional 6\RegistryController.exe" [2009-07-27 110880]
    "Nuance PDF Professional 6-reminder"="c:\program files\Nuance\PDF Professional 6\Ereg\Ereg.exe" [2008-11-03 54560]
    "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
    "DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" [2007-04-16 259624]
    "NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-13 90191]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-13 7766016]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-13 81920]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2011-11-10 73360]
    "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2011-12-07 827232]
    "QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-03 83568]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2010-9-14 271736]
    HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]
    HP Connections.lnk - c:\program files\HP Connections\6811507\Program\HP Connections.exe [2007-6-7 34520]
    Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-23 113024]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MySoftware NewsFlash.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MySoftware NewsFlash.lnk
    backup=c:\windows\pss\MySoftware NewsFlash.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
    backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^Users^Joe^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Launch Microsoft Office Outlook.lnk]
    path=c:\users\Joe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Launch Microsoft Office Outlook.lnk
    backup=c:\windows\pss\Launch Microsoft Office Outlook.lnk.Startup
    backupExtension=.Startup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherEye
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
    2009-04-29 20:38 188728 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
    2010-09-01 06:39 1164584 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Updater]
    2009-12-18 11:37 160752 ----a-w- c:\program files\Google\Google Updater\GoogleUpdater.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
    2006-09-29 16:39 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
    2005-02-17 00:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
    2005-02-17 00:15 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickFinder Scheduler]
    2007-01-03 04:21 83568 ----a-w- c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Seagate Dashboard]
    2010-04-30 14:47 79112 ----a-w- c:\program files\Seagate\Seagate Dashboard\MemeoLauncher.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    2011-01-26 22:05 15026056 ----a-r- c:\program files\Skype\Phone\Skype.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2007-06-07 16:15 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tracker]
    2000-06-14 18:36 94208 ----a-w- c:\program files\MySoftware\MyInvoices\Tracker.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    2008-01-19 03:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2653832812-3943419955-1683580725-1001]
    "EnableNotificationsRef"=dword:00000003
    .
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-23 116608]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-01-17 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-01 09:34]
    .
    2012-01-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-31 01:24]
    .
    2012-01-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-05-31 01:24]
    .
    2010-04-09 c:\windows\Tasks\Install.job
    - c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2010-04-08 16:10]
    .
    2012-01-17 c:\windows\Tasks\User_Feed_Synchronization-{9498605F-A8F7-465C-9A03-8FF9DF06D782}.job
    - c:\windows\system32\msfeedssync.exe [2011-07-11 04:32]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
    uInternet Settings,ProxyOverride = *.local
    IE: Append the content of the link to existing PDF file - c:\program files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
    IE: Append the content of the selected links to existing PDF file - c:\program files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML
    IE: Append to existing PDF file - c:\program files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
    IE: Create PDF file - c:\program files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
    IE: Create PDF file from the content of the link - c:\program files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
    IE: Create PDF files from the selected links - c:\program files\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    IE: Open with Nuance PDF Converter 6.0 - c:\program files\Nuance\PDF Professional 6\cnvres_eng.dll /100
    IE: Open with PDF Professional 6 - c:\program files\Nuance\PDF Professional 6\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
    IE: Open with WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
    Trusted Zone: real.com\rhap-app-4-0
    Trusted Zone: real.com\rhapreg
    TCP: DhcpNameServer = 192.168.1.1
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
    FF - ProfilePath - c:\users\Joe\AppData\Roaming\Mozilla\Firefox\Profiles\fetmiiu1.default\
    FF - prefs.js: browser.startup.homepage -
    FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4da782a2&v=7.008.031.001&i=23&tp=ab&iy=&ychte=ca&lng=en-US&q=
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: IE Tab 2 (FF 3.6+): {1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} - %profile%\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
    Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
    HKCU-Run-PhotoJoy - c:\program files\PhotoJoy\bin\PhotoJoy.exe
    HKLM-Run-ISW - (no file)
    MSConfigStartUp-Memeo AutoSync - c:\program files\Memeo\AutoSync\MemeoLauncher2.exe
    MSConfigStartUp-Memeo Instant Backup - c:\program files\Memeo\AutoBackup\MemeoLauncher2.exe
    MSConfigStartUp-Memeo Send - c:\program files\Memeo\Memeo Send\MemeoLauncher.exe
    AddRemove-OVT Scanner - c:\windows\omniuns.exe USB\Vid_05a9&PID_1550 OVT Scanner
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2012-01-17 18:15
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:00000020
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\nvvsvc.exe
    c:\windows\system32\nvvsvc.exe
    c:\program files\CheckPoint\ZAForceField\IswSvc.exe
    c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    c:\program files\APC\APC PowerChute Personal Edition\mainserv.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\AskBarDis\bar\bin\AskService.exe
    c:\program files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Common Files\Creative Labs Shared\Service\APLicensing.exe
    c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
    c:\program files\Nuance\PDF Professional 6\PDFProFiltSrv.exe
    c:\windows\system32\PSIService.exe
    c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
    c:\windows\system32\conime.exe
    c:\program files\Seagate\Seagate Dashboard\SeagateDashboardService.exe
    c:\program files\ShadowExplorer\sesvc.exe
    c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe
    c:\windows\RtHDVCpl.exe
    c:\windows\System32\rundll32.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\windows\system32\WUDFHost.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\program files\APC\APC PowerChute Personal Edition\dataserv.exe
    c:\windows\ehome\ehmsas.exe
    c:\program files\Windows Media Player\wmpnscfg.exe
    c:\windows\ehome\ehsched.exe
    c:\program files\APC\APC PowerChute Personal Edition\apcsystray.exe
    c:\hp\kbd\kbd.exe
    c:\windows\ehome\ehRecvr.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\windows\system32\wbem\WmiApSrv.exe
    .
    **************************************************************************
    .
    Completion time: 2012-01-17 18:24:18 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-01-17 23:24
    .
    Pre-Run: 26,702,266,368 bytes free
    Post-Run: 26,569,707,520 bytes free
    .
    - - End Of File - - 6ED5CF6ABF573001713BDED4EE8F4FF3
  25. Broni

    Broni Malware Annihilator Posts: 46,339   +252

    Looks good.

    How is computer doing?

    If ZA still gives issues with internet connection I suggest you uninstall it completely.

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.